Malware Analysis Report

2025-01-02 14:08

Sample ID 240905-1m2s6s1cqb
Target ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118
SHA256 2ddac1a095349a73c167b98cfc540ab4f85ea7c6e761be283d513c8744ec3e44
Tags
discovery cybergate remote persistence stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2ddac1a095349a73c167b98cfc540ab4f85ea7c6e761be283d513c8744ec3e44

Threat Level: Known bad

The file ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

discovery cybergate remote persistence stealer trojan upx

CyberGate, Rebhip

Adds policy Run key to start application

Boot or Logon Autostart Execution: Active Setup

UPX packed file

Executes dropped EXE

Checks computer location settings

Deletes itself

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Program crash

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Suspicious behavior: GetForegroundWindowSpam

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-05 21:46

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-05 21:46

Reported

2024-09-05 21:49

Platform

win7-20240903-en

Max time kernel

118s

Max time network

127s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 36

Network

N/A

Files

memory/2868-0-0x0000000000400000-0x000000000040D000-memory.dmp

memory/2868-1-0x0000000000400000-0x000000000040D000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-05 21:46

Reported

2024-09-05 21:49

Platform

win10v2004-20240802-en

Max time kernel

147s

Max time network

149s

Command Line

C:\Windows\Explorer.EXE

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Program Files (x86)\\install\\server.exe" C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Program Files (x86)\\install\\server.exe" C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{67DUN7DV-11I1-2NT4-658C-ALJU1WO28E32}\StubPath = "C:\\Program Files (x86)\\install\\server.exe Restart" C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{67DUN7DV-11I1-2NT4-658C-ALJU1WO28E32} C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{67DUN7DV-11I1-2NT4-658C-ALJU1WO28E32}\StubPath = "C:\\Program Files (x86)\\install\\server.exe" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{67DUN7DV-11I1-2NT4-658C-ALJU1WO28E32} C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Program Files (x86)\\install\\server.exe" C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Program Files (x86)\\install\\server.exe" C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\install\server.exe C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\install\server.exe C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\install\server.exe C:\Windows\SysWOW64\explorer.exe N/A
File opened for modification C:\Program Files (x86)\install\ C:\Windows\SysWOW64\explorer.exe N/A
File opened for modification C:\Program Files (x86)\install\server.exe C:\Program Files (x86)\install\server.exe N/A
File opened for modification C:\Program Files (x86)\install\server.exe C:\Program Files (x86)\install\server.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\install\server.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\install\server.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\install\server.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Windows\SysWOW64\explorer.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4172 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe
PID 4172 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe
PID 4172 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe
PID 4172 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe
PID 4172 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe
PID 4172 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe
PID 4172 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe
PID 4172 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe
PID 4172 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe
PID 4172 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe
PID 4172 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe
PID 4172 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe
PID 4172 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4752 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\ce03005692a838ea9ec9d8c1c6a075f4_JaffaCakes118.exe"

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files (x86)\install\server.exe

"C:\Program Files (x86)\install\server.exe"

C:\Program Files (x86)\install\server.exe

"C:\Program Files (x86)\install\server.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 1132 -ip 1132

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1132 -s 548

C:\Program Files (x86)\install\server.exe

"C:\Program Files (x86)\install\server.exe"

C:\Program Files (x86)\install\server.exe

"C:\Program Files (x86)\install\server.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 960 -ip 960

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 960 -s 548

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 45.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 www.server.com udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp

Files

memory/4172-0-0x0000000000400000-0x000000000040D000-memory.dmp

memory/4172-2-0x0000000000500000-0x0000000000510000-memory.dmp

memory/4172-1-0x00000000004F0000-0x0000000000500000-memory.dmp

memory/4172-10-0x0000000002530000-0x0000000002540000-memory.dmp

memory/4172-11-0x0000000002540000-0x0000000002550000-memory.dmp

memory/4172-16-0x0000000002AC0000-0x0000000002AD0000-memory.dmp

memory/4172-17-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

memory/4172-15-0x0000000002AA0000-0x0000000002AB0000-memory.dmp

memory/4172-14-0x0000000002A90000-0x0000000002AA0000-memory.dmp

memory/4172-13-0x0000000002570000-0x0000000002580000-memory.dmp

memory/4172-12-0x0000000002560000-0x0000000002570000-memory.dmp

memory/4172-9-0x0000000002520000-0x0000000002530000-memory.dmp

memory/4172-8-0x0000000002510000-0x0000000002520000-memory.dmp

memory/4172-7-0x0000000002500000-0x0000000002510000-memory.dmp

memory/4172-6-0x00000000024F0000-0x0000000002500000-memory.dmp

memory/4172-5-0x00000000024E0000-0x00000000024F0000-memory.dmp

memory/4172-4-0x00000000006F0000-0x0000000000700000-memory.dmp

memory/4172-3-0x00000000006E0000-0x00000000006F0000-memory.dmp

memory/4752-20-0x0000000000400000-0x0000000000451000-memory.dmp

memory/4752-21-0x0000000000400000-0x0000000000451000-memory.dmp

memory/4752-22-0x0000000000400000-0x0000000000451000-memory.dmp

memory/4172-23-0x0000000000400000-0x000000000040D000-memory.dmp

memory/4752-24-0x0000000000400000-0x0000000000451000-memory.dmp

memory/4752-27-0x0000000010410000-0x0000000010475000-memory.dmp

memory/2684-33-0x0000000001310000-0x0000000001311000-memory.dmp

memory/2684-32-0x0000000001250000-0x0000000001251000-memory.dmp

memory/4752-31-0x0000000010480000-0x00000000104E5000-memory.dmp

memory/4752-48-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2684-94-0x0000000010480000-0x00000000104E5000-memory.dmp

C:\Program Files (x86)\install\server.exe

MD5 ce03005692a838ea9ec9d8c1c6a075f4
SHA1 ec54211887245cba6c468d5a12d11a07a392b749
SHA256 2ddac1a095349a73c167b98cfc540ab4f85ea7c6e761be283d513c8744ec3e44
SHA512 7e4e9df8d9ee1d670381939e397f2c3a0421e2d22ce4544e771101c57fd9f5dbd13bd6d90e7c04c3d1dd02ca8f8e764f943e2928a475f1ee3ab318396a9f3c6f

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

MD5 3a9bdf4ca5239217edbba5d3fe139b5f
SHA1 da477d64786e3e869b22d48da29715ace405d299
SHA256 6c2f84ef595bf55416a2dd9d5d33adfb4adff2194add9dfeb1ee7475418252f7
SHA512 be01b9b0f7bc532497e33ca263088140dce75cc823428fc978a701053d33a377107e0244cfa29b61381c6f3d0c6e8f19b6a4b8234e8d9bc2a5ab49b1914dd787

memory/5032-159-0x00000000104F0000-0x0000000010555000-memory.dmp

C:\Users\Admin\AppData\Roaming\Adminlog.dat

MD5 bf3dba41023802cf6d3f8c5fd683a0c7
SHA1 466530987a347b68ef28faad238d7b50db8656a5
SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
SHA512 fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

memory/636-174-0x0000000000400000-0x000000000040D000-memory.dmp

memory/4752-177-0x0000000000400000-0x0000000000451000-memory.dmp

memory/636-201-0x0000000000400000-0x000000000040D000-memory.dmp

memory/3996-206-0x0000000000400000-0x000000000040D000-memory.dmp

memory/3996-229-0x0000000000400000-0x000000000040D000-memory.dmp

memory/2684-232-0x0000000010480000-0x00000000104E5000-memory.dmp

memory/5032-236-0x00000000104F0000-0x0000000010555000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 c46b0c14d15e35e6931a84a930879c85
SHA1 c97c3c1e8743e65300506cc1516a8d98a68bd7ff
SHA256 66873799cace9c80268941a17dfba7f08debb3ae7a18a76b1c2075a82dd618b0
SHA512 5c812f5f5885391c285a154df209557b3a7ab008c6bc8c3b97c0f55c156c10a558d5384f129ccee42d28d1045dad03096169da42649dfe129fde4757d8878a6a

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 80f558894a450694fdf46c4a1818c928
SHA1 0c19420824a4eb8f104554427ad7444b41ce4cc3
SHA256 7f84a134bfc2053cdff8fe751807ea18eb0963448ad86423b771a2c6e06ca98b
SHA512 fddc2d0a4c9e6ca17aa8641aa92bd799c78425325c4976fa851e8b585761ef43ded223ed0b9cf45743633e9400c8dc6cc57f34381fb9ecea11c07a74244dc16f

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 1df88ead883bb7843b662ffe4948526c
SHA1 10c70bf63b69d3bce0d04e0c276f452939d631e9
SHA256 5645a5b3c7c6bf243a7a47d3067646b3f8b47f86fa3c962918171914cb83b7d5
SHA512 77dd07ef223fc13e67f9b9daeb214c443093c399da8e10c45302ef138a17d1b1c47e142c6c0ae16faf9bce7be55b770cb01ebd6e15b112b0de87fe8e4a31c037

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 34357d47836ac1e030850d215d2bf7b4
SHA1 d2c64cc34ecab6cd2c7f2989b2df904163471d39
SHA256 8ac6e817735c71f4651b75860f08d2825a9ebbbd58137443d54a86a6206826ea
SHA512 160e35b85354441305ee7df394b2ccc7a4d57e1360a687e0b95390c477357a447f1397c9471b90b65986d2a07c2300a19306f8c1e25300ebcb8e998c0e3efa9b