Malware Analysis Report

2025-01-02 12:26

Sample ID 241125-zzs65atjep
Target 9de9363c50721f3c8eae5a2725f51690_JaffaCakes118
SHA256 332773c3fd474628c8712985b6dcdf8e7e38f478570ac87665410023e60863a4
Tags
discovery persistence upx cybergate cyber stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

332773c3fd474628c8712985b6dcdf8e7e38f478570ac87665410023e60863a4

Threat Level: Known bad

The file 9de9363c50721f3c8eae5a2725f51690_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

discovery persistence upx cybergate cyber stealer trojan

CyberGate, Rebhip

Cybergate family

Adds policy Run key to start application

Boot or Logon Autostart Execution: Active Setup

Loads dropped DLL

Executes dropped EXE

Checks computer location settings

Adds Run key to start application

Drops file in System32 directory

UPX packed file

Unsigned PE

Enumerates physical storage devices

Program crash

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-25 21:09

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-25 21:09

Reported

2024-11-25 21:12

Platform

win7-20241010-en

Max time kernel

148s

Max time network

152s

Command Line

C:\Windows\Explorer.EXE

Signatures

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\69.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\system32\\Svchost.exe" C:\Users\Admin\AppData\Local\Temp\69.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\69.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\system32\\Svchost.exe" C:\Users\Admin\AppData\Local\Temp\69.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6WXVCM1E-AV5K-V4MX-7547-SIU6F38IB028}\StubPath = "C:\\Windows\\system32\\system32\\Svchost.exe" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{6WXVCM1E-AV5K-V4MX-7547-SIU6F38IB028} C:\Users\Admin\AppData\Local\Temp\69.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6WXVCM1E-AV5K-V4MX-7547-SIU6F38IB028}\StubPath = "C:\\Windows\\system32\\system32\\Svchost.exe Restart" C:\Users\Admin\AppData\Local\Temp\69.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{6WXVCM1E-AV5K-V4MX-7547-SIU6F38IB028} C:\Windows\SysWOW64\explorer.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\69.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\69.exe N/A
N/A N/A C:\Windows\SysWOW64\system32\Svchost.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\69.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\69.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\69.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\system32\\Svchost.exe" C:\Users\Admin\AppData\Local\Temp\69.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\system32\\Svchost.exe" C:\Users\Admin\AppData\Local\Temp\69.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\system32\Svchost.exe C:\Users\Admin\AppData\Local\Temp\69.exe N/A
File opened for modification C:\Windows\SysWOW64\system32\Svchost.exe C:\Users\Admin\AppData\Local\Temp\69.exe N/A
File opened for modification C:\Windows\SysWOW64\system32\Svchost.exe C:\Users\Admin\AppData\Local\Temp\69.exe N/A
File opened for modification C:\Windows\SysWOW64\system32\ C:\Users\Admin\AppData\Local\Temp\69.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\69.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\69.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\69.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\69.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\69.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\69.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\69.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\69.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\69.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\69.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3032 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\9de9363c50721f3c8eae5a2725f51690_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\69.exe
PID 3032 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\9de9363c50721f3c8eae5a2725f51690_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\69.exe
PID 3032 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\9de9363c50721f3c8eae5a2725f51690_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\69.exe
PID 3032 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\9de9363c50721f3c8eae5a2725f51690_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\69.exe
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE
PID 2780 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\69.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\9de9363c50721f3c8eae5a2725f51690_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\9de9363c50721f3c8eae5a2725f51690_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\69.exe

C:\Users\Admin\AppData\Local\Temp\69.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Users\Admin\AppData\Local\Temp\69.exe

"C:\Users\Admin\AppData\Local\Temp\69.exe"

C:\Windows\SysWOW64\system32\Svchost.exe

"C:\Windows\system32\system32\Svchost.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.server.com udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp

Files

memory/3032-0-0x000007FEF651E000-0x000007FEF651F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\69.exe

MD5 6afb13c14bf63d663dbe88d7f1fe0130
SHA1 5e707443dc8dfc126f443fa405af457913dec921
SHA256 cd5d45fba6c736217301dae95df68b0842223b2781dc4b8aa2c8135903e538c2
SHA512 e8d4adb40dcc6291c5eec5af649ac1f3b1c38faa398d8e76617c5bcc29cb2f449554ade6c6daf1f35505ada83c86d9fb473e5899d8bccb814aaa1e931fed2bf3

memory/3032-7-0x000007FEF6260000-0x000007FEF6BFD000-memory.dmp

memory/3032-8-0x000007FEF6260000-0x000007FEF6BFD000-memory.dmp

memory/2780-12-0x0000000010410000-0x0000000010475000-memory.dmp

memory/1180-13-0x0000000002780000-0x0000000002781000-memory.dmp

memory/2056-256-0x00000000000A0000-0x00000000000A1000-memory.dmp

memory/2056-268-0x0000000000160000-0x0000000000161000-memory.dmp

memory/2056-551-0x0000000010480000-0x00000000104E5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

MD5 86189767ef0bf87128b19869a9197060
SHA1 b8c6dcfad0f5234547d83a698dc7ffecc7abb817
SHA256 1af86964f23c531bcd6f9c08e1317f5376c303fb6ca792e5fb0d5e9990a1ab88
SHA512 05ca6ddf3db0f8f08c6bc40240baff09f015327bb6c377b0de0f29968927825b7cef4061d83c8a4ab88a12773a6d9345a7c407d809e0ee1b6f3fc0d692fb7e27

C:\Users\Admin\AppData\Roaming\Adminlog.dat

MD5 bf3dba41023802cf6d3f8c5fd683a0c7
SHA1 466530987a347b68ef28faad238d7b50db8656a5
SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
SHA512 fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

memory/3032-899-0x000007FEF6260000-0x000007FEF6BFD000-memory.dmp

memory/2056-907-0x0000000010480000-0x00000000104E5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 fcdb6b5fbbea1644891afa1b7edd248d
SHA1 d068146aa72fdcf9b1fa3b374625719c8c2e67ce
SHA256 4cf92f1a54974b341520f0fc7c1f81e5dec43e4330fcea3cc5759e7238a73f87
SHA512 e282ece3a0333d084c096eae61aa81f1fd771a35bd12910480ccd93cb9799764c84c54924c34f54c213f362568fd95396a2279418d0d9824ab29b320ecd99f90

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 5615143300b1189c3ee413900d5bb24d
SHA1 71b162367172b7da1244f0991900a08c80f7b50e
SHA256 2e117ff3a82ad5c82412eb01efd0dc3182ddfacfea1a12b0a32dd38981946d3f
SHA512 d2fce2a2834f23c854af7dbfc7b22861cc7f90397ef9378d8c86e05260fe39ac9503cddaa5a2d54557591e0d9281de11dad38df0044b5437c612080b7965001d

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 3b0f17ab4fdc4611cfb4defd78ca6ad2
SHA1 8d223493fc8abf48eb954b2f1234d5afd5b1df03
SHA256 65950d44f291328bc85bad08be9e0d637a4970a6a7db22966d37007701f8628a
SHA512 5f0ff45d2821674a5028295d7013a96f892eb22b012defc3f1d1105f73421a307fa5c55ecda3febfc2e7d21870d237c2e5d50e8c6b182c17959a15ebaad11c25

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 12557128031a99221bcb44247e447035
SHA1 6a11161a7504ec1baeab212be34617e45ad4d793
SHA256 bb8c37d4676f848a38ccec79d216bdbd142282f8d9d7b432882b731ee09ce7bc
SHA512 3e5985a4a5389d00c0f6486c2bb6540381ab10620e0ab0ec101b51f4ae7ceb1bb0bc69ed5f3bf1212a52cb52d8465870fb7876e8c1d029a93d5ab8db32d0aac9

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 218489f938082050e13e53024f6dc93c
SHA1 624b122c248758fe4b884caa0b825e41cbc216c5
SHA256 96e6d7eb6add65ac3e3d4c004068f3f3ed46e90f66402dae2d62d8cb6d3dda0a
SHA512 3aa11ef1a5c09ef1310b23eef1c51c829909412914a175c3bab28fe3983e7f9f2024c614759c3cf486a52a3b9104c978e54702693123e08f2d27163938553fa5

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 9e1b4e2d27d7b3e188a8e7edb79d889a
SHA1 aefd3014c91b19bde8b0d6b6e62abe14526e0839
SHA256 b4e0c61d9b1e321344c7c1b0d148d4a0000d4410d41a1723fcae515c6a4f1859
SHA512 69fbdfbdfdfe0ce2224b18935c4c9ffa3cd90bc5da1aeccdc53d33bca0f681f2384a887b0b9a53e4ea62f21414031fda1576b6e2aa5cc494c180faf402204493

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 04b05bc52b2ca0313bab88fb61da6fde
SHA1 faa32f8c3690fd59e7334b4b7b694d1d870acfdc
SHA256 f06da408e59bf8658ab2b128dc86e218bb6aa19ea78051eab5da052480cd2159
SHA512 fc70a9832a36808d49b09ca53332722af34f96d0bc41659eff70d5156d404001af43566f44ea9c33cf40d93be333273eaf873914d3e1536bc7732383d4edb8a3

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 50de4cab1083d5cf8cd706e5f1b0ff4c
SHA1 895795066c2205e315a3b1712c4c4c69915a9111
SHA256 a8951e7d9c9b7cd79cfe71106349355cae7ef582945d8e93c1cb91c8e2d55ea2
SHA512 71a1d9c6d36ed7c464744133455c41067dd99da185586ea8cd9ef0ec32a624f7c33d7faeccbfedea2f7d365b5d117d8e42200f81220d601715f12e5f1dcc4500

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 a4cbe8d803912c6762a498462121087a
SHA1 2ad075983a0aeb004e4724b88771e2a06edf2bbb
SHA256 a2ed7be0bb68eb79ee24fd90fd4ba16390fd3c36a05b71523dc766f6f4abe623
SHA512 0205cc559d2a8c24d83fca158a70c51efd79f89e74f11e5bdffb4fb8f2ead40cef1fe4e0294ee6723c55c43ddf836f40130898ea3609c2d25d8d93173f82677a

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 5887ed0851fe17fc9139b899b2f525fc
SHA1 dc8c8a1eb720ecb6f65a6915777aaab9604c33e4
SHA256 431860144cbce2327b5f3da9b06e4892324d4d45b01c2a1df2b03388995a639d
SHA512 4141a984600526f13995157341983c6cd3c183ea73c24453d8b7d312ff8da3822fa69ad828ae61c597c3654fe3774cc5a2ae5fe7a30e9e7f4b51ad6803294163

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 c275d2f4e6fd7d1e3efae7d177beabdb
SHA1 f7841e53e6c56b557b5a4008f95fde51a3bb89b6
SHA256 6cd17a5c6d8d136400334f387220cd49ced0ff8ceeda230f960267c6402cdec2
SHA512 4dc6fc52edc3b26432b63c167d894bd1a4d8d6595198788a157b9d4a7333787c39ef1d4ecc30cf9cb979b157815eb4f508076e3b67a66d6a00a938e89339eb3d

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 3ca22cd52370e3c8d15eab0793d79b05
SHA1 0fa1f05f7b45c61a83f0ac8d2e46a812bb7e3318
SHA256 d9bfbcfe6258c66fa14921e1aee86c5b4bb09a09e712ac7fac2694dd617caedb
SHA512 750aa2abf02293ede06b830c4c99b7968331759b77c086187067f9135a92d53e5fc033b85b7a3d4ad8463e15eb0cddae9a10ed67969e81f8a6fabe60c4f76473

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 59fcb7745281efd707a2da6d4db3009c
SHA1 1befb081b3853fbab5861b1ff9621d45cdfa078a
SHA256 e93fc480581d3c85543f0739668a048efa23ef7ddcaabdfab7575817f87614ba
SHA512 75f6e7403300021e89acf9188b04d97fb93fa203b20bfdc020d6ed60b86955ab95beec74147e3538df79afd2caeb04fc9bdcdff7fc5c66b7cceba6567f624c25

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 06edfd6334852a215841c6668fd91bf2
SHA1 2e5a73933c739ae25d5440d76ad77f3d44501f91
SHA256 5a90b6298ce6e90e3cdecaa5ad465708331d6003dda8185dddb59b889d064d4d
SHA512 eeeda7510fef3b8149aaf10a2c06520b0f239866ec05abe67c64c5d66657ffa7a073773daa3da1fcc7d4bae33927093561b07337243b03b6fc0f15cce3efc037

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 902b94f5f7676805dcb199589b29341c
SHA1 e14a83a57693bbfe63afa4a39e9c6e52977a1cca
SHA256 62677c8444dec39e1135524abcd91af2da51ec77cfee70b034f1991a629768ee
SHA512 088a7d5edc27e7802b0f86a7c7e95bb21fd9059f81f08fd7c2d7ea8e48b6a64f945fe8cb685163c247329563a3b3c8829277e8b2d6d71eb6bb6395f20b886e8e

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 a90434f255658ce7ba5861cb0bbd5e26
SHA1 2fdf14bcd0865da2125aa1b60b66c49aeb76134c
SHA256 1c9dfc7b7688732388451c0d1b7a398cc419204c342250ba43062505b6329abb
SHA512 f417853759c3601ecbea1008b830c764d22ff5281afb56b8dbdd026654c31ea803f6f41c7eaca03f73e7e3232e572f198539661a92d9f151f509626b29612f54

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 39e2717ae6fb9660285c36dd9a68ccdb
SHA1 d4eb45717312ef1e293274d49526ec0f5828d58f
SHA256 c7e592c00194cccc736846b229e2ca6b8a2f2d4b0c3fb840604fac5a412054d7
SHA512 f7c485202d67e8a65fb1c29a97771d2e90fcb206df6e209ed3cfc64b9d89dc001a619785d90707354ada201fa0dc8c95aa8e8a0be03aaeb530f95f507540ac4c

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 1ea2fbe0117312df1d586b25f2dc7ff9
SHA1 0aca36f3429d68f9327dfe7f4f1bcf8aa1793b27
SHA256 9d46b6260aece8793afc43054ea3ea0cc619a6d3c907e41d9ac7220fed7c5e41
SHA512 f30c2dbce045db34dc1106dc387076c9a7b7ec89b802729331e1798c72b692d8980c142ae5af66cd4cd14bbac5a0ecd82b02ebb701735d767b580374e99deedf

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 f8598fbd4976bbe1caaefcfca2856b0f
SHA1 efadd7305c0f1c17fefec106e8b93070069b50cd
SHA256 a5217e68176da9fe56de584837401856c092769c59891ae41deb522e04ddd727
SHA512 f63e0ec21fe2398df4ae205de2acbab376a76870a10ad7c75d0e5fb514f0ac9bf4ba4147336ec4a961d82c3b87459df82815ea05bd833b90bac91809a1a101ea

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-25 21:09

Reported

2024-11-25 21:12

Platform

win10v2004-20241007-en

Max time kernel

147s

Max time network

150s

Command Line

C:\Windows\Explorer.EXE

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Cybergate family

cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\system32\\Svchost.exe" C:\Users\Admin\AppData\Local\Temp\32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\system32\\Svchost.exe" C:\Users\Admin\AppData\Local\Temp\32.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{6WXVCM1E-AV5K-V4MX-7547-SIU6F38IB028} C:\Users\Admin\AppData\Local\Temp\32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6WXVCM1E-AV5K-V4MX-7547-SIU6F38IB028}\StubPath = "C:\\Windows\\system32\\system32\\Svchost.exe Restart" C:\Users\Admin\AppData\Local\Temp\32.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{6WXVCM1E-AV5K-V4MX-7547-SIU6F38IB028} C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6WXVCM1E-AV5K-V4MX-7547-SIU6F38IB028}\StubPath = "C:\\Windows\\system32\\system32\\Svchost.exe" C:\Windows\SysWOW64\explorer.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\32.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\32.exe N/A
N/A N/A C:\Windows\SysWOW64\system32\Svchost.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\32.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\system32\\Svchost.exe" C:\Users\Admin\AppData\Local\Temp\32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\system32\\Svchost.exe" C:\Users\Admin\AppData\Local\Temp\32.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\system32\Svchost.exe C:\Users\Admin\AppData\Local\Temp\32.exe N/A
File opened for modification C:\Windows\SysWOW64\system32\Svchost.exe C:\Users\Admin\AppData\Local\Temp\32.exe N/A
File opened for modification C:\Windows\SysWOW64\system32\Svchost.exe C:\Users\Admin\AppData\Local\Temp\32.exe N/A
File opened for modification C:\Windows\SysWOW64\system32\ C:\Users\Admin\AppData\Local\Temp\32.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\system32\Svchost.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\system32\Svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\32.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\32.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\32.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\32.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\32.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2384 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\9de9363c50721f3c8eae5a2725f51690_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\32.exe
PID 2384 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\9de9363c50721f3c8eae5a2725f51690_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\32.exe
PID 2384 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\9de9363c50721f3c8eae5a2725f51690_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\32.exe
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE
PID 1116 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\32.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\9de9363c50721f3c8eae5a2725f51690_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\9de9363c50721f3c8eae5a2725f51690_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\32.exe

C:\Users\Admin\AppData\Local\Temp\32.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Users\Admin\AppData\Local\Temp\32.exe

"C:\Users\Admin\AppData\Local\Temp\32.exe"

C:\Windows\SysWOW64\system32\Svchost.exe

"C:\Windows\system32\system32\Svchost.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1576 -ip 1576

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1576 -s 572

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 www.server.com udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 105.209.201.84.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp

Files

memory/2384-0-0x00007FFC5DDC5000-0x00007FFC5DDC6000-memory.dmp

memory/2384-1-0x000000001B000000-0x000000001B0A6000-memory.dmp

memory/2384-2-0x00007FFC5DB10000-0x00007FFC5E4B1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\32.exe

MD5 6afb13c14bf63d663dbe88d7f1fe0130
SHA1 5e707443dc8dfc126f443fa405af457913dec921
SHA256 cd5d45fba6c736217301dae95df68b0842223b2781dc4b8aa2c8135903e538c2
SHA512 e8d4adb40dcc6291c5eec5af649ac1f3b1c38faa398d8e76617c5bcc29cb2f449554ade6c6daf1f35505ada83c86d9fb473e5899d8bccb814aaa1e931fed2bf3

memory/2384-7-0x00007FFC5DB10000-0x00007FFC5E4B1000-memory.dmp

memory/1116-12-0x0000000010410000-0x0000000010475000-memory.dmp

memory/1116-14-0x0000000010480000-0x00000000104E5000-memory.dmp

memory/4820-16-0x00000000014F0000-0x00000000014F1000-memory.dmp

memory/4820-15-0x0000000001430000-0x0000000001431000-memory.dmp

memory/4820-74-0x0000000003FE0000-0x0000000003FE1000-memory.dmp

memory/1116-71-0x0000000010480000-0x00000000104E5000-memory.dmp

memory/4820-76-0x0000000010480000-0x00000000104E5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

MD5 c11150ac20ce95af575121eeb5355a28
SHA1 79efb53fe9c2a7f6ff093c924e11e75d5d4a3573
SHA256 2b711fc8b7e018da61160c9461bc84b30eb5fb5a98a5317b29698eeaa8eb99f2
SHA512 fab2313298b468299493d32296c569f2921f39d2daf538d426138a9dc579d878879bb47ee38d8f9ffa1119591eb9339aae9623d6ea8403d21ffdfcc730a4b21b

memory/2384-86-0x00007FFC5DB10000-0x00007FFC5E4B1000-memory.dmp

memory/2384-149-0x00007FFC5DB10000-0x00007FFC5E4B1000-memory.dmp

C:\Users\Admin\AppData\Roaming\Adminlog.dat

MD5 bf3dba41023802cf6d3f8c5fd683a0c7
SHA1 466530987a347b68ef28faad238d7b50db8656a5
SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
SHA512 fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

memory/4820-169-0x0000000010480000-0x00000000104E5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 c966b989cd131163e61774e0ed35ddef
SHA1 4d92426b2d63bb02bf7894650d3ec45bacaca0f0
SHA256 ec1d730fc2a2907e01dfad0ff29d56051f3b8033e889c559fc8a37712048c4d6
SHA512 9f4aa63ac040f4f10ab6eb892e8f38f33b81ce577f8f39876f450fc4b711a1acfc9facde9849368f587ec7b1935d8bb84b6a99eed0b1cfcc89a044b5754b4ed0

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 1749b0fb544cf35f01cc906f57305e43
SHA1 80b51bca3bf25b5131f113ea118d6bd59d856b5f
SHA256 831ed201d443cf194df84c95b334334bb5b9f9ee41b0bc16771f7962f11c3ed7
SHA512 7d9961d6f31ad39bca4c02e85e8bb06d32f46e446c40e3fc7e6569634014a96e36ac6e77d05a88a02ad9a897714041fa2846f38a437565f38e69b3d8481a68be

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 28fd72164a35a52d0dbad872a6a0e24d
SHA1 97b7b346c2faff4266111c39fa1537a5f5fbdeb1
SHA256 8cc63028cefe060ea12ecc0cb03647a1bc54335b008c031c7a71f347756792f3
SHA512 ab072f79708a8eb66140a01efd47e0b0a9ffef5ed5c777ea7753643afc9bea4977979d061376e435ded3c7536775c1339ea9a4e7dc2a5f28ce53d5332c02ce61

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 c5cd3545e6667783eb8266dd68b8b7c5
SHA1 9c98f8069e446901ccfcb1e99af9d2222f94ac49
SHA256 19cbc16a5a6095d0729f0c30d7e115526760d6f669865044f9d70a5784ade38f
SHA512 7ba1b622046b6f8d21cc819c9ea6fd642e53e48db7044e99dc1c2651419dfee6714c593275de87a1e28fac760feb979beae24654d29d13ea99af5aebbd841a2f

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 fcdb6b5fbbea1644891afa1b7edd248d
SHA1 d068146aa72fdcf9b1fa3b374625719c8c2e67ce
SHA256 4cf92f1a54974b341520f0fc7c1f81e5dec43e4330fcea3cc5759e7238a73f87
SHA512 e282ece3a0333d084c096eae61aa81f1fd771a35bd12910480ccd93cb9799764c84c54924c34f54c213f362568fd95396a2279418d0d9824ab29b320ecd99f90

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 5615143300b1189c3ee413900d5bb24d
SHA1 71b162367172b7da1244f0991900a08c80f7b50e
SHA256 2e117ff3a82ad5c82412eb01efd0dc3182ddfacfea1a12b0a32dd38981946d3f
SHA512 d2fce2a2834f23c854af7dbfc7b22861cc7f90397ef9378d8c86e05260fe39ac9503cddaa5a2d54557591e0d9281de11dad38df0044b5437c612080b7965001d

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 3b0f17ab4fdc4611cfb4defd78ca6ad2
SHA1 8d223493fc8abf48eb954b2f1234d5afd5b1df03
SHA256 65950d44f291328bc85bad08be9e0d637a4970a6a7db22966d37007701f8628a
SHA512 5f0ff45d2821674a5028295d7013a96f892eb22b012defc3f1d1105f73421a307fa5c55ecda3febfc2e7d21870d237c2e5d50e8c6b182c17959a15ebaad11c25

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 12557128031a99221bcb44247e447035
SHA1 6a11161a7504ec1baeab212be34617e45ad4d793
SHA256 bb8c37d4676f848a38ccec79d216bdbd142282f8d9d7b432882b731ee09ce7bc
SHA512 3e5985a4a5389d00c0f6486c2bb6540381ab10620e0ab0ec101b51f4ae7ceb1bb0bc69ed5f3bf1212a52cb52d8465870fb7876e8c1d029a93d5ab8db32d0aac9

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 218489f938082050e13e53024f6dc93c
SHA1 624b122c248758fe4b884caa0b825e41cbc216c5
SHA256 96e6d7eb6add65ac3e3d4c004068f3f3ed46e90f66402dae2d62d8cb6d3dda0a
SHA512 3aa11ef1a5c09ef1310b23eef1c51c829909412914a175c3bab28fe3983e7f9f2024c614759c3cf486a52a3b9104c978e54702693123e08f2d27163938553fa5

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 9e1b4e2d27d7b3e188a8e7edb79d889a
SHA1 aefd3014c91b19bde8b0d6b6e62abe14526e0839
SHA256 b4e0c61d9b1e321344c7c1b0d148d4a0000d4410d41a1723fcae515c6a4f1859
SHA512 69fbdfbdfdfe0ce2224b18935c4c9ffa3cd90bc5da1aeccdc53d33bca0f681f2384a887b0b9a53e4ea62f21414031fda1576b6e2aa5cc494c180faf402204493

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 04b05bc52b2ca0313bab88fb61da6fde
SHA1 faa32f8c3690fd59e7334b4b7b694d1d870acfdc
SHA256 f06da408e59bf8658ab2b128dc86e218bb6aa19ea78051eab5da052480cd2159
SHA512 fc70a9832a36808d49b09ca53332722af34f96d0bc41659eff70d5156d404001af43566f44ea9c33cf40d93be333273eaf873914d3e1536bc7732383d4edb8a3

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 50de4cab1083d5cf8cd706e5f1b0ff4c
SHA1 895795066c2205e315a3b1712c4c4c69915a9111
SHA256 a8951e7d9c9b7cd79cfe71106349355cae7ef582945d8e93c1cb91c8e2d55ea2
SHA512 71a1d9c6d36ed7c464744133455c41067dd99da185586ea8cd9ef0ec32a624f7c33d7faeccbfedea2f7d365b5d117d8e42200f81220d601715f12e5f1dcc4500

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 a4cbe8d803912c6762a498462121087a
SHA1 2ad075983a0aeb004e4724b88771e2a06edf2bbb
SHA256 a2ed7be0bb68eb79ee24fd90fd4ba16390fd3c36a05b71523dc766f6f4abe623
SHA512 0205cc559d2a8c24d83fca158a70c51efd79f89e74f11e5bdffb4fb8f2ead40cef1fe4e0294ee6723c55c43ddf836f40130898ea3609c2d25d8d93173f82677a

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 5887ed0851fe17fc9139b899b2f525fc
SHA1 dc8c8a1eb720ecb6f65a6915777aaab9604c33e4
SHA256 431860144cbce2327b5f3da9b06e4892324d4d45b01c2a1df2b03388995a639d
SHA512 4141a984600526f13995157341983c6cd3c183ea73c24453d8b7d312ff8da3822fa69ad828ae61c597c3654fe3774cc5a2ae5fe7a30e9e7f4b51ad6803294163

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 c275d2f4e6fd7d1e3efae7d177beabdb
SHA1 f7841e53e6c56b557b5a4008f95fde51a3bb89b6
SHA256 6cd17a5c6d8d136400334f387220cd49ced0ff8ceeda230f960267c6402cdec2
SHA512 4dc6fc52edc3b26432b63c167d894bd1a4d8d6595198788a157b9d4a7333787c39ef1d4ecc30cf9cb979b157815eb4f508076e3b67a66d6a00a938e89339eb3d

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 3ca22cd52370e3c8d15eab0793d79b05
SHA1 0fa1f05f7b45c61a83f0ac8d2e46a812bb7e3318
SHA256 d9bfbcfe6258c66fa14921e1aee86c5b4bb09a09e712ac7fac2694dd617caedb
SHA512 750aa2abf02293ede06b830c4c99b7968331759b77c086187067f9135a92d53e5fc033b85b7a3d4ad8463e15eb0cddae9a10ed67969e81f8a6fabe60c4f76473

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 59fcb7745281efd707a2da6d4db3009c
SHA1 1befb081b3853fbab5861b1ff9621d45cdfa078a
SHA256 e93fc480581d3c85543f0739668a048efa23ef7ddcaabdfab7575817f87614ba
SHA512 75f6e7403300021e89acf9188b04d97fb93fa203b20bfdc020d6ed60b86955ab95beec74147e3538df79afd2caeb04fc9bdcdff7fc5c66b7cceba6567f624c25

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 06edfd6334852a215841c6668fd91bf2
SHA1 2e5a73933c739ae25d5440d76ad77f3d44501f91
SHA256 5a90b6298ce6e90e3cdecaa5ad465708331d6003dda8185dddb59b889d064d4d
SHA512 eeeda7510fef3b8149aaf10a2c06520b0f239866ec05abe67c64c5d66657ffa7a073773daa3da1fcc7d4bae33927093561b07337243b03b6fc0f15cce3efc037