Malware Analysis Report

2025-01-02 12:25

Sample ID 241126-a27pvsvmdx
Target 9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118
SHA256 ea1b64729cb531c6a8bed9ef45e4d6ed40e04715a4f385224254f9f2b7449c75
Tags
cybergate cyber discovery evasion persistence privilege_escalation stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ea1b64729cb531c6a8bed9ef45e4d6ed40e04715a4f385224254f9f2b7449c75

Threat Level: Known bad

The file 9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

cybergate cyber discovery evasion persistence privilege_escalation stealer trojan upx

CyberGate, Rebhip

Cybergate family

Adds policy Run key to start application

Disables RegEdit via registry modification

Modifies Windows Firewall

Disables Task Manager via registry modification

Boot or Logon Autostart Execution: Active Setup

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Adds Run key to start application

UPX packed file

Suspicious use of SetThreadContext

Drops file in System32 directory

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

Unsigned PE

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-26 00:43

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-26 00:43

Reported

2024-11-26 00:46

Platform

win7-20240903-en

Max time kernel

148s

Max time network

150s

Command Line

C:\Windows\Explorer.EXE

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Cybergate family

cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\winlogon.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" C:\winlogon.exe N/A
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\winlogon.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" C:\winlogon.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7CR4RB3S-230I-UCWQ-828A-O5MGD5T5SSUE}\StubPath = "C:\\Windows\\system32\\install\\server.exe" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{7CR4RB3S-230I-UCWQ-828A-O5MGD5T5SSUE} C:\winlogon.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7CR4RB3S-230I-UCWQ-828A-O5MGD5T5SSUE}\StubPath = "C:\\Windows\\system32\\install\\server.exe Restart" C:\winlogon.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{7CR4RB3S-230I-UCWQ-828A-O5MGD5T5SSUE} C:\Windows\SysWOW64\explorer.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118.exe N/A

Disables Task Manager via registry modification

evasion

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\winlogon.exe N/A
N/A N/A C:\winlogon.exe N/A
N/A N/A C:\Windows\SysWOW64\install\server.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\winlogon.exe N/A
N/A N/A C:\winlogon.exe N/A
N/A N/A C:\Windows\SysWOW64\install\server.exe N/A
N/A N/A C:\Windows\SysWOW64\install\server.exe N/A
N/A N/A C:\Windows\SysWOW64\install\server.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\System32 = "\"C:\\Users\\Admin\\AppData\\Roaming\\logon.exe\"" C:\Users\Admin\AppData\Local\Temp\9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\server.exe" C:\winlogon.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\server.exe" C:\winlogon.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\install\server.exe C:\winlogon.exe N/A
File opened for modification C:\Windows\SysWOW64\install\ C:\winlogon.exe N/A
File created C:\Windows\SysWOW64\install\server.exe C:\winlogon.exe N/A
File opened for modification C:\Windows\SysWOW64\install\server.exe C:\winlogon.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1984 set thread context of 2348 N/A C:\Users\Admin\AppData\Local\Temp\9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118.exe C:\winlogon.exe

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\winlogon.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\winlogon.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\install\server.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\winlogon.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\winlogon.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\winlogon.exe N/A
Token: SeRestorePrivilege N/A C:\winlogon.exe N/A
Token: SeDebugPrivilege N/A C:\winlogon.exe N/A
Token: SeDebugPrivilege N/A C:\winlogon.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\winlogon.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1984 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 1984 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 1984 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 1984 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 1984 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 1984 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 1984 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 1984 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Temp\9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118.exe C:\winlogon.exe
PID 1984 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Temp\9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118.exe C:\winlogon.exe
PID 1984 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Temp\9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118.exe C:\winlogon.exe
PID 1984 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Temp\9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118.exe C:\winlogon.exe
PID 1984 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Temp\9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118.exe C:\winlogon.exe
PID 1984 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Temp\9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118.exe C:\winlogon.exe
PID 1984 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Temp\9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118.exe C:\winlogon.exe
PID 1984 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Temp\9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118.exe C:\winlogon.exe
PID 1984 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Temp\9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118.exe C:\winlogon.exe
PID 1984 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Temp\9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118.exe C:\winlogon.exe
PID 1984 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Temp\9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118.exe C:\winlogon.exe
PID 1984 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Temp\9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118.exe C:\winlogon.exe
PID 1984 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Temp\9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118.exe C:\winlogon.exe
PID 1984 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Temp\9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118.exe C:\winlogon.exe
PID 1984 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Temp\9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118.exe C:\winlogon.exe
PID 2348 wrote to memory of 1236 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 2348 wrote to memory of 1236 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 2348 wrote to memory of 1236 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 2348 wrote to memory of 1236 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 2348 wrote to memory of 1236 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 2348 wrote to memory of 1236 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 2348 wrote to memory of 1236 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 2348 wrote to memory of 1236 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 2348 wrote to memory of 1236 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 2348 wrote to memory of 1236 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 2348 wrote to memory of 1236 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 2348 wrote to memory of 1236 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 2348 wrote to memory of 1236 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 2348 wrote to memory of 1236 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 2348 wrote to memory of 1236 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 2348 wrote to memory of 1236 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 2348 wrote to memory of 1236 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 2348 wrote to memory of 1236 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 2348 wrote to memory of 1236 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 2348 wrote to memory of 1236 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 2348 wrote to memory of 1236 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 2348 wrote to memory of 1236 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 2348 wrote to memory of 1236 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 2348 wrote to memory of 1236 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 2348 wrote to memory of 1236 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 2348 wrote to memory of 1236 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 2348 wrote to memory of 1236 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 2348 wrote to memory of 1236 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 2348 wrote to memory of 1236 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 2348 wrote to memory of 1236 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 2348 wrote to memory of 1236 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 2348 wrote to memory of 1236 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 2348 wrote to memory of 1236 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 2348 wrote to memory of 1236 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 2348 wrote to memory of 1236 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 2348 wrote to memory of 1236 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 2348 wrote to memory of 1236 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 2348 wrote to memory of 1236 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 2348 wrote to memory of 1236 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 2348 wrote to memory of 1236 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 2348 wrote to memory of 1236 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 2348 wrote to memory of 1236 N/A C:\winlogon.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118.exe"

C:\Windows\SysWOW64\netsh.exe

"netsh.exe" firewall set opmode disable

C:\winlogon.exe

C:\winlogon.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\winlogon.exe

"C:\winlogon.exe"

C:\Windows\SysWOW64\install\server.exe

"C:\Windows\system32\install\server.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.server.com udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp

Files

memory/1984-0-0x0000000074A02000-0x0000000074A04000-memory.dmp

C:\winlogon.exe

MD5 4428c969f83fe0fb6bb2a635fe605bce
SHA1 15efa531bc399c5e92d72cf266f8e18b4ec78bb0
SHA256 458b17876c0ea9ce182b9966f97d7617600ac6cb95c363cc7f33aec420424151
SHA512 4896c3e06391a7caca83ae36fd2a093af81ad6165979ed23232fb35a4d85a7188ecbbc66e720c4cd3d86e4c5546848ce7b02e5d8e28cd02ca0c246b091e9d809

memory/2348-7-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2348-15-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2348-21-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2348-25-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2348-19-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2348-17-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2348-13-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2348-47-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2348-54-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2348-51-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2348-43-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2348-37-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2348-33-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2348-31-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2348-29-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2348-26-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2348-50-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2348-42-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2348-39-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2348-35-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2348-23-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2348-9-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2348-53-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2348-11-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1236-58-0x0000000002650000-0x0000000002651000-memory.dmp

memory/2348-57-0x0000000010410000-0x0000000010475000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

MD5 e219621110684e8c7370b96e031f1ea6
SHA1 b9a3164a972af0dd689bf934c662aa7deaa14a58
SHA256 1eb9fc2f6328c4c8a16d30e735b9b9f365a51141a23bc33c2b92244b4a451724
SHA512 b4438984530b2b5cb3a97b387e1219bf7d367d88c719fd7cee8788320cc68cb63250c20adc52395677988f8035f7c6991930080b37d790a40fa0a3f52ce1c9cb

memory/2348-979-0x0000000000400000-0x0000000000451000-memory.dmp

C:\Users\Admin\AppData\Roaming\Adminlog.dat

MD5 bf3dba41023802cf6d3f8c5fd683a0c7
SHA1 466530987a347b68ef28faad238d7b50db8656a5
SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
SHA512 fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 18545786d6551a43165d7ce89316a95a
SHA1 800176ad016d4277680c5d104f94d3159ae7c148
SHA256 7e7d744b07f8b5f9314dc574509e4aa5e12341daf624c3d89d6b34f8cea71949
SHA512 01dc49c87c9796e704fa3541f43f6356791df3bfcd1ff383618a21cc14178d6d45093a64630603b617fc941a464cb1b2c68429352ced3424e1140b14a6d7ef2e

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 4af14196ecbef21ed40d7d7176d47db7
SHA1 5a13d5314a659e6e4d93705fcbd66082740e2a06
SHA256 3d7c0ef665bd8e74064cde4d9682300da22f8f00c44b5f992f2cc4bdb7982629
SHA512 dc96676b40c4374a0528b188ed2b27fb91eaf67baa10294413a3b0ddfa69f34376e1a0a1cc331612e559585f723cb5c42e111bb80abbd7488bdd29339afb5cb7

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 05f6bf2bb2ca1f972ec72eca3af79b60
SHA1 df237b01477c9dc46c0cf6d2ac702eda871ada70
SHA256 81f41350bd9ec6207f6b3912766aafdd3ba7d117bd6aaedff4437c657fe474c0
SHA512 08881b3d35823386302321edc76253c60f5e1298155f0de87d608dc148311b7fbc541a4863de170510f7c6c222b6097218e55fd3fd4ab2c4361d883d55f81501

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 21ca3f45ee32813ca1775dd040102c36
SHA1 61de6dd0434b682dc96a8c0a224f21c217794e47
SHA256 a7c0f01b7762b212e893148383750320fcc8d0ed6790eb307152d26ea360852b
SHA512 7d0318dbec9026d3ecb26d68282592cdeb8b6e5f750a51732211ee41baf54d1b7f2b739788b2a66829da1a1d9abb8b785756aaa6eeae46956b3eaae8d905bcc7

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 26c8b689214a327067b2ade5dc8d2f68
SHA1 f7b9cb43ca9257ad7266e651f52e68ff7109d1b1
SHA256 31a982c9c497292207aed317a299b80bf2115e40de7e8ebdd044d3d64cc3fca4
SHA512 ae93e182fc3a38c3e0c78f8fd0314cbf2b8839f80a2a3e0a232a60cce17ef30d23f74d091adf73d327dfaa379b228cb18c04e6aff3b6f3edc1b96d7784f3815d

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 0a56508e3a7da04e688be7b8e26fcfab
SHA1 780b8f84e4b2e6c7ebaf9e6ef446db39db60b388
SHA256 bca0542c99b620f3aec9ce50bb7c96e0b428349a7b14b96206e6b22436945a17
SHA512 a1138a11d04d283fe41ba941dd90357ba547f248eb0af3f4bad4a491c83df4d0dd68ffa20cdc04372f81fda9234fa00f8e292968713d70f7ecf84fc16113e492

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 937b929d83fc61cafa137dd8fd40e1d9
SHA1 b1e4c3bbb91337b1eab3b3daf829cd7b6dddf06d
SHA256 a523db4e1ca5e6f0b01e1ab3d38b25f1d5ef1ec4ad18869f701f84c6f6936ec6
SHA512 b94923c6a136dcca9cddcfbd9a202f7f52b0d42f72c9d6195eeacbf220b93da853e4ace5124dedb86d9d2f2936dbb8cd64b196bae2b971b4ff262fd8bad986c5

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 0ebe8be35938c7ac16d9c0ada9e0994b
SHA1 762aa28ff34b6c47ce7dfb7813fcab013630dbf7
SHA256 14cf74567fdba374a955dbcd965b9eba016092c076e26da91d73b222b553c774
SHA512 7924120b2f4a92c26ef7e0c8934d1c2652b0a43e7a12597db842e56680040defd827fe1d7231312f3ccdd748529de3805f7b92c5252cc375713ef42db5dd5698

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 e58bfce1c39b6c98325dcf903f91ed90
SHA1 e837c8f2eb0fb83c61888bb19e5cbdd17af06ecd
SHA256 21ade4b9fd65ada1f9de8cd043fb21c1d54dee792b160ac5dc1584012d8cde23
SHA512 053c08f2e19b43b799791d97b22d94409cb38311465958a0f5e20b7dda799f2ea4e8add566bba272d4ee0de6549b99c4c8b8240019fc67c327c6292092d64803

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 a2df744ae6485e0895672ff357dac517
SHA1 c66aa8221674071b127699f885013b5518252589
SHA256 b56a65c29acdc588f116481b6697abb956ae693e640115e9dafd966ead489ff3
SHA512 227ffc8298aff7235fe81289bfc804027c804c67d9e6171ad916acbdef8a807280f95224b651cf1265cd164b341679f8210b63e6f1f3543adb0c89948e990017

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 39b9cf964bd8b51c78547cb677d1ba34
SHA1 abb8c332fb74ee2c466bc37add04470e1910b3d1
SHA256 9f41eb1aebc49224bc75ceaa03f9e5caa17b10de08c23c7addf3e574cc89b707
SHA512 d5c75597ca118fbb64c2fabf6bc79e22c10bbfc018b8bed3ad3c1a20752d7e0a4ae03480e4ed00ebcb1de5dd277f7613eaaa64d2b95c8a225a0c762ed7208d09

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 abbdf6b3aeff33b3e3686b91133ac9d7
SHA1 0ff57728bdff99967e0f999592c1f4d011adccef
SHA256 a317b6c378307730b6ef887fd645f494461bfe8968dfc4cbaec4f498c1764f69
SHA512 ba76731353ab9b4b12a392ac97d8a14c2e5bd9d6c056523602ebe34748394bfa71f9a0b8591c8dc59eeefc69f2d9d6dbd9b0f42c6ff09a33e54185eab3009e42

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 9fa79618e93dc19890ba505bace7ee6c
SHA1 ea974262b928438b0baf598377a9b79daa41f329
SHA256 217d1b79220c9281b265043c3e83f6e40db3b8159b4b546c29fb96d0c9fff387
SHA512 13d9ed48605536f89a1e6c3f42e0cbcba4a67af4c4fd5dd0d70a4687a87f6b3c733ed4ddbec63ee67875aa2720a291c6c372e211a1da9cb9fc0ccff40910190b

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 6eb8ac15b02647866fbde047fe745639
SHA1 ab519d9bc04b04371570074e88c9087bbfd03128
SHA256 13903301f171114c4904d9060669057e6943a5353ffa558dac81135b943ba619
SHA512 4747b9d4be95351cb4b8393abe8956fc23aba9a54f9d355ec892e90e09de8fe5fbb49934d7fb265425f42b88b70de984ba664a6acd76fa153815901d4cd75f45

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 3e762c5463130cad8260e454bf4d839e
SHA1 2e306a80e76498b5dab958cbfef03a42efe05e52
SHA256 09e31489b5145b9427c77fc2ddcf112c87c97de5809168b2b8d2848b1f612019
SHA512 cd831e174667646b1f5fa4a6ab9ca17cadca1367aed5148d55992f404af5e4422b0097468a758c44e98bc62ecdee63ef22c5ad20ac7730805be549e2ff35195d

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 09265dd4b5840d158348745f36fac8ed
SHA1 3b573856a7cebffea64e1523fa96e6346a114397
SHA256 9e49aaad977631c656a209618fb2f9153f251220ddc472efc71d2dc8d83b9a28
SHA512 0b240064d435f2ca07420299849349ca8d58a365e005f3257ada3e415e0b42288fe4d77d75b80a616551118dddec1a357f5215eec9e8a91cebe58ef2eeb00dce

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 4c6562c9a575445939c724b06ac430c7
SHA1 d632fd984ad3ff9280df00986b7837d0c963deaa
SHA256 87319888b10d6aec4fe50d33b186d183a7493da776531a945ece255c3f7bf45c
SHA512 92d1732ae2c16b8d85226f2d155d01dc7259dcb867d57aa0f0e3de1db9bdd752e2ff64642a2d29d32db102861dfe4fe114703e79bc02660399fc51a34414552a

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 ed619fa331caa77fdecf915038db75d7
SHA1 510445d2d15d6dd567ee7b746d9fee9c68214050
SHA256 da828bdf8097c86a32ad9da5868b0d14ab0e8f4b481eedee2ade19cd3c8b78b1
SHA512 c9c771d45cbb427db9d1f0d7864daf1d6f3dac954658c4bd06bc3ce93e7d284c2b31d891576520c45d05179da574d1e42b7b0e78f39607b4a8852403ce394846

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 e1a2a24ccc1683a1d8fac0f1a4524bcd
SHA1 42ff0d725748f069b30516897c9c57f0c78858a9
SHA256 7d0d5cb7f529040f1aedd657c3408bee6cc7c94d1bfd6b98f05994679d427964
SHA512 4fbe603761cbdf5ac66966ceeefed58273253ef80b1ccd6be2aa81522109f4b7fb8d1d7c98d7ee9625d550039890a2e36fdf24b8efdbb3c89946b3680436f7f9

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 97929218139e8f9231e06df83b85b876
SHA1 ed8690fc62ae1485880a725ed5b9145a1577726d
SHA256 f76f209de337e6020535d0468efc1184225da96d63ba8c23c532bb0039988a80
SHA512 d89a0ba2eb87f0b634f83324e2a2405f5ed4e5ae8f0c9091978cb3df377877d215ceea66dc75941f534aaed57d2806eac03a45f48d3bed2f49caec3323382d0e

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 a4ddf03c19143ed85776ef96877ab15e
SHA1 b070f64e0c5b07c7127149fd4a6b70a4f199eec4
SHA256 0319955036156877461189d8430c53a740ed68f124b55a84a9410a4b52afa4f4
SHA512 b8cac940f9b4dbdb4bcda6ddbd75b95aa6bda484368b96df7821eeac5823f2e35a741c90cf9b3dcbab84181a99caf4c9accb0d7a1f2a7969f9e74c14e13e7ee2

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-26 00:43

Reported

2024-11-26 00:46

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

151s

Command Line

C:\Windows\Explorer.EXE

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Cybergate family

cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\winlogon.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" C:\winlogon.exe N/A
Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\winlogon.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" C:\winlogon.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{7CR4RB3S-230I-UCWQ-828A-O5MGD5T5SSUE} C:\winlogon.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7CR4RB3S-230I-UCWQ-828A-O5MGD5T5SSUE}\StubPath = "C:\\Windows\\system32\\install\\server.exe Restart" C:\winlogon.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{7CR4RB3S-230I-UCWQ-828A-O5MGD5T5SSUE} C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7CR4RB3S-230I-UCWQ-828A-O5MGD5T5SSUE}\StubPath = "C:\\Windows\\system32\\install\\server.exe" C:\Windows\SysWOW64\explorer.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118.exe N/A

Disables Task Manager via registry modification

evasion

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation C:\winlogon.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\winlogon.exe N/A
N/A N/A C:\winlogon.exe N/A
N/A N/A C:\Windows\SysWOW64\install\server.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System32 = "\"C:\\Users\\Admin\\AppData\\Roaming\\logon.exe\"" C:\Users\Admin\AppData\Local\Temp\9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\server.exe" C:\winlogon.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\server.exe" C:\winlogon.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\install\ C:\winlogon.exe N/A
File created C:\Windows\SysWOW64\install\server.exe C:\winlogon.exe N/A
File opened for modification C:\Windows\SysWOW64\install\server.exe C:\winlogon.exe N/A
File opened for modification C:\Windows\SysWOW64\install\server.exe C:\winlogon.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1792 set thread context of 3260 N/A C:\Users\Admin\AppData\Local\Temp\9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118.exe C:\winlogon.exe

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\winlogon.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\winlogon.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\install\server.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\winlogon.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\winlogon.exe N/A
N/A N/A C:\winlogon.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\winlogon.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\winlogon.exe N/A
Token: SeRestorePrivilege N/A C:\winlogon.exe N/A
Token: SeDebugPrivilege N/A C:\winlogon.exe N/A
Token: SeDebugPrivilege N/A C:\winlogon.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\winlogon.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1792 wrote to memory of 3300 N/A C:\Users\Admin\AppData\Local\Temp\9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 1792 wrote to memory of 3300 N/A C:\Users\Admin\AppData\Local\Temp\9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 1792 wrote to memory of 3300 N/A C:\Users\Admin\AppData\Local\Temp\9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 1792 wrote to memory of 3260 N/A C:\Users\Admin\AppData\Local\Temp\9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118.exe C:\winlogon.exe
PID 1792 wrote to memory of 3260 N/A C:\Users\Admin\AppData\Local\Temp\9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118.exe C:\winlogon.exe
PID 1792 wrote to memory of 3260 N/A C:\Users\Admin\AppData\Local\Temp\9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118.exe C:\winlogon.exe
PID 1792 wrote to memory of 3260 N/A C:\Users\Admin\AppData\Local\Temp\9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118.exe C:\winlogon.exe
PID 1792 wrote to memory of 3260 N/A C:\Users\Admin\AppData\Local\Temp\9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118.exe C:\winlogon.exe
PID 1792 wrote to memory of 3260 N/A C:\Users\Admin\AppData\Local\Temp\9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118.exe C:\winlogon.exe
PID 1792 wrote to memory of 3260 N/A C:\Users\Admin\AppData\Local\Temp\9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118.exe C:\winlogon.exe
PID 1792 wrote to memory of 3260 N/A C:\Users\Admin\AppData\Local\Temp\9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118.exe C:\winlogon.exe
PID 1792 wrote to memory of 3260 N/A C:\Users\Admin\AppData\Local\Temp\9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118.exe C:\winlogon.exe
PID 1792 wrote to memory of 3260 N/A C:\Users\Admin\AppData\Local\Temp\9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118.exe C:\winlogon.exe
PID 1792 wrote to memory of 3260 N/A C:\Users\Admin\AppData\Local\Temp\9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118.exe C:\winlogon.exe
PID 1792 wrote to memory of 3260 N/A C:\Users\Admin\AppData\Local\Temp\9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118.exe C:\winlogon.exe
PID 1792 wrote to memory of 3260 N/A C:\Users\Admin\AppData\Local\Temp\9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118.exe C:\winlogon.exe
PID 3260 wrote to memory of 3444 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 3260 wrote to memory of 3444 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 3260 wrote to memory of 3444 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 3260 wrote to memory of 3444 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 3260 wrote to memory of 3444 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 3260 wrote to memory of 3444 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 3260 wrote to memory of 3444 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 3260 wrote to memory of 3444 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 3260 wrote to memory of 3444 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 3260 wrote to memory of 3444 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 3260 wrote to memory of 3444 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 3260 wrote to memory of 3444 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 3260 wrote to memory of 3444 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 3260 wrote to memory of 3444 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 3260 wrote to memory of 3444 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 3260 wrote to memory of 3444 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 3260 wrote to memory of 3444 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 3260 wrote to memory of 3444 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 3260 wrote to memory of 3444 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 3260 wrote to memory of 3444 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 3260 wrote to memory of 3444 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 3260 wrote to memory of 3444 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 3260 wrote to memory of 3444 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 3260 wrote to memory of 3444 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 3260 wrote to memory of 3444 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 3260 wrote to memory of 3444 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 3260 wrote to memory of 3444 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 3260 wrote to memory of 3444 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 3260 wrote to memory of 3444 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 3260 wrote to memory of 3444 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 3260 wrote to memory of 3444 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 3260 wrote to memory of 3444 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 3260 wrote to memory of 3444 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 3260 wrote to memory of 3444 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 3260 wrote to memory of 3444 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 3260 wrote to memory of 3444 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 3260 wrote to memory of 3444 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 3260 wrote to memory of 3444 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 3260 wrote to memory of 3444 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 3260 wrote to memory of 3444 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 3260 wrote to memory of 3444 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 3260 wrote to memory of 3444 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 3260 wrote to memory of 3444 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 3260 wrote to memory of 3444 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 3260 wrote to memory of 3444 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 3260 wrote to memory of 3444 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 3260 wrote to memory of 3444 N/A C:\winlogon.exe C:\Windows\Explorer.EXE
PID 3260 wrote to memory of 3444 N/A C:\winlogon.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118.exe"

C:\Windows\SysWOW64\netsh.exe

"netsh.exe" firewall set opmode disable

C:\winlogon.exe

C:\winlogon.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\winlogon.exe

"C:\winlogon.exe"

C:\Windows\SysWOW64\install\server.exe

"C:\Windows\system32\install\server.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 www.server.com udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp

Files

memory/1792-0-0x0000000074F02000-0x0000000074F03000-memory.dmp

memory/1792-1-0x0000000074F00000-0x00000000754B1000-memory.dmp

memory/1792-2-0x0000000074F00000-0x00000000754B1000-memory.dmp

C:\winlogon.exe

MD5 4428c969f83fe0fb6bb2a635fe605bce
SHA1 15efa531bc399c5e92d72cf266f8e18b4ec78bb0
SHA256 458b17876c0ea9ce182b9966f97d7617600ac6cb95c363cc7f33aec420424151
SHA512 4896c3e06391a7caca83ae36fd2a093af81ad6165979ed23232fb35a4d85a7188ecbbc66e720c4cd3d86e4c5546848ce7b02e5d8e28cd02ca0c246b091e9d809

memory/3260-6-0x0000000000400000-0x0000000000451000-memory.dmp

memory/3260-9-0x0000000000400000-0x0000000000451000-memory.dmp

memory/3260-12-0x0000000000400000-0x0000000000451000-memory.dmp

memory/3260-13-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1792-15-0x0000000074F00000-0x00000000754B1000-memory.dmp

memory/3260-19-0x0000000010410000-0x0000000010475000-memory.dmp

memory/3964-23-0x0000000000D40000-0x0000000000D41000-memory.dmp

memory/3964-24-0x0000000001000000-0x0000000001001000-memory.dmp

memory/3260-79-0x0000000010480000-0x00000000104E5000-memory.dmp

memory/3964-84-0x0000000010480000-0x00000000104E5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

MD5 e219621110684e8c7370b96e031f1ea6
SHA1 b9a3164a972af0dd689bf934c662aa7deaa14a58
SHA256 1eb9fc2f6328c4c8a16d30e735b9b9f365a51141a23bc33c2b92244b4a451724
SHA512 b4438984530b2b5cb3a97b387e1219bf7d367d88c719fd7cee8788320cc68cb63250c20adc52395677988f8035f7c6991930080b37d790a40fa0a3f52ce1c9cb

memory/3260-156-0x0000000000400000-0x0000000000451000-memory.dmp

C:\Users\Admin\AppData\Roaming\Adminlog.dat

MD5 bf3dba41023802cf6d3f8c5fd683a0c7
SHA1 466530987a347b68ef28faad238d7b50db8656a5
SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
SHA512 fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

memory/3964-175-0x0000000010480000-0x00000000104E5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 18545786d6551a43165d7ce89316a95a
SHA1 800176ad016d4277680c5d104f94d3159ae7c148
SHA256 7e7d744b07f8b5f9314dc574509e4aa5e12341daf624c3d89d6b34f8cea71949
SHA512 01dc49c87c9796e704fa3541f43f6356791df3bfcd1ff383618a21cc14178d6d45093a64630603b617fc941a464cb1b2c68429352ced3424e1140b14a6d7ef2e

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 4af14196ecbef21ed40d7d7176d47db7
SHA1 5a13d5314a659e6e4d93705fcbd66082740e2a06
SHA256 3d7c0ef665bd8e74064cde4d9682300da22f8f00c44b5f992f2cc4bdb7982629
SHA512 dc96676b40c4374a0528b188ed2b27fb91eaf67baa10294413a3b0ddfa69f34376e1a0a1cc331612e559585f723cb5c42e111bb80abbd7488bdd29339afb5cb7

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 05f6bf2bb2ca1f972ec72eca3af79b60
SHA1 df237b01477c9dc46c0cf6d2ac702eda871ada70
SHA256 81f41350bd9ec6207f6b3912766aafdd3ba7d117bd6aaedff4437c657fe474c0
SHA512 08881b3d35823386302321edc76253c60f5e1298155f0de87d608dc148311b7fbc541a4863de170510f7c6c222b6097218e55fd3fd4ab2c4361d883d55f81501

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 21ca3f45ee32813ca1775dd040102c36
SHA1 61de6dd0434b682dc96a8c0a224f21c217794e47
SHA256 a7c0f01b7762b212e893148383750320fcc8d0ed6790eb307152d26ea360852b
SHA512 7d0318dbec9026d3ecb26d68282592cdeb8b6e5f750a51732211ee41baf54d1b7f2b739788b2a66829da1a1d9abb8b785756aaa6eeae46956b3eaae8d905bcc7

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 26c8b689214a327067b2ade5dc8d2f68
SHA1 f7b9cb43ca9257ad7266e651f52e68ff7109d1b1
SHA256 31a982c9c497292207aed317a299b80bf2115e40de7e8ebdd044d3d64cc3fca4
SHA512 ae93e182fc3a38c3e0c78f8fd0314cbf2b8839f80a2a3e0a232a60cce17ef30d23f74d091adf73d327dfaa379b228cb18c04e6aff3b6f3edc1b96d7784f3815d

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 0a56508e3a7da04e688be7b8e26fcfab
SHA1 780b8f84e4b2e6c7ebaf9e6ef446db39db60b388
SHA256 bca0542c99b620f3aec9ce50bb7c96e0b428349a7b14b96206e6b22436945a17
SHA512 a1138a11d04d283fe41ba941dd90357ba547f248eb0af3f4bad4a491c83df4d0dd68ffa20cdc04372f81fda9234fa00f8e292968713d70f7ecf84fc16113e492

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 937b929d83fc61cafa137dd8fd40e1d9
SHA1 b1e4c3bbb91337b1eab3b3daf829cd7b6dddf06d
SHA256 a523db4e1ca5e6f0b01e1ab3d38b25f1d5ef1ec4ad18869f701f84c6f6936ec6
SHA512 b94923c6a136dcca9cddcfbd9a202f7f52b0d42f72c9d6195eeacbf220b93da853e4ace5124dedb86d9d2f2936dbb8cd64b196bae2b971b4ff262fd8bad986c5

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 0ebe8be35938c7ac16d9c0ada9e0994b
SHA1 762aa28ff34b6c47ce7dfb7813fcab013630dbf7
SHA256 14cf74567fdba374a955dbcd965b9eba016092c076e26da91d73b222b553c774
SHA512 7924120b2f4a92c26ef7e0c8934d1c2652b0a43e7a12597db842e56680040defd827fe1d7231312f3ccdd748529de3805f7b92c5252cc375713ef42db5dd5698

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 e58bfce1c39b6c98325dcf903f91ed90
SHA1 e837c8f2eb0fb83c61888bb19e5cbdd17af06ecd
SHA256 21ade4b9fd65ada1f9de8cd043fb21c1d54dee792b160ac5dc1584012d8cde23
SHA512 053c08f2e19b43b799791d97b22d94409cb38311465958a0f5e20b7dda799f2ea4e8add566bba272d4ee0de6549b99c4c8b8240019fc67c327c6292092d64803

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 a2df744ae6485e0895672ff357dac517
SHA1 c66aa8221674071b127699f885013b5518252589
SHA256 b56a65c29acdc588f116481b6697abb956ae693e640115e9dafd966ead489ff3
SHA512 227ffc8298aff7235fe81289bfc804027c804c67d9e6171ad916acbdef8a807280f95224b651cf1265cd164b341679f8210b63e6f1f3543adb0c89948e990017

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 39b9cf964bd8b51c78547cb677d1ba34
SHA1 abb8c332fb74ee2c466bc37add04470e1910b3d1
SHA256 9f41eb1aebc49224bc75ceaa03f9e5caa17b10de08c23c7addf3e574cc89b707
SHA512 d5c75597ca118fbb64c2fabf6bc79e22c10bbfc018b8bed3ad3c1a20752d7e0a4ae03480e4ed00ebcb1de5dd277f7613eaaa64d2b95c8a225a0c762ed7208d09

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 abbdf6b3aeff33b3e3686b91133ac9d7
SHA1 0ff57728bdff99967e0f999592c1f4d011adccef
SHA256 a317b6c378307730b6ef887fd645f494461bfe8968dfc4cbaec4f498c1764f69
SHA512 ba76731353ab9b4b12a392ac97d8a14c2e5bd9d6c056523602ebe34748394bfa71f9a0b8591c8dc59eeefc69f2d9d6dbd9b0f42c6ff09a33e54185eab3009e42

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 9fa79618e93dc19890ba505bace7ee6c
SHA1 ea974262b928438b0baf598377a9b79daa41f329
SHA256 217d1b79220c9281b265043c3e83f6e40db3b8159b4b546c29fb96d0c9fff387
SHA512 13d9ed48605536f89a1e6c3f42e0cbcba4a67af4c4fd5dd0d70a4687a87f6b3c733ed4ddbec63ee67875aa2720a291c6c372e211a1da9cb9fc0ccff40910190b

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 6eb8ac15b02647866fbde047fe745639
SHA1 ab519d9bc04b04371570074e88c9087bbfd03128
SHA256 13903301f171114c4904d9060669057e6943a5353ffa558dac81135b943ba619
SHA512 4747b9d4be95351cb4b8393abe8956fc23aba9a54f9d355ec892e90e09de8fe5fbb49934d7fb265425f42b88b70de984ba664a6acd76fa153815901d4cd75f45

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 3e762c5463130cad8260e454bf4d839e
SHA1 2e306a80e76498b5dab958cbfef03a42efe05e52
SHA256 09e31489b5145b9427c77fc2ddcf112c87c97de5809168b2b8d2848b1f612019
SHA512 cd831e174667646b1f5fa4a6ab9ca17cadca1367aed5148d55992f404af5e4422b0097468a758c44e98bc62ecdee63ef22c5ad20ac7730805be549e2ff35195d

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 09265dd4b5840d158348745f36fac8ed
SHA1 3b573856a7cebffea64e1523fa96e6346a114397
SHA256 9e49aaad977631c656a209618fb2f9153f251220ddc472efc71d2dc8d83b9a28
SHA512 0b240064d435f2ca07420299849349ca8d58a365e005f3257ada3e415e0b42288fe4d77d75b80a616551118dddec1a357f5215eec9e8a91cebe58ef2eeb00dce

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 4c6562c9a575445939c724b06ac430c7
SHA1 d632fd984ad3ff9280df00986b7837d0c963deaa
SHA256 87319888b10d6aec4fe50d33b186d183a7493da776531a945ece255c3f7bf45c
SHA512 92d1732ae2c16b8d85226f2d155d01dc7259dcb867d57aa0f0e3de1db9bdd752e2ff64642a2d29d32db102861dfe4fe114703e79bc02660399fc51a34414552a

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 ed619fa331caa77fdecf915038db75d7
SHA1 510445d2d15d6dd567ee7b746d9fee9c68214050
SHA256 da828bdf8097c86a32ad9da5868b0d14ab0e8f4b481eedee2ade19cd3c8b78b1
SHA512 c9c771d45cbb427db9d1f0d7864daf1d6f3dac954658c4bd06bc3ce93e7d284c2b31d891576520c45d05179da574d1e42b7b0e78f39607b4a8852403ce394846