cybergate | 2753c8b0d7cc891d9f9665e82cefcdc085064810ec8c0cb1988c36bbc0938bc7

Analysis

max time kernel
150s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-09-2024 23:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
Size

301KB
MD5

fd60ad05941f2bee3dfd05c976bc2eff
SHA1

eae3af05983d5e47ebb3f228f98517f9a3806376
SHA256

2753c8b0d7cc891d9f9665e82cefcdc085064810ec8c0cb1988c36bbc0938bc7
SHA512

b16dbd2bb8c169bb5e772469f2bd98947e74dd7c30a1899b3416da6b2c967c6644baf97f138192b725e343233ec10c4b2516c889b7f0e302f0161392052c522b
SSDEEP

6144:tmcD66R7M5JGmrpQsK3RD2u270jupCJsCxC:4cD66DZ2zkPaCx

Score

10^/10

cybergate vítima discovery persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

vítima

mise1.zapto.org:5210

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
server.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
abcd1234
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe"	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe"	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5VA86RD0-3W22-6R73-7QS8-ODE408423R68}	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5VA86RD0-3W22-6R73-7QS8-ODE408423R68}\StubPath = "C:\\Windows\\system32\\install\\server.exe Restart"	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
10576	server.exe

Loads dropped DLL 2 IoCs

pid	Process
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\server.exe"	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\server.exe"	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\install\server.exe	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\install\server.exe	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\install\server.exe	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\install\	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2676-2-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral1/memory/2788-307-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral1/memory/2788-2989-0x0000000024010000-0x0000000024072000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
Token: SeDebugPrivilege	2788	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2788	2676	fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe	30

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
PID:256

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:336

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:384
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:480
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:608
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:1440
  - - C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe
      4⤵
      PID:1044
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
      4⤵
      PID:11228
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
      4⤵
      PID:6984
  - - C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe -Embedding
      4⤵
      PID:7504
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
      4⤵
      PID:8080
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:684
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:756
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:828
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1180
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:864
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:980
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:272
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:308
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1080
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1116
- - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    3⤵
    PID:624
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:1852
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:2752
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:488
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:496

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:392

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1244
- C:\Users\Admin\AppData\Local\Temp\fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe"
  2⤵
  - Adds policy Run key to start application
  - Boot or Logon Autostart Execution: Active Setup
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Users\Admin\AppData\Local\Temp\fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe"
    3⤵
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:2788
  - - C:\Windows\SysWOW64\install\server.exe
      "C:\Windows\system32\install\server.exe"
      4⤵
      Executes dropped EXE
      PID:10576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

Filesize
240KB

MD5
40bf045a90c5af86f363d052477f951e

SHA1
ff32c907dca090c8e3cba347708964cf213bc4a9

SHA256
bf3afb0a67cadfa0f7cd76d91da74b80bfee530c5a5ac266c41a7ccde4a77104

SHA512
2518a062a9141a6cd9e7216217f89f496cecb81688939664dda7067dfb52ee92fa8e0bc6f956f32c2542a10cbb2a2a374999d4ac551cffe8e7f3a43cb2291c58

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
31bb25a1ce6f0c26f2a3eabe2f579998

SHA1
654508c7a879545c6d6ee66538619213c36ae203

SHA256
ea1f6549ccf1d9676a9245dca2dd9cd4e78c7a87254a6d6d7324ea74845ca0e8

SHA512
ebcbdf5866ce9b17a9bfa195bcc92c8da178df6b1c9ffbfa3ebd6b09b591101c2d3a6d00556164545086ea3db13edd91ceaa6b22839cffa927c1253a9f263d6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
31ace7304e92727f086efd2f03088a9a

SHA1
2d6784450f5ca253ee2ce0cd6ba26397ac7418b1

SHA256
4b7e50237b2438d642126ec63ceb48afa8fa57d8a2c3125eeb9a218a13228f42

SHA512
bc829f25ccffe46741f30c25d6d2707f12d8c388268c724ba34057847782c78faf9a60a451e3f1f5472a5b1420dba14932a98dafe7f6d719e0bb4e6f50fe5c3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
fafb96b4d3bf3fd9f6c8f79594e8faca

SHA1
1ca8567108e24478a934b6258fea405a0b9a1e6f

SHA256
3ca8a1175ff3f1e8741605e8b6bb524305d5d3d0325fb3f3a3f3f95fecb3968f

SHA512
8c535ab17a4ea1e4c3479f2701d2080304d1c8ec5fd3d340bc9c6c7b9c8b123ac65ad076098afe85f708828a88bea0f06f1d56dd6c1cf7e8afb57f80f9670f97

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
92aa1338f1cd2b1ed58e46583e958433

SHA1
f597ce89bd6bed82ec593cdc5943eee0edf9d9a4

SHA256
f54cdb32bccfdffed795e8c0b87169465450b843afcdb6f21a7aa45fa5fa3873

SHA512
85fd9145a8b59c3bf3d9ebc1c33381d499421419fa707c9eebc103cbab58e41db876f0c7db3cfb0f77d5d516c685fa76d5b0554aeb1cdd5218bfd1c7333fd0d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
ce4a333868283d2827fb4377ba5cc146

SHA1
d69fcd8da19615106cec2149236589f371bf3df4

SHA256
76aa9f1b704dad9bbf659354b885728f751b7bad70f9ef572055143b37dd4457

SHA512
29403624addc0932a1c104d7048603ae837734545c1e22b41368b544f5c63d0728fe3fde1e688fb17df0ec38a83119241687adc448917da0e2b502753fe1a2a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
2cf8cabbc56f05a3f4a9f6d60666806a

SHA1
defd98697e86d57cdb333f7431f929bf962f7898

SHA256
0c04c2a1ff448da2cd298cc9656a2d552ab60f887e41ab7cc6f2d93ba0352ba1

SHA512
2546c3e5e238a6d1924b2956d4613ac9d0cd7d60e8959ffd613ba1c8e82f9bf6aa8aad651796c4970b0ef4556580a3fd5f9cdee1c1e7ff6d86225689468cd384

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
432d90c56b5e9914d48d7312790eb012

SHA1
4c05b88f34ec5c820fd790ec5c7dbeaed0d8458c

SHA256
7c02bb88c5ef8cb6387a5d40ada7e2a8d9aff80154a23d33b1f67f83f827aa02

SHA512
b9b91e318092ddddb9f6efdac1bb584e7b78cb7473bd42dc3576bd48aae61f3c29f84f654894a81fa347e0bd03ee27dd3a7ed2b1e962e97db8fd02a64ed8756f

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
7dbe8d7419380afd17917188b52d429c

SHA1
7d9d2844d9a39c0745bc8132ea3bf461262af23e

SHA256
6aa119f64bf66da234474da553d60bbfef29b81f07bd703c0979e20707a828fd

SHA512
7bcff8273a244f2dbe11c7615b63d1cb9f33089dc4527f15ff3a85ec47385ef7706101d2087a3b4efbb5bba941430e1dddaca042c1f36337ed1c2c3e754aaddd

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
685fda2dd4f5998fffbe30c38631eeee

SHA1
18b408d836fff1f41276232b2d7b360f02ec7a10

SHA256
561fd162ba2cd94737f3bd51d32155a9614f310ca20ee067d5f566c8de4c4b8f

SHA512
f3067211a77a5085e3c62687f57f23dc15f440674e3a91df6e72ec2f3c0fffd7ef4a503443983517fee81694d92f2108d1ba971d88485793b1b036749ac67e6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
5639c638ccea4eb6e47a8d0acb0ca608

SHA1
14d5bc6fa27548e2f106aa32dfe4871aa9cb6356

SHA256
cf068768a91b3a593f87f937c88887514f4568d783b4fb59d32c87fbe7f80747

SHA512
200fce5ae8f19f68d345ae3d4c9719f4eb6c503810bbea77836bf6fba7dd67bf4dc5af8f0a5b09b4cd8389c32c9d2d1a62a49ecdfc9c2f1d4e9f1f0695a7890e

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
c51667adc57f694167892f825b97c364

SHA1
c3a306ef6cda9c32addb802a5e1fccfe097ddcd6

SHA256
570636ee2c047648178c9c825d37851b00f8aa570e8c2c8d6584cede8cd192e7

SHA512
5d7c26f1fed5b39e75099ac54fc7f5cc615f9fc17563b15a57c77ced1bc6c323b9554ed0d1ef04c8ec35e9a917fb4288dbe4a2af21b3b9b0fae8a1b6b86b6db7

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
f5e0a40ddd42bdf731acbe7fb8ac8299

SHA1
c0d902ad84916acba7f5cb4b92940eb9dc19b3cd

SHA256
5a71891effd53b2ddb270218fe6ff941e0ced66fcf3bcfa6d59fa3a33ec3f733

SHA512
a67875dda735e19ed6bfb47ec9eeea2ce713090e181df4e2171da8c17b7d2e30db8cc5ecffe375508121ff00494e351bca27f7282b6c89d52d3db77eceba5f92

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
082d15fc030dd259da044522353b8ca6

SHA1
9c7f23879c264daa0f10198531b4c87c48d533a6

SHA256
2bc75fbe7b1850eedb5140b50b0c1cd1bb3a9af8227bf3863f95f3d9d966e468

SHA512
150febdd75f4157457b9086eea95d5879bd239935f8119fb7b7a36628b71f6afacdd40775319b3a3cf1fc4d3381dd3a706cff12a16291267ee33eaefb29515af

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
12196073dbb4e31ba50208fc4eb638f0

SHA1
07d931e256e8affbda32e4980e5711491409b24b

SHA256
18cf2241eef5ab17e6addf817343a693d36240e31ce97d9136aab71ffdf83763

SHA512
6b78d282bb5a3792bc270a54e3efde7e9f42853feaf86e81b1225138818d4edb8d45daf52fce1d893084a3d14004beb12a42fc5b6ae6287da20b225bdcf31c3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
1238d20c25f4f8574676952ce9e9737b

SHA1
d3865e08060a839f10fa7b802ec45743cc24363e

SHA256
0ecffae58298eaaab7dca8fd7b43ddad415103e74c6322bc50c8a7f36e0362b0

SHA512
db34af7734016ffa076d9a678d76f108cb33deba09e9c7987e9467ad7d3b8d217f4a7a82ebcf802934e1cba2e601c32ba9c921b83fcbb0cab4e57d03a8cc931f

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
48a93c37f7be55bbce2800beb3da80d8

SHA1
d7913bf452c20e8ce90efe0242aab02dde1c74bc

SHA256
7e0f0dc62371c3072c08db890f0ee65b7a9f90a87e6079f96a960cb6d4eb30df

SHA512
ffee7641cb974c6212d5befaa8e4963da45a43cba616a32c6e7c4d51d84c4bec3b07187abe3b490e819abfd391f702dda9aaaffc7b28fc93a53ba0144929db9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
b7e64d5879d95e422d78bd7d75ca61d5

SHA1
665e23f23f4d3d0c8f3689bff3f293e6f5fa2b3f

SHA256
7f81a59422fcb8db97e80411bf43852333c1debdd4ad0ba9153e045cb2e38965

SHA512
a9c890a260ff9af8a29de2d9c281123239cc5a11bad5e4180c508b3799bfd0d5bc84d450acd2104a3e8124c4a2833f8fffaa9d4e912a79862275bceddd382adf

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
82c4b965ee14eccc776853ab3d12decf

SHA1
a5d9e0926113ad93e8a9866765ad7482b456fcd6

SHA256
3dcc13598ee3711bec3a7bf0bb8f5c0ec91c3c1ec127fdcc14bd8b4483de48bb

SHA512
ea8ceea11f82ea88f8e3d5228374c20bf1d5873af74879574081ced4eb7ebeb94048cb6a7fac77585fa881959a764fbf811b2cc5146fa78b1ae72074980de46b

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
ca8f1d5e3e95945d4334538e5f427d09

SHA1
63cd367e6b36457ddf0546480e24e885c4868b5d

SHA256
cc48e2c1a07204fb7382d33ae21be44d3698e2b298088a573992e35cd71610b3

SHA512
3c35f7cd48d67477684270151c7b3eb6e94e9c69d5c87364116fa6b5ab3b76cb33edcb546aac7c355deb81ba098f633faa499ccdfd74a8c23cf00e25961c67e3

Download Submit
C:\Users\Admin\AppData\Roaming\logs.dat

Filesize
15B

MD5
e21bd9604efe8ee9b59dc7605b927a2a

SHA1
3240ecc5ee459214344a1baac5c2a74046491104

SHA256
51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46

SHA512
42052ad5744ad76494bfa71d78578e545a3b39bfed4c4232592987bd28064b6366a423084f1193d137493c9b13d9ae1faac4cf9cc75eb715542fa56e13ca1493

Download Submit
C:\Windows\SysWOW64\install\server.exe

Filesize
301KB

MD5
fd60ad05941f2bee3dfd05c976bc2eff

SHA1
eae3af05983d5e47ebb3f228f98517f9a3806376

SHA256
2753c8b0d7cc891d9f9665e82cefcdc085064810ec8c0cb1988c36bbc0938bc7

SHA512
b16dbd2bb8c169bb5e772469f2bd98947e74dd7c30a1899b3416da6b2c967c6644baf97f138192b725e343233ec10c4b2516c889b7f0e302f0161392052c522b

Download Submit
memory/2676-2-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/2788-307-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/2788-3-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2788-14-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/2788-9-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/2788-2989-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download