Malware Analysis Report

2025-01-02 14:05

Sample ID 240908-2k6j1syfjk
Target d5370a01303e0afce725c9834e632233_JaffaCakes118
SHA256 e9f8c9f2e06ec57ba035788b663be0d6f4daa84fcdaae6f7404ec32018a3dbb6
Tags
cybergate remote discovery persistence stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e9f8c9f2e06ec57ba035788b663be0d6f4daa84fcdaae6f7404ec32018a3dbb6

Threat Level: Known bad

The file d5370a01303e0afce725c9834e632233_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

cybergate remote discovery persistence stealer trojan upx

CyberGate, Rebhip

Boot or Logon Autostart Execution: Active Setup

Adds policy Run key to start application

Executes dropped EXE

UPX packed file

Loads dropped DLL

Uses the VBS compiler for execution

Checks computer location settings

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in System32 directory

Enumerates physical storage devices

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-08 22:39

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-08 22:39

Reported

2024-09-08 22:42

Platform

win7-20240704-en

Max time kernel

149s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d5370a01303e0afce725c9834e632233_JaffaCakes118.exe"

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{52H57FY5-1751-M040-OW46-N2177HNQFOG7}\StubPath = "C:\\Windows\\system32\\install\\svchost.exe Restart" C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{52H57FY5-1751-M040-OW46-N2177HNQFOG7} C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
N/A N/A C:\Windows\SysWOW64\install\svchost.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Uses the VBS compiler for execution

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\install\ C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
File created C:\Windows\SysWOW64\install\svchost.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\install\svchost.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\install\svchost.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2520 set thread context of 2160 N/A C:\Users\Admin\AppData\Local\Temp\d5370a01303e0afce725c9834e632233_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\d5370a01303e0afce725c9834e632233_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\install\svchost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2520 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\d5370a01303e0afce725c9834e632233_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2520 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\d5370a01303e0afce725c9834e632233_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2520 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\d5370a01303e0afce725c9834e632233_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2520 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\d5370a01303e0afce725c9834e632233_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2520 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\d5370a01303e0afce725c9834e632233_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2520 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\d5370a01303e0afce725c9834e632233_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2520 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\d5370a01303e0afce725c9834e632233_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2520 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\d5370a01303e0afce725c9834e632233_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2520 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\d5370a01303e0afce725c9834e632233_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2520 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\d5370a01303e0afce725c9834e632233_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2520 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\d5370a01303e0afce725c9834e632233_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2520 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\d5370a01303e0afce725c9834e632233_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2160 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe

Processes

C:\Users\Admin\AppData\Local\Temp\d5370a01303e0afce725c9834e632233_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\d5370a01303e0afce725c9834e632233_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\vbc.exe

C:\Users\Admin\AppData\Local\Temp\vbc.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Users\Admin\AppData\Local\Temp\vbc.exe

"C:\Users\Admin\AppData\Local\Temp\vbc.exe"

C:\Windows\SysWOW64\install\svchost.exe

"C:\Windows\system32\install\svchost.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.server.com udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp

Files

memory/2520-0-0x0000000074001000-0x0000000074002000-memory.dmp

memory/2520-1-0x0000000074000000-0x00000000745AB000-memory.dmp

memory/2520-3-0x0000000074000000-0x00000000745AB000-memory.dmp

\Users\Admin\AppData\Local\Temp\vbc.exe

MD5 34aa912defa18c2c129f1e09d75c1d7e
SHA1 9c3046324657505a30ecd9b1fdb46c05bde7d470
SHA256 6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512 d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

memory/2160-7-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2160-9-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2160-25-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2160-26-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2160-27-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2160-23-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2160-21-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2160-19-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2160-17-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2160-15-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2160-13-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2160-11-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2520-28-0x0000000074000000-0x00000000745AB000-memory.dmp

memory/2160-32-0x0000000010410000-0x0000000010475000-memory.dmp

memory/2812-49-0x0000000000360000-0x0000000000361000-memory.dmp

memory/2812-44-0x00000000001E0000-0x00000000001E1000-memory.dmp

memory/2812-38-0x00000000001C0000-0x00000000001C1000-memory.dmp

memory/2160-37-0x0000000010480000-0x00000000104E5000-memory.dmp

memory/2812-51-0x0000000000400000-0x000000000051E000-memory.dmp

memory/2160-337-0x0000000000400000-0x0000000000451000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

MD5 4ad8fa33ef9412e122d585d603eace5a
SHA1 fdc8ea181390e90da0125389edaa96f95ab653d8
SHA256 c92f16b24915720788b178dde4451e337c4b590e2e499af24e34a87c9dace088
SHA512 26dc6ecdeb87e2646d1556ccdd875151dbf7588b14f7213843dff7f04f77ab591c363c2d8ad520a3b60f3fc1799e7aa703065adf03df817f6eef9cb8ef42bdca

C:\Users\Admin\AppData\Roaming\Adminlog.dat

MD5 bf3dba41023802cf6d3f8c5fd683a0c7
SHA1 466530987a347b68ef28faad238d7b50db8656a5
SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
SHA512 fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 8ecf5643e198246337377508b13eb9b0
SHA1 aec3d4626f9e24700249559e67ddd2a42a87472b
SHA256 8c533257d13683130bf4d06b87f5b742f61c53e3f534c7ad96f6c6bc17067df2
SHA512 f25504412d0b91cd303343d5727a19848673f724169debcff67acf58d69bd10bef1782ea11f4a22cbbec9b17c7d64067c1fef185f039c3afc4c9efb08929bd66

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 2987ce8f4c9d35e10541f3c8e5e93fe8
SHA1 3b4796feb35e47e3b84c7f4baf2acb88cb26740c
SHA256 b77e4101f4d47142277dd0df33a8d80084cec7c4cd67f4b94ebed819936f5bb5
SHA512 224770b4b830ed27fac257c9cbcefeae52befb94cb1b49f8329ae63104911897ef66fd04887d6c5842cd83ec8b687bb6b7cd30465e6db3303d56434b26fe33b3

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 a76ab98beca27344431053e7e579786d
SHA1 ef61edc420b3d3136ee8233420cfacddae938981
SHA256 17537f665f00dc4a82a3f21373a67702e4be838e0c4d63767549753d7519f08a
SHA512 58fd569f95a547ca115ad821ed38ec89d7c62d4cc78bbd75a3c6f62ac034e77d9e57bc379684d99d36292120ea91b8ed9060ce368992c9f57469e51f11237f61

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 09a685f06a57ad3909a426675f3ab66d
SHA1 2f8722fa86379bf020ca4d4cc013b0bb37c035d6
SHA256 f10c76ed10eb7b16276ee8088359a8018ae1041252a513425447aa60e8d40e62
SHA512 a7c6d7435800e66cff79c00108511167ffe258fd62e596508ba9c11669f08b07e73f214a6d6fbc3a61ebcea95a4bd1e02f16dc58293b6f005747ba8c793307c8

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 7387a06d95d12dc35030337a680ef140
SHA1 5299e03b6d869f6da07af12eb4eb6f7d02cf8b21
SHA256 c8ab9326e39847041511d5d5274b528fa28bd39f4183da11c60f27c2722d6759
SHA512 b64bd2fbcf694d72b4a4691d6de3e1e35994d29ff10fe298092272a5f4bc3db7009c704f7951d41e2504f5ea50aa63e5279ce25bf3c8cc35d9aee06c9ee12fc5

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 f6710b198f400272885b3bbb572d610d
SHA1 94fe6099381694b8398d37eb98cd33d78b176cad
SHA256 e5f6e6a1a2804bc29fd63d3cda512c11959b6880f861a72c42114ffcbf59c18d
SHA512 621dc1a7b944f75488d030cd0d50427beabfd66c0258fe8e344104536001d34b9509dcdb52adde20d59b27471671ea2a7777187af5b2079e58ec719b3a1e9133

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 1b77491b531785cc4906f6a11cdcc15a
SHA1 5b6a4ad5e5372fd3051ced5f0693f956b802874f
SHA256 1cc178036a881149395356694b3a398659386aef39bf9f5c52714e0750e8663b
SHA512 a055121258076f39cc4d9c4c8d5a8b5b323666eccddd2521f19a8563983fbfe6124f46d9ca7c57ddf1771b7b2e82a9a788e9eb8fb86fd80a7c85f121a98dff51

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 502b0c689a13bfddb32d086f1a902003
SHA1 75a06d71bc1b6f3c5ffc2bc68bf6ded66ddb0014
SHA256 417f47243e4aa81233b3a3c0865acfa72b40e0253c5737cfa2f2cd6ff7b90209
SHA512 2115542dc612131e8f177cccd24ab38f6cbe79e37d0cef4665eb88aea3b5c0d6887ca494d590fae689316bbf704b08fc7d8b5a05a4899536e310dbac143b8764

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 485647b21ab314e8662f64dee9e415cf
SHA1 dd161d7bccfc9cb209158666b8b2a4002abcc7c6
SHA256 abf01141053b25c71f60ca64ec84529602ee0e1607cbb3be2a0549e79431b9f5
SHA512 ecdb00adc8834e2b9c07af7efd6b9ed1971f21dab8e2471bf514a831a161ccaa3aa44bf4f29e3760cd05eb85c19e281938b8faeb634108d3f666529bea3914cf

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 01adea81cf6f49992255dc13292b8af2
SHA1 fb0fa0e0f609cc57ecc7f654aa9143a4f52181c3
SHA256 e2789edd50f101bc9cce146788863c804552893cd33b82a0f704c14eb3346d69
SHA512 b441cd39c2f6942b5a3a9d5af0e1f64ac355d90977f69e888603b477cda4bc0764c9f1884a8b39717f4ebbb47879baf9dafdc67bb9b864d02710f7d46d1a1abe

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 e6b4573a07f8c8d2cfb83662bf3aab67
SHA1 a6579f60e17d594918d38e12011b1fcd1b1e8362
SHA256 a2917adf0ee9ced5c497fcd3f1fa21934a24924d4f6f2ed1610488f395632bba
SHA512 4907d5aec8f8001600b5b30f740f51d1aeb693c28c523d851cd12f2d37c4c0882eea175ae8b4acfd4b621f5f7021f0f67d4ef1f0bd4a9ea035e955a528f9fa14

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 7cc8654337260869aea3f5a451c76f41
SHA1 1d2b4df67815d2f4fc05581869300eefdb704f4c
SHA256 805e7ac2444dec9eacdd94c516abf243cc71edb56697c5c949afbb01cc258762
SHA512 6139b0cfa408fa3759528d89a1b0f1742004dfc4be6dc703470543b3d70707fd3c6f6e95c7455a1a7eed1e3e2eecbf42096208aa727347c055a41bd850a5f7a7

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 1749a63008dfb099bbdb7723b31da6dd
SHA1 e279fb662bca26071553c21d39705c75cc8ab3c9
SHA256 4e05bb839bd30d105f26cff6531b6eabb1866a39a198f11fcc7b62bf3518b1d7
SHA512 554275b22dea39ca25df0fceecf81ec4d1e70be4bcec7c4cfe20989f268aafc2dc150f2dd2364405c41c6e1b30e692d800248146ae216dc4594fe49e69e320a1

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 ba51d969b5b3645d8aea59e492658efe
SHA1 ce52d2cf2243dfbf5a6603618b73ca4e44c18b60
SHA256 8dc0bb155e771fb86168c4b307f629fc57a7ba633b37fb7e4babf8ca46219b06
SHA512 567ab983eaac8a5a99fb11fbfbc5e51b51a0aeb9b19d9f48b1ce02b5ebf289273d1bfe92b5d00ebe969be12f1b7ac32c55b7bcf0f6d57663853adce430e03737

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 6c1763df77694201001a1db5b5b633d7
SHA1 26f3a8657c8dacc0571bd3d2f663a3529ba82fe1
SHA256 38a29a1623d0f73d494dad1dbaf5fe1a78a7db409e0f2fab5d252bf4ec985378
SHA512 8cbb26afef2d3181046b7af5d300cb2955c7c9dd9efae8a4d28d63d7321ce5174be476957d2c3a73135d243358b6486d46e4bd575b8f7d0d6c5319a3d5920410

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 90223706be0e74657bf2c11d547e6ca2
SHA1 2c17644bbda5d3d8b9894ab26703039398d1289e
SHA256 104c5cd843afd8780babe6a2666b8b997eeedd7d86b6790f8c8c239e9bf1157f
SHA512 122f9d34d01493c1ad6ee367df51855135ac7fb001ff6344cccd3e8648557f686cc69583e2f8e19b5e29ceacbccba889c40c3b3f63019ff94ad7b5067a83e46c

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-08 22:39

Reported

2024-09-08 22:42

Platform

win10v2004-20240802-en

Max time kernel

149s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d5370a01303e0afce725c9834e632233_JaffaCakes118.exe"

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{52H57FY5-1751-M040-OW46-N2177HNQFOG7} C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{52H57FY5-1751-M040-OW46-N2177HNQFOG7}\StubPath = "C:\\Windows\\system32\\install\\svchost.exe Restart" C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
N/A N/A C:\Windows\SysWOW64\install\svchost.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Uses the VBS compiler for execution

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\install\svchost.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\install\svchost.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\install\svchost.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\install\ C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2588 set thread context of 264 N/A C:\Users\Admin\AppData\Local\Temp\d5370a01303e0afce725c9834e632233_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\install\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\d5370a01303e0afce725c9834e632233_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2588 wrote to memory of 264 N/A C:\Users\Admin\AppData\Local\Temp\d5370a01303e0afce725c9834e632233_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2588 wrote to memory of 264 N/A C:\Users\Admin\AppData\Local\Temp\d5370a01303e0afce725c9834e632233_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2588 wrote to memory of 264 N/A C:\Users\Admin\AppData\Local\Temp\d5370a01303e0afce725c9834e632233_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2588 wrote to memory of 264 N/A C:\Users\Admin\AppData\Local\Temp\d5370a01303e0afce725c9834e632233_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2588 wrote to memory of 264 N/A C:\Users\Admin\AppData\Local\Temp\d5370a01303e0afce725c9834e632233_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2588 wrote to memory of 264 N/A C:\Users\Admin\AppData\Local\Temp\d5370a01303e0afce725c9834e632233_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2588 wrote to memory of 264 N/A C:\Users\Admin\AppData\Local\Temp\d5370a01303e0afce725c9834e632233_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2588 wrote to memory of 264 N/A C:\Users\Admin\AppData\Local\Temp\d5370a01303e0afce725c9834e632233_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2588 wrote to memory of 264 N/A C:\Users\Admin\AppData\Local\Temp\d5370a01303e0afce725c9834e632233_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2588 wrote to memory of 264 N/A C:\Users\Admin\AppData\Local\Temp\d5370a01303e0afce725c9834e632233_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2588 wrote to memory of 264 N/A C:\Users\Admin\AppData\Local\Temp\d5370a01303e0afce725c9834e632233_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2588 wrote to memory of 264 N/A C:\Users\Admin\AppData\Local\Temp\d5370a01303e0afce725c9834e632233_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2588 wrote to memory of 264 N/A C:\Users\Admin\AppData\Local\Temp\d5370a01303e0afce725c9834e632233_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 264 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe

Processes

C:\Users\Admin\AppData\Local\Temp\d5370a01303e0afce725c9834e632233_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\d5370a01303e0afce725c9834e632233_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\vbc.exe

C:\Users\Admin\AppData\Local\Temp\vbc.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Users\Admin\AppData\Local\Temp\vbc.exe

"C:\Users\Admin\AppData\Local\Temp\vbc.exe"

C:\Windows\SysWOW64\install\svchost.exe

"C:\Windows\system32\install\svchost.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 www.server.com udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp

Files

memory/2588-0-0x0000000075422000-0x0000000075423000-memory.dmp

memory/2588-1-0x0000000075420000-0x00000000759D1000-memory.dmp

memory/2588-2-0x0000000075420000-0x00000000759D1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\vbc.exe

MD5 d881de17aa8f2e2c08cbb7b265f928f9
SHA1 08936aebc87decf0af6e8eada191062b5e65ac2a
SHA256 b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA512 5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

memory/264-5-0x0000000000400000-0x0000000000451000-memory.dmp

memory/264-9-0x0000000000400000-0x0000000000451000-memory.dmp

memory/264-10-0x0000000000400000-0x0000000000451000-memory.dmp

memory/264-12-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2588-11-0x0000000075420000-0x00000000759D1000-memory.dmp

memory/264-15-0x0000000010410000-0x0000000010475000-memory.dmp

memory/4596-21-0x0000000000690000-0x0000000000691000-memory.dmp

memory/264-19-0x0000000010480000-0x00000000104E5000-memory.dmp

memory/4596-20-0x00000000001F0000-0x00000000001F1000-memory.dmp

memory/4596-25-0x0000000000400000-0x000000000051F000-memory.dmp

memory/264-84-0x0000000000400000-0x0000000000451000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

MD5 4ad8fa33ef9412e122d585d603eace5a
SHA1 fdc8ea181390e90da0125389edaa96f95ab653d8
SHA256 c92f16b24915720788b178dde4451e337c4b590e2e499af24e34a87c9dace088
SHA512 26dc6ecdeb87e2646d1556ccdd875151dbf7588b14f7213843dff7f04f77ab591c363c2d8ad520a3b60f3fc1799e7aa703065adf03df817f6eef9cb8ef42bdca

C:\Users\Admin\AppData\Roaming\Adminlog.dat

MD5 bf3dba41023802cf6d3f8c5fd683a0c7
SHA1 466530987a347b68ef28faad238d7b50db8656a5
SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
SHA512 fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 2987ce8f4c9d35e10541f3c8e5e93fe8
SHA1 3b4796feb35e47e3b84c7f4baf2acb88cb26740c
SHA256 b77e4101f4d47142277dd0df33a8d80084cec7c4cd67f4b94ebed819936f5bb5
SHA512 224770b4b830ed27fac257c9cbcefeae52befb94cb1b49f8329ae63104911897ef66fd04887d6c5842cd83ec8b687bb6b7cd30465e6db3303d56434b26fe33b3

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 a76ab98beca27344431053e7e579786d
SHA1 ef61edc420b3d3136ee8233420cfacddae938981
SHA256 17537f665f00dc4a82a3f21373a67702e4be838e0c4d63767549753d7519f08a
SHA512 58fd569f95a547ca115ad821ed38ec89d7c62d4cc78bbd75a3c6f62ac034e77d9e57bc379684d99d36292120ea91b8ed9060ce368992c9f57469e51f11237f61

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 09a685f06a57ad3909a426675f3ab66d
SHA1 2f8722fa86379bf020ca4d4cc013b0bb37c035d6
SHA256 f10c76ed10eb7b16276ee8088359a8018ae1041252a513425447aa60e8d40e62
SHA512 a7c6d7435800e66cff79c00108511167ffe258fd62e596508ba9c11669f08b07e73f214a6d6fbc3a61ebcea95a4bd1e02f16dc58293b6f005747ba8c793307c8

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 7387a06d95d12dc35030337a680ef140
SHA1 5299e03b6d869f6da07af12eb4eb6f7d02cf8b21
SHA256 c8ab9326e39847041511d5d5274b528fa28bd39f4183da11c60f27c2722d6759
SHA512 b64bd2fbcf694d72b4a4691d6de3e1e35994d29ff10fe298092272a5f4bc3db7009c704f7951d41e2504f5ea50aa63e5279ce25bf3c8cc35d9aee06c9ee12fc5

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 f6710b198f400272885b3bbb572d610d
SHA1 94fe6099381694b8398d37eb98cd33d78b176cad
SHA256 e5f6e6a1a2804bc29fd63d3cda512c11959b6880f861a72c42114ffcbf59c18d
SHA512 621dc1a7b944f75488d030cd0d50427beabfd66c0258fe8e344104536001d34b9509dcdb52adde20d59b27471671ea2a7777187af5b2079e58ec719b3a1e9133

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 1b77491b531785cc4906f6a11cdcc15a
SHA1 5b6a4ad5e5372fd3051ced5f0693f956b802874f
SHA256 1cc178036a881149395356694b3a398659386aef39bf9f5c52714e0750e8663b
SHA512 a055121258076f39cc4d9c4c8d5a8b5b323666eccddd2521f19a8563983fbfe6124f46d9ca7c57ddf1771b7b2e82a9a788e9eb8fb86fd80a7c85f121a98dff51

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 502b0c689a13bfddb32d086f1a902003
SHA1 75a06d71bc1b6f3c5ffc2bc68bf6ded66ddb0014
SHA256 417f47243e4aa81233b3a3c0865acfa72b40e0253c5737cfa2f2cd6ff7b90209
SHA512 2115542dc612131e8f177cccd24ab38f6cbe79e37d0cef4665eb88aea3b5c0d6887ca494d590fae689316bbf704b08fc7d8b5a05a4899536e310dbac143b8764

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 485647b21ab314e8662f64dee9e415cf
SHA1 dd161d7bccfc9cb209158666b8b2a4002abcc7c6
SHA256 abf01141053b25c71f60ca64ec84529602ee0e1607cbb3be2a0549e79431b9f5
SHA512 ecdb00adc8834e2b9c07af7efd6b9ed1971f21dab8e2471bf514a831a161ccaa3aa44bf4f29e3760cd05eb85c19e281938b8faeb634108d3f666529bea3914cf

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 01adea81cf6f49992255dc13292b8af2
SHA1 fb0fa0e0f609cc57ecc7f654aa9143a4f52181c3
SHA256 e2789edd50f101bc9cce146788863c804552893cd33b82a0f704c14eb3346d69
SHA512 b441cd39c2f6942b5a3a9d5af0e1f64ac355d90977f69e888603b477cda4bc0764c9f1884a8b39717f4ebbb47879baf9dafdc67bb9b864d02710f7d46d1a1abe

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 e6b4573a07f8c8d2cfb83662bf3aab67
SHA1 a6579f60e17d594918d38e12011b1fcd1b1e8362
SHA256 a2917adf0ee9ced5c497fcd3f1fa21934a24924d4f6f2ed1610488f395632bba
SHA512 4907d5aec8f8001600b5b30f740f51d1aeb693c28c523d851cd12f2d37c4c0882eea175ae8b4acfd4b621f5f7021f0f67d4ef1f0bd4a9ea035e955a528f9fa14

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 7cc8654337260869aea3f5a451c76f41
SHA1 1d2b4df67815d2f4fc05581869300eefdb704f4c
SHA256 805e7ac2444dec9eacdd94c516abf243cc71edb56697c5c949afbb01cc258762
SHA512 6139b0cfa408fa3759528d89a1b0f1742004dfc4be6dc703470543b3d70707fd3c6f6e95c7455a1a7eed1e3e2eecbf42096208aa727347c055a41bd850a5f7a7

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 1749a63008dfb099bbdb7723b31da6dd
SHA1 e279fb662bca26071553c21d39705c75cc8ab3c9
SHA256 4e05bb839bd30d105f26cff6531b6eabb1866a39a198f11fcc7b62bf3518b1d7
SHA512 554275b22dea39ca25df0fceecf81ec4d1e70be4bcec7c4cfe20989f268aafc2dc150f2dd2364405c41c6e1b30e692d800248146ae216dc4594fe49e69e320a1

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 ba51d969b5b3645d8aea59e492658efe
SHA1 ce52d2cf2243dfbf5a6603618b73ca4e44c18b60
SHA256 8dc0bb155e771fb86168c4b307f629fc57a7ba633b37fb7e4babf8ca46219b06
SHA512 567ab983eaac8a5a99fb11fbfbc5e51b51a0aeb9b19d9f48b1ce02b5ebf289273d1bfe92b5d00ebe969be12f1b7ac32c55b7bcf0f6d57663853adce430e03737

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 6c1763df77694201001a1db5b5b633d7
SHA1 26f3a8657c8dacc0571bd3d2f663a3529ba82fe1
SHA256 38a29a1623d0f73d494dad1dbaf5fe1a78a7db409e0f2fab5d252bf4ec985378
SHA512 8cbb26afef2d3181046b7af5d300cb2955c7c9dd9efae8a4d28d63d7321ce5174be476957d2c3a73135d243358b6486d46e4bd575b8f7d0d6c5319a3d5920410

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 90223706be0e74657bf2c11d547e6ca2
SHA1 2c17644bbda5d3d8b9894ab26703039398d1289e
SHA256 104c5cd843afd8780babe6a2666b8b997eeedd7d86b6790f8c8c239e9bf1157f
SHA512 122f9d34d01493c1ad6ee367df51855135ac7fb001ff6344cccd3e8648557f686cc69583e2f8e19b5e29ceacbccba889c40c3b3f63019ff94ad7b5067a83e46c

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 1197cbd100786e4481b4ed00623733e2
SHA1 d96eb8456f7d984aa0e2e0cee0faa7ca2e52a526
SHA256 b76a3268845536e8831db921eab0121c05b2bf755cec2abd9f6bea9bc966a755
SHA512 93e762fde260025e4eac5a2c605c841898de1410af45a8f34d6a96084652643813d1f0e755a3979bc4baeed3d7cc1b5cdbff3a06701da7ec5bdccdd29107f693

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 7ad78b4fb04755be4ec8f94d082eea5e
SHA1 645232d70fddfa16cd1556a65bbf9a2fcc75818d
SHA256 2c385c24a36900dce4fac09963dbd08ca1958d5c58116c5a07d2e873724125a3
SHA512 d81150e1d9066fcfc078f130748649f713007ba0d37a024ab8be9d794ab82870e7110c521082d304f9b5788ff9e0761d4aadb1f1c23495ba7fa7d1405c43f2f6