Malware Analysis Report

2025-01-02 13:58

Sample ID 240830-hxvhqstbjk
Target ca653b09e16390d6fe14b08bf240e011_JaffaCakes118
SHA256 3eb8f02733aec96115d2e220056d9cea8dae63ed943a3baef522f4c0ca62b954
Tags
cybergate backdoor remote discovery persistence stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3eb8f02733aec96115d2e220056d9cea8dae63ed943a3baef522f4c0ca62b954

Threat Level: Known bad

The file ca653b09e16390d6fe14b08bf240e011_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

cybergate backdoor remote discovery persistence stealer trojan upx

CyberGate, Rebhip

Adds policy Run key to start application

Boot or Logon Autostart Execution: Active Setup

Executes dropped EXE

Loads dropped DLL

Uses the VBS compiler for execution

UPX packed file

Drops startup file

Adds Run key to start application

Drops desktop.ini file(s)

Drops file in System32 directory

Suspicious use of SetThreadContext

Program crash

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Suspicious use of SendNotifyMessage

Modifies registry class

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-30 07:07

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-30 07:07

Reported

2024-08-30 07:09

Platform

win7-20240708-en

Max time kernel

147s

Max time network

146s

Command Line

C:\Windows\Explorer.EXE

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\directory\\CyberGate\\install\\server.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\directory\\CyberGate\\install\\server.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{S4KWPT8L-6A3Q-P6RM-8573-OS1KMA30800M}\StubPath = "C:\\Windows\\system32\\install\\server.exe Restart" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{S4KWPT8L-6A3Q-P6RM-8573-OS1KMA30800M} C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{S4KWPT8L-6A3Q-P6RM-8573-OS1KMA30800M}\StubPath = "C:\\Windows\\system32\\install\\server.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{S4KWPT8L-6A3Q-P6RM-8573-OS1KMA30800M} C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlog.exe C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlog.exe C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\install\server.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Uses the VBS compiler for execution

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\server.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\server.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Windows\SysWOW64\explorer.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\install\server.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\install\server.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\install\server.exe C:\Windows\SysWOW64\explorer.exe N/A
File opened for modification C:\Windows\SysWOW64\install\ C:\Windows\SysWOW64\explorer.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\install\server.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1244 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1244 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1244 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1244 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1244 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1244 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1244 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1244 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1244 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1244 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1244 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1244 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1244 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1244 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1244 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1244 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1244 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1244 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1244 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1244 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1244 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1244 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1244 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1244 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2512 wrote to memory of 2824 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2512 wrote to memory of 2824 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2512 wrote to memory of 2824 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2512 wrote to memory of 2824 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2512 wrote to memory of 2824 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2512 wrote to memory of 2824 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2512 wrote to memory of 2824 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2512 wrote to memory of 2824 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2512 wrote to memory of 2824 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2512 wrote to memory of 2824 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2512 wrote to memory of 2824 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2512 wrote to memory of 2824 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2512 wrote to memory of 2824 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2512 wrote to memory of 2824 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2512 wrote to memory of 2824 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2512 wrote to memory of 2824 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2512 wrote to memory of 2824 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2512 wrote to memory of 2824 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2512 wrote to memory of 2824 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2512 wrote to memory of 2824 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2512 wrote to memory of 2824 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2512 wrote to memory of 2824 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2512 wrote to memory of 2824 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2512 wrote to memory of 2824 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2512 wrote to memory of 2824 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2512 wrote to memory of 2824 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2512 wrote to memory of 2824 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2512 wrote to memory of 2824 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2512 wrote to memory of 2824 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2512 wrote to memory of 2824 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2512 wrote to memory of 2824 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2512 wrote to memory of 2824 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2512 wrote to memory of 2824 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2512 wrote to memory of 2824 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2512 wrote to memory of 2824 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2512 wrote to memory of 2824 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2512 wrote to memory of 2824 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2512 wrote to memory of 2824 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2512 wrote to memory of 2824 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2512 wrote to memory of 2824 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\install\server.exe

"C:\Windows\system32\install\server.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1444 -s 556

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.server.com udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp

Files

memory/1244-0-0x00000000747A1000-0x00000000747A2000-memory.dmp

memory/1244-1-0x00000000747A0000-0x0000000074D4B000-memory.dmp

memory/1244-2-0x00000000747A0000-0x0000000074D4B000-memory.dmp

memory/2392-3-0x0000000000400000-0x0000000000450000-memory.dmp

memory/2512-31-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2392-15-0x0000000000400000-0x0000000000450000-memory.dmp

memory/2392-33-0x0000000000400000-0x0000000000450000-memory.dmp

memory/2512-32-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2392-14-0x0000000000400000-0x0000000000450000-memory.dmp

memory/2392-11-0x0000000000400000-0x0000000000450000-memory.dmp

memory/2392-10-0x0000000000400000-0x0000000000450000-memory.dmp

memory/2392-9-0x0000000000400000-0x0000000000450000-memory.dmp

memory/2392-8-0x0000000000400000-0x0000000000450000-memory.dmp

memory/2392-30-0x0000000000400000-0x0000000000450000-memory.dmp

memory/2512-28-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2512-27-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2512-25-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2512-24-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2512-23-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2512-22-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2512-21-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2512-20-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2512-18-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2392-7-0x0000000000400000-0x0000000000450000-memory.dmp

memory/2512-16-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2392-5-0x0000000000400000-0x0000000000450000-memory.dmp

memory/1244-34-0x00000000747A0000-0x0000000074D4B000-memory.dmp

memory/3012-48-0x00000000001E0000-0x00000000001E1000-memory.dmp

memory/2512-37-0x0000000010410000-0x0000000010475000-memory.dmp

memory/3012-53-0x0000000000360000-0x0000000000361000-memory.dmp

memory/3012-42-0x00000000001C0000-0x00000000001C1000-memory.dmp

memory/2512-41-0x0000000010480000-0x00000000104E5000-memory.dmp

memory/2392-57-0x0000000010410000-0x0000000010475000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

MD5 7793b731ff94223a4e18c2d3cae8b1fd
SHA1 442b8ca5aaf4fede6007e5efd8fcc37d0de96b28
SHA256 2be793e92419d0809e077cf993765bfe99732abb5bce5447beac8e569fe21182
SHA512 9b81766a7d55bf554aa0f638fc9c47f11b3dbd4ba61d6f21756c98bac83baaa99b5ad8967f0b0c94d04d6e50121d8ae460443142630b3b5a4ca8b312328326ef

memory/3012-321-0x0000000000400000-0x000000000051E000-memory.dmp

memory/2512-784-0x0000000000400000-0x0000000000451000-memory.dmp

memory/3012-916-0x0000000010480000-0x00000000104E5000-memory.dmp

C:\Windows\SysWOW64\install\server.exe

MD5 34aa912defa18c2c129f1e09d75c1d7e
SHA1 9c3046324657505a30ecd9b1fdb46c05bde7d470
SHA256 6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512 d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

memory/3028-917-0x0000000010480000-0x00000000104E5000-memory.dmp

C:\Users\Admin\AppData\Roaming\Adminlog.dat

MD5 bf3dba41023802cf6d3f8c5fd683a0c7
SHA1 466530987a347b68ef28faad238d7b50db8656a5
SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
SHA512 fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

memory/2392-1268-0x0000000000400000-0x0000000000450000-memory.dmp

memory/3012-1270-0x0000000010480000-0x00000000104E5000-memory.dmp

memory/3028-1271-0x0000000010480000-0x00000000104E5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 a948306bca5c31624d596c5445ed739c
SHA1 3e90edf061a7b612f0b6134bbfd09413522dd28a
SHA256 7bce4cf46b8ad3f393fe7bf96e3b0ecae015191d51900b59ea04b22795c296d5
SHA512 34a97e24b940b8afff9698543b085c28016809c6f4459a043f7ade8944152b4081620769f59740c765a6e4fb774904e4ba99951f07c503548bc2de3dff78fd66

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 8fb1a800299e0f12a56c33b7ee25bbee
SHA1 a3da68a875f70bb0989655b38c6cde0dcbba0adf
SHA256 3dea99c7a973a34e4d1600744633870e638944a2815f8c209dc54414b01e7a36
SHA512 1cc41a8ebbcfdf060e959eb81489ea9959eeaa3a5cfd08cb46ddff1b230dec39ee40dbb7f63e8ce245c6cd6d3934e92db997309e51046b99cc6479af30d83ba0

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 a1f64cb8129c4bf5b1f3cd5e1d6ef8c8
SHA1 fbf41081ccb13189e8a96026ee4cbfa94bd92afd
SHA256 f7005197b7a239fd3b2071b89d5c1434e1922422827a59adc5946d34ed8c07a3
SHA512 c3b06b12551d93360b730cc8110169e210d37721499564fc97492d3b627216031282813ae105535c038b2a34612efc1e70cf737d00852ac2382c1de8f2aadf28

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 b1bae6efeaaab2a9916a1938c8322e97
SHA1 8733a861b925bf625a490ac73d388fc0b91d07cc
SHA256 6218bec6ebddb4bee633f3e2be25d6a798c1cf7222077264f18913a75522e932
SHA512 0cb4dfe7be38bde966d1ea6af66a1fe9748a75c41a7e48f10455da1b1dccd0ddcbf94f617fb9b98fc49208ea25e375b045fe6430487793d32116453a92fb1a86

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 ddfaddd894baf5ceec1391592883ce61
SHA1 21a7203af4346bf6a1bc6a494465fa84dcf0250f
SHA256 0660175fc943bad36a11101f805902a3c94d3656ee931bd372f30552a6eac093
SHA512 c0eaae74a52e34d9ac7baea405e3a3e7b715df4dedeb682d065df09574043a86205894869c9c32bcbfb3256fec4e3636cdade2d4b27f1215f7443a1bc4200900

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 30f6542b5499b2cd0c539bdd0c6128b9
SHA1 c0c54c9c8f970945c8af4817a6cf81b2eedadeff
SHA256 2f6ad496a568773d1899b8b82d892c6e378ab5b7968c7c7036cd7f10ada05756
SHA512 2cf3a71d4a5689bf65cbb6552a4bc28fa1d8947d0a8367f78d725337bc92d5c474040043e033401a0bb26664fd93f7c01600210e4410620cddd11804f190f248

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 170e7363da9b1ed8548cd57c465a5c6d
SHA1 cc98f6f35a68aace8ae2af2a2d217db5205c1eb6
SHA256 e475f579b86e08d7bd86956d526a936a7d450765d370150226c87e36e3285dcb
SHA512 73582fae2eb84f4340044394b1518986f8d3e8ad858c092dea0d12409825d2497d1da0e313713a41df61f9d8b3e6879c71eec410ee9311cb5312eeeb43600f70

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 a309fc226fd488301c8431786bf02606
SHA1 8c5d3b2c0dd4ec3e1a20f5cc921d0534b3f7d650
SHA256 02a9b998304757c7aa3b151a57eb3e62a6cb904631b92919325cacb84c7ef481
SHA512 87435963100eca36f4b90ea2317d0d342166d6d84f8b57338f7c0bc2fc4a244a4c143368249a71c7996326712308d0deb03cf211ccbbbed298d88c973c16bb90

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 691cf90981dfe0d872c1edf278027f2e
SHA1 728a409700e15bfb0f3f563420787146533ca4d2
SHA256 3090387089285c3bdfea3f1e4e3ce68d75e638d1f53c49536bcbca0d9e5179f0
SHA512 9e2c679586b9117926da907c11c227702c6049b65816fad392f91149e58b30d0554e6a69466061299ee79ae3f5ed46b3b748d65f0c08196e5f0aace7c3e380f5

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 9b4800b4e635a2b1238986bb7011b1bb
SHA1 388cdecb47287ad2991b5598eb7653c9436ab2cd
SHA256 2ad78c8b12b111d753232ac03263d44db28cccf4ef9f3cf9891530c4218f13c6
SHA512 2356201bb6f3f8ad981e84cd91228f981238542743949d1bacc036554092e8e9d49c86bb71d0cf33a04c21cb97413f9aeed5f0defd2104adb59a5fd92fe978cb

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 55dfbbf469b838568907e82b8892a96d
SHA1 8e3c533e78df114db83f41bfba5cb6dca528f6e7
SHA256 8322b50c2c765d2050c83a25de8965c22f92dbbd8f36d25b98b4be3f7e40deaf
SHA512 6c6430553f0eb32ce2ee4ebaffac8c91a2bbd892a494bcb4ff22a64742c0708fbd1ef1c20716ed73a49363000fe5f6396c473fbd8b420abd4abaad8a13784094

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 49ea697a2ff20476a62fe158379e12bc
SHA1 095b04f0b320ba05f9c66205fe2cfdfc5442672a
SHA256 1a9b0e1c9498fe7c129253e81c9357b4a400b3757fba9747ad3a72d382b03581
SHA512 9afa2636e57a242d77d8642a66e99ed222606db6aadcdf5e1a98af374953d825eb1e5d476d77022658cbe4b513ed09f9010b2e3dcb970b2a57a1c5745788bfc3

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 69718d08125b337359b946728b9b0099
SHA1 634c4954db4642ab7bbf2eacf990934f11766fd3
SHA256 cdce874fcaa223d06ac75e11d1d9463c81abd63f99c9c01e9c8f76462bc788ce
SHA512 2088a18e166e2b98369ba0b428b5baf9f1c79f113673fc6d92e690e0853d4da67b223da71e7c6fb71956b3446a4154b94ad97f441253936bff9a25ba9f10b859

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 b6d95c5aa928b55fb4b723f0fa6c2398
SHA1 879e612e5ef1894cdc82a93f96e2a4d443f7b2ef
SHA256 86053e6d986c535dbe2b296523514444e5ebfacf9ccfe7489100c7fe23649c70
SHA512 6bf5a6105637c28e32dcbf713ea93b287daf48e323f3cde11d1255e0ffebd60532b72feee397cdf2c928ef8fc2787ed4feb99dd3ad5923c6464cd2ca9d0bd317

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 682adb8678899fe99ac5d19e32174cc7
SHA1 b8edd1ff6d36f6cf1ef99e960709aeab49db401f
SHA256 44eada45c078837244e7f820f9f753694a39ae0fc27f6e140006a8a59f78c2a0
SHA512 c3e1e1d3ce3a315dfee9a7b5e7ed1cfdccad3871ea8d7b98312a5e1bc1ddc06b8267ee56c2f39b35b3b3a662b4dab3755745435bdd87732e716c5d8277981b3d

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 c78c106d840a1207ba56fd7ef3e19da2
SHA1 a110d1f3690bcebcb5fe95db002d2b77e961ba8f
SHA256 32c6747103f83f4edd6eb22ec07088424239740bc9c066dafd29b1d18a410231
SHA512 14838dabb27de876459834f10a9e040c8a69e1fab197e259f7fbe22b9140fe48f566705a5f545942ab2bbb45d3892884f05bad78b5e90533903e08a49ebfffc7

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 d71df5f2a94468db2ba4eb16574b5c62
SHA1 152469b9f0098fc5b9cfb0ecfefa9e955bf9bfd6
SHA256 d1a557c4074e2d727f4acbb3a1448bd194031f095e320a169cc8c533ee488862
SHA512 bd688fb43c8858f042caab40e04777f67dc7de236aea78935fbb54ec08fbc5be9d49e12d0beb76778dd0ce81a7647816c2e3b0c66ff893e3e0847a5885dad3dd

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 1ab4ebff99008b38ae921644b3e2863c
SHA1 3f8a1c1a79e7a12b1d3a4be66e31ba54f9e9835b
SHA256 ca31bb40ec9fe83c34857fa6298094729635c1cc870691a381a229320a2c9c21
SHA512 2dff0f7c3834297c7f141c844de2eba9c2b584a869202a2f9a566f878b9cc63088a9d378a4e311a86fc4e1d0e9ec79de25ff76ff41f37139d3c837f9fc751708

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 d4337f8c2d23746ee4a810ca94f6e403
SHA1 0fd5079e9fe91d7490fabfcd7b22aae59d710a80
SHA256 aaa95f8f5088bcefe608ca7959bff2b34c06c6d0ac729c9b76b45c950bbba5c1
SHA512 207d99ace31a4fcd76f16735b5152d4bd4f9de299753ba1b61671fa7f6cb562e462920799b31fbd973b77ee7935c8d8630792ae46903cb64f7b984ee6a0cf06d

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 394d7afeab41492ad98a65b109df3f0f
SHA1 3c59f49b858cc0dbafa4530be0e4751b5b3ab708
SHA256 31494195103b99f95c6afcbae75288199499f7fac4c2ab14b49ef6b8af6aebda
SHA512 9a344ab84bab99875d4353627f611701c42964d4a878c91887dbaaf9407d8dbcde792ad84fec28330cd5b0ef9861821e651cc5edd2765168ec524f9747098814

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 b4164e8b0171533da0839d60d7af4430
SHA1 4f08a74b2dab66b1d916ee721d8cbc47e7a90def
SHA256 e86544ab2078b8e0f0fd19c9c3c71663e2c0d214bde66d3f9f857221eea56870
SHA512 cad853096c9217eb23920c5bce2b8b7f3c27c09e29aadf0cbe98040399c1378e06fd54dab5cd8362979e08aee4a8076342ecd0104e4eff0f264a0d36ce697cf1

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-30 07:07

Reported

2024-08-30 07:10

Platform

win10v2004-20240802-en

Max time kernel

146s

Max time network

152s

Command Line

C:\Windows\Explorer.EXE

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\directory\\CyberGate\\install\\server.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\directory\\CyberGate\\install\\server.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{S4KWPT8L-6A3Q-P6RM-8573-OS1KMA30800M}\StubPath = "C:\\Windows\\system32\\install\\server.exe Restart" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{S4KWPT8L-6A3Q-P6RM-8573-OS1KMA30800M} C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlog.exe C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlog.exe C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\directory\CyberGate\install\server.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Uses the VBS compiler for execution

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\server.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\server.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\install\server.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\install\server.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\directory\CyberGate\install\server.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Windows\SysWOW64\explorer.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3268 wrote to memory of 4296 N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3268 wrote to memory of 4296 N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3268 wrote to memory of 4296 N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3268 wrote to memory of 4296 N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3268 wrote to memory of 4296 N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3268 wrote to memory of 4296 N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3268 wrote to memory of 4296 N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3268 wrote to memory of 4296 N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3268 wrote to memory of 4296 N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3268 wrote to memory of 4296 N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3268 wrote to memory of 4296 N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3268 wrote to memory of 4296 N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3268 wrote to memory of 4296 N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3268 wrote to memory of 4872 N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3268 wrote to memory of 4872 N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3268 wrote to memory of 4872 N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3268 wrote to memory of 4872 N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3268 wrote to memory of 4872 N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3268 wrote to memory of 4872 N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3268 wrote to memory of 4872 N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3268 wrote to memory of 4872 N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3268 wrote to memory of 4872 N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3268 wrote to memory of 4872 N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3268 wrote to memory of 4872 N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3268 wrote to memory of 4872 N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3268 wrote to memory of 4872 N/A C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4296 wrote to memory of 3492 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4296 wrote to memory of 3492 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4296 wrote to memory of 3492 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4296 wrote to memory of 3492 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4296 wrote to memory of 3492 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4296 wrote to memory of 3492 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4296 wrote to memory of 3492 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4296 wrote to memory of 3492 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4296 wrote to memory of 3492 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4296 wrote to memory of 3492 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4296 wrote to memory of 3492 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4296 wrote to memory of 3492 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4296 wrote to memory of 3492 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4296 wrote to memory of 3492 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4296 wrote to memory of 3492 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4296 wrote to memory of 3492 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4296 wrote to memory of 3492 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4296 wrote to memory of 3492 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4296 wrote to memory of 3492 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4296 wrote to memory of 3492 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4296 wrote to memory of 3492 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4296 wrote to memory of 3492 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4296 wrote to memory of 3492 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4296 wrote to memory of 3492 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4296 wrote to memory of 3492 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4296 wrote to memory of 3492 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4296 wrote to memory of 3492 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4296 wrote to memory of 3492 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4296 wrote to memory of 3492 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4296 wrote to memory of 3492 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4296 wrote to memory of 3492 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4296 wrote to memory of 3492 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4296 wrote to memory of 3492 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4296 wrote to memory of 3492 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4296 wrote to memory of 3492 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4296 wrote to memory of 3492 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4296 wrote to memory of 3492 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4296 wrote to memory of 3492 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\ca653b09e16390d6fe14b08bf240e011_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3256 -ip 3256

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3256 -s 1044

C:\directory\CyberGate\install\server.exe

"C:\directory\CyberGate\install\server.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3256 -ip 3256

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3256 -s 1052

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4432 -ip 4432

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4432 -s 1044

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4432 -ip 4432

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4432 -s 1084

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 www.server.com udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
NL 52.111.243.31:443 tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp

Files

memory/3268-0-0x0000000074F72000-0x0000000074F73000-memory.dmp

memory/3268-1-0x0000000074F70000-0x0000000075521000-memory.dmp

memory/3268-2-0x0000000074F70000-0x0000000075521000-memory.dmp

memory/4296-4-0x0000000000400000-0x0000000000450000-memory.dmp

memory/4296-3-0x0000000000400000-0x0000000000450000-memory.dmp

memory/4296-5-0x0000000000400000-0x0000000000450000-memory.dmp

memory/4872-6-0x0000000000400000-0x0000000000451000-memory.dmp

memory/4296-8-0x0000000000400000-0x0000000000450000-memory.dmp

memory/4872-7-0x0000000000400000-0x0000000000451000-memory.dmp

memory/4872-12-0x0000000000400000-0x0000000000451000-memory.dmp

memory/4872-11-0x0000000000400000-0x0000000000451000-memory.dmp

memory/3268-13-0x0000000074F70000-0x0000000075521000-memory.dmp

memory/4296-16-0x0000000010410000-0x0000000010475000-memory.dmp

memory/4296-17-0x0000000010410000-0x0000000010475000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

MD5 da1fd408da73dc4050f22a3b45864cbb
SHA1 e66278e800211b0c32155664bb57f884fc4d7218
SHA256 2b042c14b34063f2ee9490091ac80c9743dd67ba1abe86dc061eae86595b0c42
SHA512 6c719e902ed1e7c61089370cf6fa19c39b20af23ac000505516e9a2c1d3a17a7713475d15b451e26d451fae555754e5a7ad8c1639132f325b7099045a50f0353

memory/3640-26-0x00000000001F0000-0x00000000001F1000-memory.dmp

memory/3640-25-0x0000000000130000-0x0000000000131000-memory.dmp

memory/4296-23-0x0000000010480000-0x00000000104E5000-memory.dmp

memory/4296-45-0x0000000000400000-0x0000000000450000-memory.dmp

memory/4872-49-0x0000000000400000-0x0000000000451000-memory.dmp

memory/3640-120-0x0000000010480000-0x00000000104E5000-memory.dmp

memory/4872-155-0x0000000000400000-0x0000000000451000-memory.dmp

memory/3256-157-0x0000000010480000-0x00000000104E5000-memory.dmp

\??\c:\directory\CyberGate\install\server.exe

MD5 d881de17aa8f2e2c08cbb7b265f928f9
SHA1 08936aebc87decf0af6e8eada191062b5e65ac2a
SHA256 b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA512 5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

C:\Users\Admin\AppData\Roaming\Adminlog.dat

MD5 bf3dba41023802cf6d3f8c5fd683a0c7
SHA1 466530987a347b68ef28faad238d7b50db8656a5
SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
SHA512 fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

memory/3256-246-0x0000000010480000-0x00000000104E5000-memory.dmp

memory/4296-264-0x0000000000400000-0x0000000000450000-memory.dmp

memory/3640-285-0x0000000010480000-0x00000000104E5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 a1f64cb8129c4bf5b1f3cd5e1d6ef8c8
SHA1 fbf41081ccb13189e8a96026ee4cbfa94bd92afd
SHA256 f7005197b7a239fd3b2071b89d5c1434e1922422827a59adc5946d34ed8c07a3
SHA512 c3b06b12551d93360b730cc8110169e210d37721499564fc97492d3b627216031282813ae105535c038b2a34612efc1e70cf737d00852ac2382c1de8f2aadf28

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 b1bae6efeaaab2a9916a1938c8322e97
SHA1 8733a861b925bf625a490ac73d388fc0b91d07cc
SHA256 6218bec6ebddb4bee633f3e2be25d6a798c1cf7222077264f18913a75522e932
SHA512 0cb4dfe7be38bde966d1ea6af66a1fe9748a75c41a7e48f10455da1b1dccd0ddcbf94f617fb9b98fc49208ea25e375b045fe6430487793d32116453a92fb1a86

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 ddfaddd894baf5ceec1391592883ce61
SHA1 21a7203af4346bf6a1bc6a494465fa84dcf0250f
SHA256 0660175fc943bad36a11101f805902a3c94d3656ee931bd372f30552a6eac093
SHA512 c0eaae74a52e34d9ac7baea405e3a3e7b715df4dedeb682d065df09574043a86205894869c9c32bcbfb3256fec4e3636cdade2d4b27f1215f7443a1bc4200900

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 30f6542b5499b2cd0c539bdd0c6128b9
SHA1 c0c54c9c8f970945c8af4817a6cf81b2eedadeff
SHA256 2f6ad496a568773d1899b8b82d892c6e378ab5b7968c7c7036cd7f10ada05756
SHA512 2cf3a71d4a5689bf65cbb6552a4bc28fa1d8947d0a8367f78d725337bc92d5c474040043e033401a0bb26664fd93f7c01600210e4410620cddd11804f190f248

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 170e7363da9b1ed8548cd57c465a5c6d
SHA1 cc98f6f35a68aace8ae2af2a2d217db5205c1eb6
SHA256 e475f579b86e08d7bd86956d526a936a7d450765d370150226c87e36e3285dcb
SHA512 73582fae2eb84f4340044394b1518986f8d3e8ad858c092dea0d12409825d2497d1da0e313713a41df61f9d8b3e6879c71eec410ee9311cb5312eeeb43600f70