Malware Analysis Report

2024-09-22 09:05

Sample ID 240727-vpt88asgrh
Target 78e7f1563c25848c3762b61c2a49087c_JaffaCakes118
SHA256 52b15158cd920cb369a6e000be8e17206913fc5f06fdbb5e87403ab30f17e820
Tags
cybergate cyber discovery persistence stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

52b15158cd920cb369a6e000be8e17206913fc5f06fdbb5e87403ab30f17e820

Threat Level: Known bad

The file 78e7f1563c25848c3762b61c2a49087c_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

cybergate cyber discovery persistence stealer trojan upx

CyberGate, Rebhip

Boot or Logon Autostart Execution: Active Setup

Adds policy Run key to start application

Executes dropped EXE

Uses the VBS compiler for execution

UPX packed file

Loads dropped DLL

Adds Run key to start application

Drops file in System32 directory

Suspicious use of SetThreadContext

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious behavior: GetForegroundWindowSpam

Modifies registry class

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-07-27 17:10

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-27 17:10

Reported

2024-07-30 11:46

Platform

win7-20240729-en

Max time kernel

147s

Max time network

149s

Command Line

C:\Windows\Explorer.EXE

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{IIJG4L86-7V87-IK6O-38JM-CF0M3IKTCR20}\StubPath = "C:\\Windows\\system32\\install\\server.exe" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{IIJG4L86-7V87-IK6O-38JM-CF0M3IKTCR20} C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{IIJG4L86-7V87-IK6O-38JM-CF0M3IKTCR20}\StubPath = "C:\\Windows\\system32\\install\\server.exe Restart" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{IIJG4L86-7V87-IK6O-38JM-CF0M3IKTCR20} C:\Windows\SysWOW64\explorer.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\install\server.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Uses the VBS compiler for execution

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\Testing = "C:\\ProgramData\\Svg64.exe" C:\Users\Admin\AppData\Local\Temp\78e7f1563c25848c3762b61c2a49087c_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\server.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\server.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\install\server.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\install\server.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\install\server.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\install\ C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2188 set thread context of 2376 N/A C:\Users\Admin\AppData\Local\Temp\78e7f1563c25848c3762b61c2a49087c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\install\server.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\78e7f1563c25848c3762b61c2a49087c_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\explorer.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2188 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\78e7f1563c25848c3762b61c2a49087c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2188 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\78e7f1563c25848c3762b61c2a49087c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2188 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\78e7f1563c25848c3762b61c2a49087c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2188 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\78e7f1563c25848c3762b61c2a49087c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2188 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\78e7f1563c25848c3762b61c2a49087c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2188 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\78e7f1563c25848c3762b61c2a49087c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2188 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\78e7f1563c25848c3762b61c2a49087c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2188 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\78e7f1563c25848c3762b61c2a49087c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2188 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\78e7f1563c25848c3762b61c2a49087c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2188 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\78e7f1563c25848c3762b61c2a49087c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2188 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\78e7f1563c25848c3762b61c2a49087c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2188 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\78e7f1563c25848c3762b61c2a49087c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 1172 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\78e7f1563c25848c3762b61c2a49087c_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\78e7f1563c25848c3762b61c2a49087c_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"

C:\Windows\SysWOW64\install\server.exe

"C:\Windows\system32\install\server.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.server.com udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp

Files

memory/2188-0-0x0000000074B31000-0x0000000074B32000-memory.dmp

memory/2188-1-0x0000000074B30000-0x00000000750DB000-memory.dmp

memory/2188-2-0x0000000074B30000-0x00000000750DB000-memory.dmp

memory/2376-3-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2376-13-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2376-19-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2376-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2376-15-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2376-11-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2376-9-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2376-7-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2376-5-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2376-20-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2376-21-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2376-25-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2188-26-0x0000000074B30000-0x00000000750DB000-memory.dmp

memory/1172-30-0x00000000029E0000-0x00000000029E1000-memory.dmp

memory/2376-29-0x0000000010410000-0x0000000010475000-memory.dmp

memory/1624-313-0x00000000000A0000-0x00000000000A1000-memory.dmp

memory/1624-312-0x00000000000E0000-0x00000000000E1000-memory.dmp

memory/1624-565-0x0000000010480000-0x00000000104E5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

MD5 571fd566d9ad40e38a30a9ce89667aba
SHA1 ad01a33387f6f17e1435a2dd1b353e5daa2f3e60
SHA256 c42c0cf3a968cb0cf80f6f8c880e86c8e7609ca5cd24c158554178bab0f955f8
SHA512 04bfe55441d98e4e2fc4a44cfc175e281ae04f4c07bf60412204730eb2f9cc7b77e3992b894a7b83d842c53c350d63eea1f6f0ad485617283e9d28708bda294f

C:\Windows\SysWOW64\install\server.exe

MD5 34aa912defa18c2c129f1e09d75c1d7e
SHA1 9c3046324657505a30ecd9b1fdb46c05bde7d470
SHA256 6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512 d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

memory/2376-896-0x0000000000400000-0x0000000000451000-memory.dmp

C:\Users\Admin\AppData\Roaming\Adminlog.dat

MD5 bf3dba41023802cf6d3f8c5fd683a0c7
SHA1 466530987a347b68ef28faad238d7b50db8656a5
SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
SHA512 fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 4fffc5f08cda7e70f968c5517c12ea64
SHA1 23d09a3a7a7a318f73cc2a66d454a99e8bd6dd31
SHA256 304b3c5f66c5d201d0d16935add59a2414ccf8d49470852d00bf55cb555117d4
SHA512 d40b8e5a7534b7af0d4519610f7c1737013cec1d2707b48996c12fe582c5eeadf844caeb6b49e948b93a9bdb53a5339a56addc41095546fc23d6ab8e3d8f9a49

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 fd567a1bf4469d132d5351f290ddd619
SHA1 24d183b9b77bc55f8b1098799d7c18458818cd5e
SHA256 b9aeed834a50ca4359970e5a39a41b096cca5bca4d79a4e49343ee3d61c43691
SHA512 612d24126319bf5e69e40e2f91f563084ae79fd6355250c7419711437ffaf7cd3c08bf2159d9d8762657e419f546f38ba53ef3f30b9a2bdf1b5a25ab77a87c00

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 d4df5810e9e5900e62f899729eab5eb7
SHA1 26f5dd81ad04afd4613f9754753b343ee98f0cd3
SHA256 f0cfde9414fd8ad1eb14a64e7e6ffc2c364e4637947b563f941206131a67dc5d
SHA512 7bea78623fd50df33e3ab5216c87ac8bce70df8b8e19c4fba909197d465273a07456f3fb9e8346d296bfba75a86df9921e8ae81ee2f453a3a8e0b305668110d4

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 b0bdcc71b6694531ce63ef2cae9c3482
SHA1 21a385d435cf18293870ee42b16fb37b2e5b77e0
SHA256 9c2c331dbe248e6c5fdd94709e4aed1dc9524ca6c37fa4fb17150bfa12aedfe6
SHA512 e65b62360b6816dc0b55edfd571bb94cbfcf3fb28d6bb170ddfc620dc5f13a518d0b2e72c37e2f056a9fd78e8826bfdb125f09ddb7d12c114b85546207b8cf6e

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 8782992558871bb7fef30b5b159b9014
SHA1 c039ede80a39e50b81bf7fa13e6b3f93fc243c33
SHA256 e8b446d27523358fcf8606b4c5a8b9ab6d3aa177b0012fa7b8e065361971fa8c
SHA512 eebd3b35bd8fc3310e9e858bc8d5f09c77345601574af9e0706f505cc93e6838affd0b043b25dd0b13f98d1755ac7580d6fae51d621a21d5245c6293c159fcd3

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 a6757b5d6ef04f806daab19a7202642c
SHA1 6e47af2599de0c92f27a173e527b1edc30dd0523
SHA256 dca5362db08f0394d301b1f5753dda49abcbfc5ab28374f2a05d9eb86647633c
SHA512 b0b0acc2b279dbd83afc6e033ad1ae6cfc5f89502ae1740051c95dea6fa9bdb9861cdfd80a9d29a92084c3609fdc0881957ab7bdebf34111e32b6719c60ac4cd

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 bfd4a97f0e69974b6de00030a21668b2
SHA1 0fab99ef5c8bda7f117fde24ddaa03055eb80b9b
SHA256 2d12a171eca9d4b44e6e57e64dc9ae7137ab5f9e8a080ab75663b65a09bdf034
SHA512 8437f4727d900a544ddfd50fb36b84427033b8dd612c14db01754554b2c933c374b6b5902903badd76aa83487434403043559e8a570f12ffa6e46d0bb8b2a307

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 e4ce3b9ad7371c8a0ffd44cff700a2c1
SHA1 96d703e51daf3b9aa09f8839b1fd487efb9c48a6
SHA256 181c2a67041f5a690a9a73d63e29b8e3b2ab163f37a13c5c117fcb8664272356
SHA512 b57c2fbf90fb93f27ed556c2440e26255339fe0e70e02fae962176edd41d660c06ee524b4259b360e8e94498206149b89707c80db5aad8c154441283ca11c780

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 8275b6be92b3f6ccec1295a94743c87e
SHA1 0d3cba6eb1f34d122474abf33c805287449e81ad
SHA256 06e2b08fcdbb6c9f6c57937015f221fbdb249cc7218f22212111f89f182ca9e2
SHA512 5836642694f6f274a7b16082d04df9efa1ed04694eb127cfdf68a079fbab4d0b874a0f00d1be4f261a2b746f72363e6c7648a898e29cf2b833619d262e791a28

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 fc566824674e737ef1c406e5c54785e4
SHA1 bf987951ce8743410bf2216bcd7aed005dfc8029
SHA256 35ef74443f7822e0307ddb55ce177aa0b3bb8c790ce9159ed447239692d43e1d
SHA512 6d9dc54ea16de5dcf90c8a2a939e6fa50b1d855b588ea4ed70c94aa4237ce2a12dfa6d1c656023d468d2422cb6a6bb10b50980378d0782a6f19da7224334fd5f

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 d53d2039989eac051123a9f202783023
SHA1 ae6e8be937e8996662864ab81578e09cdb64097a
SHA256 b2d6b7b2df1c5427f19b3ef1333bd4d5ab739979fe1b6943e5fda886f7f799f1
SHA512 70e1eecd3c74329bd006302d9aff77de0b86d5b5594baac7f53dbb88b5ca240f278b730337e053f9a90406643d44d999d2ecd2327ddcc3a50eee8f1823214244

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 21141eb8e836634bc6c5a8b7705ffdcf
SHA1 7419afa430c18aa5de3bfc648809881a94d4c6f5
SHA256 a3208d7a279f0db51272b32844d62c25fa770cbc877bc7f1b946c940def85b99
SHA512 e8eb005fd8be4a998a526587d1164889aa42c1567cb25f0789f0dce5ac0b665188338a831734131ad9acbb9432a534363e26e3b3c2dd072a720ae76dd263eb00

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 5de44c3dc76034793af0d206a867d7bb
SHA1 67b9a52dc80f61a895e13fe2074d4da21cbf97a6
SHA256 3e866be9b75b528d672505b52b8190be579852fde10ab2d41a8e69e89c374c69
SHA512 1fa28b2d6949194283e66c2119d2967ef48478f0431b571474e97a8323a87cba3fbeb8f4756688c8928e33436995cef05c71acd23a327748c4f6638481645a17

memory/1624-1520-0x0000000010480000-0x00000000104E5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 c65beee0aa69f0fb040ffc28b8aaf186
SHA1 6f6ed70c2ee72c4d13b2b976ddcd46230f4819cc
SHA256 1eae32bb2c6027c42c68cc6c4c12bc2814eecccc6298d6dd3b1d4198b8c56229
SHA512 3658819e49c3fd077a6fc897606031bd906e5609b4b711ab905dccd8d379e433f90d9411d1b8df6dd613f4a520f23772675e407fcd073c3251553125312a1908

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 a26349be84a6b5b8de79353f1091849d
SHA1 aafff19ac8cfeef8b3bf6fcc35640c627ecfe60b
SHA256 828358d4c3b2451177d8885f037a0ab945c03936a306a8b8451ee8087540b04f
SHA512 c94ce201a62aa54adbc612855080d3b7c4e4df8d869c4f2b4861a4fc525eb66a8fd510f7eebf8e30924d862ab5a8bfe5d72edc111a87bf2035889d7fd69f341d

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 a77dc182af529a09d24d71d3ac1a6e17
SHA1 fc483a21ff6edacd9e6ce7d2bb6b955cca369f3f
SHA256 dbb49aeaea1c769c4377dea508135b4c4bf392dd9ab309c3fb3872d833e81992
SHA512 2b39e409360ba4d3ce081cea43a97650eec0d8aac03d3df51c72f228f4f98043e70f58bd3a6043da86e9196f621810bf2124c864b768446d19e49a86cf65050c

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 6e55e4797dc9628b45c31d25cec5205b
SHA1 a1fd62f53574e9a2dc914ecacf0c4f133dc3f1e0
SHA256 dd5750a32933c75c49ae9fbb7d981d36046ad0790be7190672aca123a111c604
SHA512 f11ab89c36f7b3e6107a23b8497512b67a858400a5f546f709206285ddc6be307807fe2d08c6a9067a404e8f35222e55a0beb488c6f9e221e6c5e0d690e4870d

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 dfca6ac4e3cf8201e0ffa88d871b6bf4
SHA1 c8f81e00b78e9baac0dd8bf5b7e4a3200ac13b60
SHA256 934e0e694dfbb8c012e652783ed5a8c36e7ae0d99862d39e72bf051403353e05
SHA512 7a8a578598b0650675f99f3a45c05130c8f23b43b3d583c886e04316ec0bab4c6b8bd712cd5c0f42c2b15e4717552d958011e291b11f3080682d3adaeb18aac9

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 5f88a3c8e1fe0f19298699f0f6d5dca7
SHA1 78579ff48748d817f22f0bb83fad33b45de46724
SHA256 ffe1c2fbebbb6c7652d8ca70e3419bed1ef3a575ed392a5b2c720e84cc80629a
SHA512 50198ae0327c9287669fde7e6de6eb551db0d397b9ddf9c9726a5fefb3d3466f21e8999e4c955729ee29697088b42cf586704af7d8afbf63f1f54102126f76a1

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 d2a8ce807e38b2532b38483965610528
SHA1 59666efa5f1038a9aacc9d5afddbb958625803cd
SHA256 ba93e375ba3c81d40fb532835063ce021f66056e5076fb0b333acaa63aa2cf47
SHA512 172319f7c8d2c8d750240b2ddbefc11ff9635bca61e391e6eb0708a3a74a995ddc859c8647fd2c4bb9b4cb9dae8e9c969ce7b98da8ce7171d62808d894f83e04

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-27 17:10

Reported

2024-07-30 11:46

Platform

win10v2004-20240709-en

Max time kernel

147s

Max time network

151s

Command Line

C:\Windows\Explorer.EXE

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{IIJG4L86-7V87-IK6O-38JM-CF0M3IKTCR20} C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{IIJG4L86-7V87-IK6O-38JM-CF0M3IKTCR20}\StubPath = "C:\\Windows\\system32\\install\\server.exe" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{IIJG4L86-7V87-IK6O-38JM-CF0M3IKTCR20} C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{IIJG4L86-7V87-IK6O-38JM-CF0M3IKTCR20}\StubPath = "C:\\Windows\\system32\\install\\server.exe Restart" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\install\server.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Uses the VBS compiler for execution

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Testing = "C:\\ProgramData\\Svg64.exe" C:\Users\Admin\AppData\Local\Temp\78e7f1563c25848c3762b61c2a49087c_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\server.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\server.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\install\server.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\install\server.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\install\server.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\install\ C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2908 set thread context of 4696 N/A C:\Users\Admin\AppData\Local\Temp\78e7f1563c25848c3762b61c2a49087c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\install\server.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\78e7f1563c25848c3762b61c2a49087c_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2908 wrote to memory of 4696 N/A C:\Users\Admin\AppData\Local\Temp\78e7f1563c25848c3762b61c2a49087c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2908 wrote to memory of 4696 N/A C:\Users\Admin\AppData\Local\Temp\78e7f1563c25848c3762b61c2a49087c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2908 wrote to memory of 4696 N/A C:\Users\Admin\AppData\Local\Temp\78e7f1563c25848c3762b61c2a49087c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2908 wrote to memory of 4696 N/A C:\Users\Admin\AppData\Local\Temp\78e7f1563c25848c3762b61c2a49087c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2908 wrote to memory of 4696 N/A C:\Users\Admin\AppData\Local\Temp\78e7f1563c25848c3762b61c2a49087c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2908 wrote to memory of 4696 N/A C:\Users\Admin\AppData\Local\Temp\78e7f1563c25848c3762b61c2a49087c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2908 wrote to memory of 4696 N/A C:\Users\Admin\AppData\Local\Temp\78e7f1563c25848c3762b61c2a49087c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2908 wrote to memory of 4696 N/A C:\Users\Admin\AppData\Local\Temp\78e7f1563c25848c3762b61c2a49087c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2908 wrote to memory of 4696 N/A C:\Users\Admin\AppData\Local\Temp\78e7f1563c25848c3762b61c2a49087c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2908 wrote to memory of 4696 N/A C:\Users\Admin\AppData\Local\Temp\78e7f1563c25848c3762b61c2a49087c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2908 wrote to memory of 4696 N/A C:\Users\Admin\AppData\Local\Temp\78e7f1563c25848c3762b61c2a49087c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2908 wrote to memory of 4696 N/A C:\Users\Admin\AppData\Local\Temp\78e7f1563c25848c3762b61c2a49087c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2908 wrote to memory of 4696 N/A C:\Users\Admin\AppData\Local\Temp\78e7f1563c25848c3762b61c2a49087c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4696 wrote to memory of 3580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\78e7f1563c25848c3762b61c2a49087c_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\78e7f1563c25848c3762b61c2a49087c_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"

C:\Windows\SysWOW64\install\server.exe

"C:\Windows\system32\install\server.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 www.server.com udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp

Files

memory/2908-0-0x0000000074942000-0x0000000074943000-memory.dmp

memory/2908-1-0x0000000074940000-0x0000000074EF1000-memory.dmp

memory/2908-2-0x0000000074940000-0x0000000074EF1000-memory.dmp

memory/4696-4-0x0000000000400000-0x0000000000451000-memory.dmp

memory/4696-3-0x0000000000400000-0x0000000000451000-memory.dmp

memory/4696-7-0x0000000000400000-0x0000000000451000-memory.dmp

memory/4696-5-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2908-11-0x0000000074940000-0x0000000074EF1000-memory.dmp

memory/4696-15-0x0000000010410000-0x0000000010475000-memory.dmp

memory/4036-20-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

memory/4036-19-0x0000000000D20000-0x0000000000D21000-memory.dmp

memory/4696-18-0x0000000010480000-0x00000000104E5000-memory.dmp

memory/4036-23-0x00000000000C0000-0x00000000004F3000-memory.dmp

memory/4696-76-0x0000000010480000-0x00000000104E5000-memory.dmp

C:\Windows\SysWOW64\install\server.exe

MD5 d881de17aa8f2e2c08cbb7b265f928f9
SHA1 08936aebc87decf0af6e8eada191062b5e65ac2a
SHA256 b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA512 5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

MD5 571fd566d9ad40e38a30a9ce89667aba
SHA1 ad01a33387f6f17e1435a2dd1b353e5daa2f3e60
SHA256 c42c0cf3a968cb0cf80f6f8c880e86c8e7609ca5cd24c158554178bab0f955f8
SHA512 04bfe55441d98e4e2fc4a44cfc175e281ae04f4c07bf60412204730eb2f9cc7b77e3992b894a7b83d842c53c350d63eea1f6f0ad485617283e9d28708bda294f

memory/4696-151-0x0000000000400000-0x0000000000451000-memory.dmp

memory/4660-152-0x0000000010560000-0x00000000105C5000-memory.dmp

C:\Users\Admin\AppData\Roaming\Adminlog.dat

MD5 bf3dba41023802cf6d3f8c5fd683a0c7
SHA1 466530987a347b68ef28faad238d7b50db8656a5
SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
SHA512 fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 a119d8f105fbd0754ee116743efe1370
SHA1 7fa67ec155099f68574f6014b2ee3986314f5c86
SHA256 7ee116126210c85665e103eb7063271bc72bcb8c8615f8a90a9954c1d772f087
SHA512 dd175e99e056b03211c4548d238cc22dc87400db9ac2fee0b4d7d527cac6780b75588e3ccb1dbdde35377b145861ce99e3ad98ccffcf47f312df19a6eb58b583

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 ec5772e8dcb4b596e3857991785a3d0d
SHA1 203fddd5e663fdf3c57fc6b9ad9c54b6c8a5a095
SHA256 674bc95d0526a11f7c20ede1d2406901ce8c97ce91d385c2c2d82f4c810fb30f
SHA512 2fc7f97bc5b379d1a836bc977307b308194385210ea55842cf12ed47d9605b110b20def545290bf259d3b20f545737e9c99e6e82945f89ac73db82fc4c0ef68c

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 4b742d91af69bbbda200001f3a5d3519
SHA1 c10661f937c673545caab224748431cf3c76ee9d
SHA256 3fef80aa1ec9c382802505d26232aa95642174e7f98e29fcf61a3be8cdefddcc
SHA512 1af4088aea566d4914ae3d6a1b82d16d001e972d5acfba71ab59c33e2672892848e826d8499dac59f0567a6df7dec967fa426147bbe87e7143af7ab129df1f1f

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 db3ef8425c13bcd73aaf68ba362bfcda
SHA1 89d6bf4bcdf4dd5ee845dd12086937c4911668cf
SHA256 edf5481cf4d890825a8d8bcd9b613a53f5dc0caa8d07379121a61c3bf07e7a2f
SHA512 f95ff95e27ad7efbe34ebd1489aa43c6748d5f3e0fed8352e5c74d38dcd35504e1ef6286c3f9ed21e9b13377358c3ff466e1087624eedae7ac2fb674eaba9859

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 23689262392eb6deb4b3bfe2ef8cc503
SHA1 2cac931dfd8992cae512316beb108c0392ada89c
SHA256 5910c3ed3702faf0f22753d086bb771d556a1645ff3175960a5a335018618949
SHA512 e7f855416d82eb5a643cefc5ea93257e19c32a9f95e4c821fcbd6cf1647d75b70c24c82f39042085dc2ea653dcef15ccee9710d15b3b2804bb4369ba9a5c77cb

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 950a6f667be1b761de3ff27e885f32b6
SHA1 3e6cf132cd64f69e375886b1ca4d754d504eb4da
SHA256 6e7f8c42fd4b808b1342692048db6af8b0bdf420fb016bd33cd63ba0781f75c2
SHA512 ab06abe33f7333117f6ee948c443d23e5401b0767027047e74219ec7bfa69ce817c7d4ce24e490a0991bb8147cba6fcdf06e7bf654c0876ee0a3a9d85a90db35

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 175f09d8a0c94bc589bad5a8b57b1b80
SHA1 b7bf57e2b1a3f9f731dd5d1487c19219d5d186f7
SHA256 3c71299637785c570c6a241278195047916976bdd326f0888d855935f8efc5b8
SHA512 cf5feed22e49634ad3287881c8e1904be383b74d2ca10951276cbbf65c1b550087733663d5978509f45fdc4254cfea2eff204195074da57e395502ca0c806d16

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 bfc4b6a927614a88d6366d2a1b0c4a42
SHA1 77e2475d32fd8099560e5b730fec8f6067773889
SHA256 36161f41bfaa0908b9a6a6522adfe892412ad08918e0e26d22c3a76212be8b0a
SHA512 22ee9d292c03cc7c5cb2da680007f67192c1e4b541a54ee33af8638921330008f93291041484469f8ba4f159b1eacb6813f4de0787e3f7d44fb85a3225657727

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 bff3753e30491ed42d4c8186c8829e9f
SHA1 9962094428099f79bffaa606ffff7beb75b44a97
SHA256 721f0d1960830e3dc92fa6af97cb3b1db59064497b9ef0633982f9d18ee241f6
SHA512 c7a4bba753285e09b8f69fe9ef135598c1b76c360c957b8fcb694d8cd8304b93a4d5b5b4081a1d21cf17b8eaf92aaa7fad123e289f54021082ae3de10c08d2eb

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 71c6eba6244773c7d1f63ffa4b1c844d
SHA1 2df253c0bb2af5d5a9f4f7c4fda08b9fca418329
SHA256 73a68951e751699c133f97ae285809a87f6e504ecfbd5979cf0a9d162dcf7da7
SHA512 c8f8454a583fbe1eda077fe8df54efd48f55a65bf799073dd0d503ed110a5c2880ddf0d05ae31a549903b6d9a3a60895420791f03acbce9b277db8bfa173a219

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 730a4b80816431dcd258f733cacde00e
SHA1 cdd1d18bc5f5e103f1b15d9feb6b5bc5951784f5
SHA256 3485b449b438ff48b4489d2d5cedeafb0f7b43c66380437108c6fa27c2cb9b46
SHA512 78a78a41aa4014819d5e145dcb0888e234adafe40ce0244f2ec528508e77997aa04b7147733de7ca73877af14970a914d585bf61400f5c8bed13e4f1ac33c6d4

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 283d76d2da9d9fd6e6f777dd8d04c0e5
SHA1 9e4ddb894b19b2f824806592dd81a13894723d74
SHA256 63546e0c7f04cbeefc56978ab756263c26aaaf039fe848f727e73016973428c1
SHA512 613890bb40f22c2f26f2609aee30634e9e90f5355eb499cae39da6f9a1df745b881fb43a4b5d49b837e667db231981a4982c47cfa05e45352c2516429baccaf8

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 c36a1dbd1002e8e928f6c2221e0ff9fb
SHA1 8bb27635f8acdb7610b3920ed9660d852f8feefd
SHA256 ec076af02747a0a7049421aadc63bdda0bd8bdfd064739b8d6941a492e2c8555
SHA512 fbd0f110983ef8d53a94101abf1aa1a619d485e92113398513a373e21a89ca19c9461733f640c89d0025daf9c9872dad9e63c43893c3f9064e80dfad9e3c5772

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 6743bcf0f0ff95db2bd6467f4457a287
SHA1 b0eaf04ed64c59a822240f035ccc9252c4267265
SHA256 75112b2744d91fd3f1f223671903d1957d7c3c412762a01ffafac3d5d1ab37e8
SHA512 e92af7f7ae8e4ea6b5010c364708e3d57a04bf71f50949e346e70e114416e453b0d92215814b9fa2489f7de9199a6e7574d4fe2a697151e4a9d5effe41379ac4

memory/4660-1452-0x0000000010560000-0x00000000105C5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 131e3290fc1fc76148e89c6b6bf9f7e8
SHA1 8610d515af05307faa27dbd12615f801a55d8546
SHA256 982180a33c200372caba9a92c6203b405b15d5939a48e6db5e3631f61f620b41
SHA512 77ccc635ec36e35347563ac70f78a3a89c834e0351f0530e2d7079a6181198a9577d110dac04d2a6811c583454059c401794729e295e3fc6a47ccd16a7cebafe

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 80491361033d99f0070dbbf1a578a6a6
SHA1 491a85e123ae3bdd3dd700ec9bc41397168762fc
SHA256 6745a12995e98672cf6e97654c86d378a0b6185d0281d3b2edcfc61f705d45fe
SHA512 0144070ae5e57ba7b7b3a41db34600592a55bc63f56dd91e33e0b097d9edcf402dd3a8b905d3cf4e176840d8ee79b7094d4e2b0c17a0d1ecba8c7c2fb42d8314

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 a17f26a84a4be54b905adb84e620621f
SHA1 5f9d20c03faf53a803fc376e86c4cfd1c45dfff8
SHA256 04c072b06c73c5aae69073aa1c35ee6edaf402afc41e2e90692be955573d5bbe
SHA512 370315ad1e5ba6e92f780e1b31e48ec5e08fb3becc3a7e34cb8afe9e6169354dd94fa89eff59fd96e88c22e42663d2ce8d88a1a97b4496155d67931472bf017d

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 e83d35a766ac75a6ffa1628b6ebc86fc
SHA1 23a2995e54ae079ae85a8c8dd188e7649fd9791c
SHA256 b5903372032112218a32d95ab18492200055c5f2c74ddbe69e1a2e475937aefb
SHA512 333fa8e3d4a700bf0946f1d3d04659aae0267bb0a8446576733e3bd92eafca773276538d2b324e21329fc445b89985849f7011bed056b7eeedce6f837c8c9492