Malware Analysis Report

2025-01-02 14:02

Sample ID 240911-y9v8ss1erk
Target db295321c287aceba94bdaa3b2141cb6_JaffaCakes118
SHA256 5203699ca3784d105e35cb5ee1092afb366653b4b57717bbc09d77f0e48386f3
Tags
cybergate remote discovery persistence stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

5203699ca3784d105e35cb5ee1092afb366653b4b57717bbc09d77f0e48386f3

Threat Level: Known bad

The file db295321c287aceba94bdaa3b2141cb6_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

cybergate remote discovery persistence stealer trojan upx

CyberGate, Rebhip

Adds policy Run key to start application

Boot or Logon Autostart Execution: Active Setup

Loads dropped DLL

Executes dropped EXE

UPX packed file

Adds Run key to start application

Drops desktop.ini file(s)

AutoIT Executable

Suspicious use of SetThreadContext

Drops file in System32 directory

System Location Discovery: System Language Discovery

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Modifies registry class

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Suspicious use of SendNotifyMessage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-11 20:29

Signatures

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-11 20:29

Reported

2024-09-11 20:32

Platform

win7-20240903-en

Max time kernel

148s

Max time network

150s

Command Line

C:\Windows\Explorer.EXE

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\updated.exe" C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\updated.exe" C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{445N60N3-08V0-S2B7-RWIS-4QV11S48Q5X2} C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{445N60N3-08V0-S2B7-RWIS-4QV11S48Q5X2}\StubPath = "C:\\Windows\\system32\\install\\updated.exe Restart" C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{445N60N3-08V0-S2B7-RWIS-4QV11S48Q5X2} C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{445N60N3-08V0-S2B7-RWIS-4QV11S48Q5X2}\StubPath = "C:\\Windows\\system32\\install\\updated.exe" C:\Windows\SysWOW64\explorer.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\install\updated.exe N/A
N/A N/A C:\Windows\SysWOW64\install\updated.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\install\updated.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\updated.exe" C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\updated.exe" C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Windows\SysWOW64\explorer.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\install\updated.exe C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\install\updated.exe C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\install\updated.exe C:\Windows\SysWOW64\explorer.exe N/A
File opened for modification C:\Windows\SysWOW64\install\ C:\Windows\SysWOW64\explorer.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\install\updated.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\install\updated.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2592 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe
PID 2592 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe
PID 2592 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe
PID 2592 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe
PID 2592 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe
PID 2592 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2776 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe"

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\install\updated.exe

"C:\Windows\system32\install\updated.exe"

C:\Windows\SysWOW64\install\updated.exe

"C:\Windows\SysWOW64\install\updated.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.server.com udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp

Files

memory/2776-1-0x00000000000C0000-0x000000000010C000-memory.dmp

memory/2776-5-0x00000000000C0000-0x000000000010C000-memory.dmp

memory/2776-4-0x00000000000C0000-0x000000000010C000-memory.dmp

memory/2776-2-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/2776-6-0x00000000000C0000-0x000000000010C000-memory.dmp

memory/2776-7-0x00000000000C0000-0x000000000010C000-memory.dmp

memory/1252-11-0x00000000025C0000-0x00000000025C1000-memory.dmp

memory/2508-268-0x00000000000A0000-0x00000000000A1000-memory.dmp

memory/2508-261-0x00000000000E0000-0x00000000000E1000-memory.dmp

memory/2776-299-0x00000000000C0000-0x000000000010C000-memory.dmp

memory/2508-543-0x0000000024070000-0x00000000240D0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

MD5 0746e5babcefa3b07c8f315a42fcdabb
SHA1 8f6f15241bfe1d9f15f0f86af11e25f92d144cc0
SHA256 7ead0f724ec2fd62f1ed50b0856fda637fa8ef2ee5de8eb33fef1df58faa3806
SHA512 8025ba2a59c712dadfe932bfcce90a1a111e6b72a7346d0e114001afadb8e85d9374a857be3897f785d4a0dc5967fb2ea2ab675d46a69e79263758b8ee44ea8f

C:\Windows\SysWOW64\install\updated.exe

MD5 db295321c287aceba94bdaa3b2141cb6
SHA1 18aeb11cf5e1d3579fb30862c56a70ace4b7ac45
SHA256 5203699ca3784d105e35cb5ee1092afb366653b4b57717bbc09d77f0e48386f3
SHA512 07720a0d47e8c616cee15a3874cdbdf586f24bb072e23f965e0350e4325724a7d841cb2642e5b0d0536ebf531ee912aa5d57d2690074ff38851b25fb4b767d88

memory/2776-870-0x00000000000C0000-0x000000000010C000-memory.dmp

C:\Users\Admin\AppData\Roaming\logs.dat

MD5 bf3dba41023802cf6d3f8c5fd683a0c7
SHA1 466530987a347b68ef28faad238d7b50db8656a5
SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
SHA512 fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

memory/2508-891-0x0000000024070000-0x00000000240D0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 f9b2e83dec24981e83f8d65db8a9b102
SHA1 bf460acba8f7620c29481a97ba43e40a9f50d73a
SHA256 9751be5ac7a25caaa41431423f90e2eecc71112329a14fc93a9294125a1b6328
SHA512 a12c27f22de3ace3d88d5f6e9f369c9c55bd4ab37dedf39d81a4ae4e86b85dbca0ae2519027077e6b4042ed64c5e7ee394687bc57ac173162cc28e02e15b83d1

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 54e01f5251006d8fcd218f5994fc2e5b
SHA1 22f7fdb8fd52271ae806456425118fea50fc5203
SHA256 8cc854dfd9f5a483337e56a3ffba6eda2c1264aacd38c1d2373a62056c2f635f
SHA512 d11ae1d34a948e2585a7c49e096d141dbe4d8fabbe1237627b623c9c487792844c8bf8d0e2b119079f13e57e301347091119b7e4dfcc5847daa79be4ca26b82c

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 32ee19a3f1036e7bcaeff1752e8425f9
SHA1 86850e6558a130bcc44723c378a02c1ee1410b3e
SHA256 e14d39fd72edac8c0323978d2119514c3dbbf8e318daa968e106bda638c1aa52
SHA512 2a5227ffb6c14c6c2a1c1a9e8f88f258c246d62ce44f7e1d65f5ca578423d73d7fbfa0a487f4b2f9d5da7a66ac4e10b19e383ea29c18557be403e5059abe56df

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 7bc3ad4c6f6aea06392573002643965a
SHA1 1e8cc6ac9c639388a57a77348e9fe90f3be59a54
SHA256 c7634d92c98d6bee72490e27a8223e434c0c2d3e064412de41a2684c58e9b77d
SHA512 18f5e7c192e3d1840b5c884e496b45162da04d28b0dab38773add46c0146390a21357e9ea79742e7b877b698c6ff6a8455b302396e575953c017e86723f401d1

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 1d52b9ecc0f3bfa8714abe02b0c7ce58
SHA1 d725cd89b55f93a8673b2b7f8d1956896aa9b4eb
SHA256 cadd44aa778b9113a0c30162a7ecf37e4a43400ee09ef455f702bd89a4dc364b
SHA512 19effaade0933116a47a7314c30b051409e3e31280d6f48d9e971dd227251cd0aca6c1b30711d0ce339043f62180e3a6676828d359b04722e0da4bf5000b9715

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 e8eeaa3559a37812cdeea64c466c58f5
SHA1 d8f99a25f5f4d7d726d00896da4d57103dbb2996
SHA256 ace7444032ce78d7d9ee9a00c550e682bc41358fafb76783deac815cca9fe4be
SHA512 f39d962d524a36ddae4f90fe20e858ae934ae0762da6382766c38f6a874f8042a641c205579e52c303003261ff831fd72a0967bb02596b28071043417864d293

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 78f43182e71d2101b83a424fe77497e1
SHA1 e94432409bf5c45dff7a643ff29c918a8b1aec8b
SHA256 4c0be6f09f426cc2e3506353301349f37d5c4aafaeb9ea3df3a03b7d41d55629
SHA512 d9c93439ea5b5be3afef4106ce3b1a5c3c526bcb85eb1910de5f2896900bdcc2c1396bbb2db21a286409d22c9ba5610cc7c625fac56faa16d62d451b6094212b

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 83dab600735c9b58b3998e219636c16a
SHA1 9414cfb84797ec2fc7fa892fe8f150585884da94
SHA256 025085ecca5a15c025c3c56eaa709faebb947ac4fc5e8523ce9ae6980cd07d60
SHA512 f289c491a7b198957b4cb5449dfe564f6532d1d4a6401990a12a00d543bbcf8fd0a2cd5b8bcceb4c18ae091ae00383255be03990fce21b84c7d2a924d3850b19

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 d6b32c8a822dca415a95375fcd89d049
SHA1 c2479022cd43b9167eeebfd5a1fd46b61c9edab4
SHA256 aae604d9281f80bfbf0b0dd7ff929f216bc82ec6eaf40ece1a15a68773ac6019
SHA512 77f9fa7ff70b0bb410f7617f080690e5a4509a462da4494230a275e0fac040399e3df504ed0f6fc5de35f499e65230555ff75b0a78fb2ad1d4f17ad788f1afb4

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 fb7b221dc8ae3214e17c604682446d4d
SHA1 f15f2021cd0d146a198cf8b198dea2b48e83b75c
SHA256 575cd6e7f144d9edd1bfed552eec49c35dc4b3a745f109789c0f5228d7bfcf96
SHA512 d266affa38bd020c18bd63d84a5815b5db75b3826238f5d19a8e2a805369a402b9b5e8ebb13c8ddbfd7fdfc68eb46de47b6d62cd70b64cbfbfac0c46c919807b

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 1c6afe8378053ce62efef55990a7c28d
SHA1 fcc63f39c555bb473d58adc19800f08997279a1e
SHA256 81f5690aea9eee0eef572c9f1c1777650b34fbc31009dc5901ac24b38a4a4038
SHA512 79c0d488403213ba8bbefaa90ff99ca6e44b6a9a7f53e322042ac14743f6d91ca23cc38c43751ca807d85eb33433710d9b169431d667d6a8d709936843abf46d

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 b1ddb3f25f35a4f986bb505d62e7af27
SHA1 9743d2fbc537140d9a08cb52993be103c4233b49
SHA256 fb1266a77d2aa24320cf24d6f92e9b3078d355aa26e949f7ebd747fbe6840911
SHA512 c99950b5d2654f9c81c3b84dd4b1681db7772082004f92c0d1a285aa1badababefe46ee02e5388e47d5f1b02b61ca413e16c1326b40782e32c74b99d976b2906

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 323c1a7fb83d1d11ef53b6f8ff916d00
SHA1 19e3f3eabe89f5b0edbf396d822fad5ba7fe387d
SHA256 650c98ee09afb12538c1f689a510c83f0095a5db008739eae2689455778564eb
SHA512 f08d14fbe5e75b4476d7bdf3ddb205910c9245c2160a204e83c0d425c85321229764ea7803e8cf7d32cc6dd4af213dea8d8a9a8f993c37a9899d844271b62738

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 fdf9d479c147fbfce17f09ce56d6dc03
SHA1 bd8abe835bd5e9123532c9aaa4f16fdc7e69af19
SHA256 faec86df7d0beb35d30acce4e2b10fcf13f15a29dad1a9e3d62ebd83464d5a66
SHA512 4bc9f9a313f7f659d2cc905949439335ee092b41c8ff86d1ba37860e62a9fc01fd5521e774dcf58e74f5b277587e5992f74516c498d700c4e14090ae02e04a8e

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 a9d48d2e680a078ce83b6b9b878de286
SHA1 2603a5662d0eb7216599fa1190233c78212c9081
SHA256 055ba281787b1307e5efddd6ed64e4cac7f6a6e687801cdb65b66fd4d27b99ed
SHA512 9706074aa69b9b1427b3e114c4b893a1af087c1dc05bda794cd0e9eb93cda6b034d39e03656cfd859c8b1f88962326e44a8304eccf25496e07d02709e1a9ea22

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 96ebedf49e077764575255842e89048f
SHA1 62e6d37177d993be411b9cde5ad55bd458e24f50
SHA256 9b323711ede5882c1f87510ce576f55de66b304debd354e0f810c5555bd8623d
SHA512 5edd6ef76e04b1f47fd9871f19bb70dcb8ee22109f8cf7d832e8b5f8f420105a5dc5f734022ea866a8570d4b23e68755ad135e41a229dddc4e00507e1d4becb8

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 3a61d1283118c9936336d638e187d3d0
SHA1 c05fd667f772bc59e4b9cc43f0e88d1ffb8876c9
SHA256 de7a79107fd2a106cd901882f9b643121207fa215f64104d4a6ca3c9445e2a36
SHA512 b0be1072ae9a1d0a459b1b14cc5827d31cc7d5126a400e1a65bb7d36b1fa6445fc30098e6e655a18cb62245b70fb3605c2d88e5d591dec7380efab0d3449e6d3

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 2d7393948189f350373501be93788c20
SHA1 663cd911c615af9e7f1ea09860fd92059b8d0626
SHA256 2c652637810cc1d70cc4f97a4d8050a035979295e3587dddf01a568466bbcbbc
SHA512 5cf79bf452633d34959c1e4d009a6408f88bc9ab269f485bf24238e3e16387f5debfc5489315dac562a396e94d64eae19674f1e49e3af87d187ceee41120d2c9

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 2d3a030a1e66bfc5befd4fa1cdf4f20f
SHA1 e6624d6a4cb2e49bc054f12d6217103fa3e8dd2c
SHA256 bd424affe026db8f55a85fea707b07dd1d006026263d78036ffac6502345d65e
SHA512 721e16e2ce9961f971b1ae7c3e79ec29a7e3ffd16f23d246a38c1022e972ca0ee7ae22764bc1d5c0629128af9d8bf4c7803e700310097180c0e59a934aec4855

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-11 20:29

Reported

2024-09-11 20:32

Platform

win10v2004-20240802-en

Max time kernel

147s

Max time network

151s

Command Line

C:\Windows\Explorer.EXE

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\updated.exe" C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\updated.exe" C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{445N60N3-08V0-S2B7-RWIS-4QV11S48Q5X2} C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{445N60N3-08V0-S2B7-RWIS-4QV11S48Q5X2}\StubPath = "C:\\Windows\\system32\\install\\updated.exe Restart" C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{445N60N3-08V0-S2B7-RWIS-4QV11S48Q5X2} C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{445N60N3-08V0-S2B7-RWIS-4QV11S48Q5X2}\StubPath = "C:\\Windows\\system32\\install\\updated.exe" C:\Windows\SysWOW64\explorer.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\install\updated.exe N/A
N/A N/A C:\Windows\SysWOW64\install\updated.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\updated.exe" C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\updated.exe" C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\install\updated.exe C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\install\updated.exe C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\install\updated.exe C:\Windows\SysWOW64\explorer.exe N/A
File opened for modification C:\Windows\SysWOW64\install\ C:\Windows\SysWOW64\explorer.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\install\updated.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\install\updated.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\explorer.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Windows\SysWOW64\explorer.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4336 wrote to memory of 4684 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe
PID 4336 wrote to memory of 4684 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe
PID 4336 wrote to memory of 4684 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe
PID 4336 wrote to memory of 4684 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe
PID 4336 wrote to memory of 4684 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4684 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe"

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\install\updated.exe

"C:\Windows\system32\install\updated.exe"

C:\Windows\SysWOW64\install\updated.exe

"C:\Windows\SysWOW64\install\updated.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 33.140.123.92.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 www.server.com udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 121.170.16.2.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp

Files

memory/4684-0-0x00000000000D0000-0x000000000011C000-memory.dmp

memory/4684-1-0x00000000000D0000-0x000000000011C000-memory.dmp

memory/4684-2-0x00000000000D0000-0x000000000011C000-memory.dmp

memory/4684-3-0x00000000000D0000-0x000000000011C000-memory.dmp

memory/4684-6-0x0000000024010000-0x0000000024070000-memory.dmp

memory/1620-12-0x00000000004C0000-0x00000000004C1000-memory.dmp

memory/1620-11-0x0000000000400000-0x0000000000401000-memory.dmp

memory/4684-10-0x0000000024070000-0x00000000240D0000-memory.dmp

memory/4684-27-0x00000000000D0000-0x000000000011C000-memory.dmp

memory/1620-73-0x0000000024070000-0x00000000240D0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

MD5 0746e5babcefa3b07c8f315a42fcdabb
SHA1 8f6f15241bfe1d9f15f0f86af11e25f92d144cc0
SHA256 7ead0f724ec2fd62f1ed50b0856fda637fa8ef2ee5de8eb33fef1df58faa3806
SHA512 8025ba2a59c712dadfe932bfcce90a1a111e6b72a7346d0e114001afadb8e85d9374a857be3897f785d4a0dc5967fb2ea2ab675d46a69e79263758b8ee44ea8f

C:\Windows\SysWOW64\install\updated.exe

MD5 db295321c287aceba94bdaa3b2141cb6
SHA1 18aeb11cf5e1d3579fb30862c56a70ace4b7ac45
SHA256 5203699ca3784d105e35cb5ee1092afb366653b4b57717bbc09d77f0e48386f3
SHA512 07720a0d47e8c616cee15a3874cdbdf586f24bb072e23f965e0350e4325724a7d841cb2642e5b0d0536ebf531ee912aa5d57d2690074ff38851b25fb4b767d88

memory/4684-138-0x00000000000D0000-0x000000000011C000-memory.dmp

memory/3484-139-0x00000000240D0000-0x0000000024130000-memory.dmp

C:\Users\Admin\AppData\Roaming\logs.dat

MD5 bf3dba41023802cf6d3f8c5fd683a0c7
SHA1 466530987a347b68ef28faad238d7b50db8656a5
SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
SHA512 fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

memory/1620-159-0x0000000024070000-0x00000000240D0000-memory.dmp

memory/3484-163-0x00000000240D0000-0x0000000024130000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 2d7d96e1506a9c6fea76419503f543fa
SHA1 e83d93d23c1f4a14293b199f70c266740cc4207a
SHA256 ab7c980be74f08772850f4e7d2eeed0cf98952c54f403f9231e7fa1d1811aaa4
SHA512 694c1efd63c03f9fcdb2d5fba091ed095b9443a052e8224a49682e6397d37ce99e38901219218053568a4742f47935b50e5a8dc6437297f58173c243c493fc4b

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 f9b2e83dec24981e83f8d65db8a9b102
SHA1 bf460acba8f7620c29481a97ba43e40a9f50d73a
SHA256 9751be5ac7a25caaa41431423f90e2eecc71112329a14fc93a9294125a1b6328
SHA512 a12c27f22de3ace3d88d5f6e9f369c9c55bd4ab37dedf39d81a4ae4e86b85dbca0ae2519027077e6b4042ed64c5e7ee394687bc57ac173162cc28e02e15b83d1

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 54e01f5251006d8fcd218f5994fc2e5b
SHA1 22f7fdb8fd52271ae806456425118fea50fc5203
SHA256 8cc854dfd9f5a483337e56a3ffba6eda2c1264aacd38c1d2373a62056c2f635f
SHA512 d11ae1d34a948e2585a7c49e096d141dbe4d8fabbe1237627b623c9c487792844c8bf8d0e2b119079f13e57e301347091119b7e4dfcc5847daa79be4ca26b82c

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 32ee19a3f1036e7bcaeff1752e8425f9
SHA1 86850e6558a130bcc44723c378a02c1ee1410b3e
SHA256 e14d39fd72edac8c0323978d2119514c3dbbf8e318daa968e106bda638c1aa52
SHA512 2a5227ffb6c14c6c2a1c1a9e8f88f258c246d62ce44f7e1d65f5ca578423d73d7fbfa0a487f4b2f9d5da7a66ac4e10b19e383ea29c18557be403e5059abe56df