Malware Analysis Report

2025-01-02 12:25

Sample ID 241203-zvyaaatpgv
Target bf386eaf13614a52a48785127a706e30_JaffaCakes118
SHA256 0c97cbd5fea6854445372b0c6bb3bad38c62cb39eacf26ccb05c9e91c9a1eb31
Tags
cybergate cyber discovery evasion persistence stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0c97cbd5fea6854445372b0c6bb3bad38c62cb39eacf26ccb05c9e91c9a1eb31

Threat Level: Known bad

The file bf386eaf13614a52a48785127a706e30_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

cybergate cyber discovery evasion persistence stealer trojan upx

CyberGate, Rebhip

Cybergate family

Disables Task Manager via registry modification

Boot or Logon Autostart Execution: Active Setup

Adds policy Run key to start application

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in System32 directory

UPX packed file

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of FindShellTrayWindow

Modifies registry key

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-03 21:02

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-03 21:02

Reported

2024-12-03 21:05

Platform

win7-20240903-en

Max time kernel

148s

Max time network

150s

Command Line

C:\Windows\Explorer.EXE

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Cybergate family

cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\temp\moof32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\temp\moof32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\temp\moof32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\temp\moof32.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{N8XQBNGL-D00W-W0E5-57AQ-VM2MRLI058WI} C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{N8XQBNGL-D00W-W0E5-57AQ-VM2MRLI058WI}\StubPath = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{N8XQBNGL-D00W-W0E5-57AQ-VM2MRLI058WI} C:\Windows\temp\moof32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{N8XQBNGL-D00W-W0E5-57AQ-VM2MRLI058WI}\StubPath = "C:\\Windows\\system32\\WinDir\\Svchost.exe Restart" C:\Windows\temp\moof32.exe N/A

Disables Task Manager via registry modification

evasion

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\temp\moof32.exe N/A
N/A N/A C:\Windows\temp\moof32.exe N/A
N/A N/A C:\Windows\SysWOW64\WinDir\Svchost.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\temp\moof32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\1XEUBHaiXDyyxCng = "C:\\Users\\Admin\\AppData\\Roaming\\system32.exe" C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\temp\moof32.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\WinDir\Svchost.exe C:\Windows\temp\moof32.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\Svchost.exe C:\Windows\temp\moof32.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\Svchost.exe C:\Windows\temp\moof32.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\ C:\Windows\temp\moof32.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2464 set thread context of 1912 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\temp\moof32.exe

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\temp\moof32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WinDir\Svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\temp\moof32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\REG.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\temp\moof32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\temp\moof32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\temp\moof32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\temp\moof32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\temp\moof32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\temp\moof32.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\temp\moof32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2464 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2464 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2464 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2464 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2464 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2464 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2464 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2464 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2464 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2464 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2464 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2464 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2464 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2464 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2464 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2464 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2464 wrote to memory of 828 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\temp\moof32.exe
PID 2464 wrote to memory of 828 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\temp\moof32.exe
PID 2464 wrote to memory of 828 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\temp\moof32.exe
PID 2464 wrote to memory of 828 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\temp\moof32.exe
PID 2464 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\temp\moof32.exe
PID 2464 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\temp\moof32.exe
PID 2464 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\temp\moof32.exe
PID 2464 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\temp\moof32.exe
PID 2464 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\temp\moof32.exe
PID 2464 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\temp\moof32.exe
PID 2464 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\temp\moof32.exe
PID 2464 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\temp\moof32.exe
PID 2464 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\temp\moof32.exe
PID 2464 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\temp\moof32.exe
PID 2464 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\temp\moof32.exe
PID 2464 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\temp\moof32.exe
PID 1912 wrote to memory of 1208 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 1912 wrote to memory of 1208 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 1912 wrote to memory of 1208 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 1912 wrote to memory of 1208 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 1912 wrote to memory of 1208 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 1912 wrote to memory of 1208 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 1912 wrote to memory of 1208 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 1912 wrote to memory of 1208 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 1912 wrote to memory of 1208 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 1912 wrote to memory of 1208 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 1912 wrote to memory of 1208 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 1912 wrote to memory of 1208 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 1912 wrote to memory of 1208 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 1912 wrote to memory of 1208 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 1912 wrote to memory of 1208 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 1912 wrote to memory of 1208 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 1912 wrote to memory of 1208 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 1912 wrote to memory of 1208 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 1912 wrote to memory of 1208 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 1912 wrote to memory of 1208 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 1912 wrote to memory of 1208 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 1912 wrote to memory of 1208 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 1912 wrote to memory of 1208 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 1912 wrote to memory of 1208 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 1912 wrote to memory of 1208 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 1912 wrote to memory of 1208 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 1912 wrote to memory of 1208 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 1912 wrote to memory of 1208 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 1912 wrote to memory of 1208 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 1912 wrote to memory of 1208 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 1912 wrote to memory of 1208 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 1912 wrote to memory of 1208 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe"

C:\Windows\SysWOW64\REG.exe

REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\REG.exe

REG add HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\REG.exe

REG add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoFolderOptions /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\REG.exe

REG add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoFolderOptions /t REG_DWORD /d 1 /f

C:\Windows\temp\moof32.exe

C:\Windows\temp\moof32.exe

C:\Windows\temp\moof32.exe

C:\Windows\temp\moof32.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Windows\temp\moof32.exe

"C:\Windows\temp\moof32.exe"

C:\Windows\SysWOW64\WinDir\Svchost.exe

"C:\Windows\system32\WinDir\Svchost.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.server.com udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp

Files

memory/2464-0-0x0000000074F01000-0x0000000074F02000-memory.dmp

memory/2464-1-0x0000000074F00000-0x00000000754AB000-memory.dmp

memory/2464-2-0x0000000074F00000-0x00000000754AB000-memory.dmp

\Windows\Temp\moof32.exe

MD5 34aa912defa18c2c129f1e09d75c1d7e
SHA1 9c3046324657505a30ecd9b1fdb46c05bde7d470
SHA256 6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512 d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

memory/1912-12-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1912-14-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1912-24-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1912-26-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1912-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1912-21-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1912-20-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1912-19-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1912-18-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1912-16-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1912-27-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1912-29-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2464-28-0x0000000074F00000-0x00000000754AB000-memory.dmp

memory/1208-34-0x00000000024E0000-0x00000000024E1000-memory.dmp

memory/2504-277-0x00000000000A0000-0x00000000000A1000-memory.dmp

memory/2504-281-0x00000000000E0000-0x00000000000E1000-memory.dmp

memory/2504-585-0x0000000010480000-0x00000000104E5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

MD5 4818824b297b801e767c88038ebef589
SHA1 52cad64b90f7c0fcaab6d0d61a13122c435d3058
SHA256 6ed133a0eab3ee482d9a861d6651eea7c24ded10f1c98c7a9ad81632d7081dc3
SHA512 9a18d89d630793f858602d8cc111984eb1e0b6305c6de27da4d2450aa0573cb98a6f06507071d238338590b7b592d80a95baa837b7c5ac4ec62757f895344775

memory/1912-917-0x0000000000400000-0x0000000000451000-memory.dmp

C:\Users\Admin\AppData\Roaming\Adminlog.dat

MD5 bf3dba41023802cf6d3f8c5fd683a0c7
SHA1 466530987a347b68ef28faad238d7b50db8656a5
SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
SHA512 fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

memory/2504-939-0x0000000010480000-0x00000000104E5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 711086eb81c43b7f6d027d6ab488c860
SHA1 43ae9fb54fca9af800189b8f58e5aee110899ff9
SHA256 6614928db7778c4b9b8bc7bf2d2213e7d50fec4df7fa253e40ea3854a471a951
SHA512 26a173de059ca3e212d60d6f13e73a0500af9fbc29d88abaaf8f02d78e8b8396cb84b551fe186e7b8aba9d0724f30baeab79bd824fbf16ec1b9979a6876c170d

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 e03fb636c32b6addff8e231534d0eb3b
SHA1 c5f8ecac21a7e103164a11d0a4b022da58d87da2
SHA256 e90b9ae25db9c1d3ce5589a4c40b03d7ba3bf29fb96e7997b3def1e54c9d9a12
SHA512 996acae9a492060437cd3a6a71ebc5d3d86bf2594c636a1ee2ec3a15a64028f3a78e7994306575975c371cfdf4a120e8281d905e295e99a7b1a63cfac61b07d6

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 fb054f669995dbb0d62e9c5efd970a2c
SHA1 959b87b6b0b799e38ebdd00f2eeba9f12f5b0148
SHA256 a1673d666b34aaec287e54c4f96107b9511be9c7166a815eba86d79c5808c951
SHA512 2a85472f3d250a99f83be3cf6439524262ed7f78895992d7b281de76a63b758e5da2941ba7eead87b367182297e9cafd6cf7e9d11e4640d61be97775e046a7eb

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 b93b0b9e9980d44791759a5186d3fe77
SHA1 68dd1682129c9283d38c8039f9071a8bf9f24d69
SHA256 baa22d91b63bdf56241fe2bda827570675fc2b2c9a09da60a9e9ca8aed4c6b0d
SHA512 ddce7a503d890f542004c7aed68f618c74f639c9e941d6d144d6a51385799c55211b61d110836325244150c419ea6d4ae82abb9debdf77f4b3ace6fe5287eed1

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 0d0815f16ef86f57e1748499567b27b2
SHA1 b1de1e65f9e68ea733553086daf3bbcd3d750403
SHA256 969ebd13dd11633d9b9c0ebe0914f43ebe3732623ad17ff6e997e6561f20776a
SHA512 aaebb2d47f779f4dd5a3d2630f4a69c53ff8af8c2fd2bc73ab951cb49d06b499430047437f933a79ace34d524389085222b8e859c2078f9740c132eae7bded23

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 3fd0ffeb2aee0e53828b85530b5dba66
SHA1 b488cb17d815fa6b8a2cb17137c5384adccb1697
SHA256 a7ab071a5e93067fe89ca4c200292c6a739c50356a65fe05f3c2cc79ed873527
SHA512 45aecad86bf8617b6903eac4a040c3be1b56e1d2e486dcebc98d7111c519368873697de15b2a70cde302ce66b409bd95419b58cd3eab2a1f5d6357b3ed728604

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 cce9efbe5561c559c745f207d773b58a
SHA1 363dd8c1e15cce592b8950f1ebe9acf99fd34f43
SHA256 3555759bd716c9d7cabb0d910c76a0f1653f0d767201e8b4e71e5ad82d1fe43b
SHA512 39e515ad01cc0db3d61d874aadaef0ac41afff6285dbfa60370902cd2e145d1ad1ace80fc0b4587d0c0375f91cee3678b347160cca590be749e61f47161fbb72

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 fa0a0ac7b2c76c01987127e72c75180b
SHA1 45074a12878137ec3bd60928e53094f5991e8506
SHA256 202eb4ba5eb610da618f0e5f4220740e95b0159202349ef829c80b91c8df97ff
SHA512 c23c084d410b3e6deca59dd8a05d51603dbf1f77b5f37efdc2a909ca68b4432621c5689a51eb14a892178123c2f49f264e348992c15bc86d7d11d2b72823be80

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 5aaeb444693fafe17ca335fabb55d4fc
SHA1 1128a2fe1a0ca59d8977803fc0afc6af37964eb4
SHA256 80eb02fc90a634fa42b536650362a8db59241a8dd1b1a418dfbd241e816c1778
SHA512 633e2cf3d15e049e2241fb7bfb65f5a558540414d963e2657633293aea401cf28c2c7fe31649d9bd09869e059c9f1cabd4da9100e154eb30bd20466286ccb56f

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 a2c0a64f15dfda45862dab0f572deb21
SHA1 03ee0e02dc731349fb1bc77458604e94bf710b0e
SHA256 f93097262ab86f926855f2f318ad2325aaa87e208c37554cca36b7dd28afc193
SHA512 45d60453a1e5262e0e8caa4f402b3dfa01a10a9b0dbb4479c032cde8a398d8c6f5cce69a12851b42bc34c2a1d8f06db12144f5084e2b3f4a969231011ebb33f1

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 f81c82178ece7811bdafe9fbe3b91bf6
SHA1 2c91228133d92bcaf000e55e23e442bc70c57732
SHA256 2bab7e3463083d3cb342a8e894e346838d301932bf8156e467271c3d27580a48
SHA512 4816319a04e8abc9e40479a83aed2c56c05696937027b59e5624cd3573ff1b5cc045778b31122d8ebcce025f1f0712cf3f3f2a8e4e15627ed124b3a30c07435d

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 73451183e39eb697e3f9897648bdd577
SHA1 d2e8cee97d42fe5aa620660667126475340c59c6
SHA256 010e0a2b266dfa56cddda27df9ed2ccca964a29305cd9f3779a3f045dbc6359b
SHA512 83b741cf640a1631b3808aab10108bc68950e58c0023ffb9f88e7feb296663d6d43bf64666e2aadc1170b2407aeef706918deba4d246a275356bc4dfd34a2e28

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 3ab67e2df9a24e0b526b387b95fbdd8c
SHA1 5699c62ba249ef0df2eca2499f6a3a9623a1904d
SHA256 0e9ff5ff0d7a062dbd22100895da773a7ba989e6cf6acac238ccf77a077e5992
SHA512 be7dacd1c08138927ff10ed16980249c387905243bbc8cb5ff4319501b94a62da398395af55f86b442ec15fb5ee6b21eb76be23615208f2de5f26ea3dc173cc0

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 59dd89ed571bcdd3ede95a81770025b2
SHA1 b710a7f078fa443f8d3db959dbf1b97ad187f961
SHA256 171451c66205ee026f6a36aebceee81dedcb365f288b8fb5eaf10e80fbb42051
SHA512 fedb8483876569f946b548b296d5788f8e774dd28faae7e5d659ab43e821ed432a1dd10e5d25f2160038f6bcda4770666e8e653d848e9eb5739e5c21157f22db

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 8be03437155f2253f391dcdbf31be5e4
SHA1 19d7b7f92c2a9517df1126526b5865cc152027ce
SHA256 5bcca639f3916099bc8a53e8315d452e693e4a2686aa762bd47055b2eafbdb40
SHA512 0c766e5f7ed35049c2fbe61c55432581248b6b5d219b91977d1800f71267fd9c927e57785239b5ae83384c8187861ef490b8995b92a5678e3aba4701712a5633

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 1ccdbcaa197e66d7879fbe0a8012fb86
SHA1 4541a5ead36172fe6d01137b39d22dba1b78ce79
SHA256 f0f5636b22f2f691eec201cfabd9755a606f180026251b994dc67c1ad2d03885
SHA512 e3d030f0e1454226b8da0004197fb31518e6f68c52de257ab24850bf3c4c5e32b7d9fd197e1af4d7cc0cac032eeda4f8ff27dc897b5069ee41ac39805e94ccfa

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 03573b1627730da35899cd56e17e9446
SHA1 42a822a1fa928eb083743fefbcc5266cae522254
SHA256 852e6e68e888488ffeac8dc88773c3bd7cd69c7d13ad9be4e2d4dc7d52f4718c
SHA512 51d8238293c633e67745bea3a6894098e914862ff7af29c9fd6c9b49b9efbf91b115fb38209ea93322c3248efaa25c4d70bc49da9c3d0146c67416709c9b0ce7

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 deace1fca21ec08dd804031f0685a5b2
SHA1 abbed419c663edc8001d2d072a34a6f1a559f090
SHA256 59d604a0e3fa734b22c46f2cd7c6bec195a5f99f4a8b4a9fd6fbd46633e94cf7
SHA512 76f01bd0747aae3b73b14db6bd0b9933b007dd3ab167c3cffb92a1008a73de5f64ab22504ea2c453e878e5494456a41dcbaab123caf50ce81d5931a6ae13de24

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 efe306cdd286df56083d187b11a7cd82
SHA1 293e47cffc983cac1d89b4b52044f9d362bff6e0
SHA256 4746b6d1db20d61ca73eb343a195642aa22ab5b40ccc27637bae50474c141b61
SHA512 fb150026dc382b70300fa9ffd72ce30015bf764af85f57af25f6ef35df278662f2c728d2ea8c66e8a1c3ea2e0b7367314c0f6acd96547e3130a04d9ab0432434

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 e2e819d29f28996b18f7d0f63cbaf90a
SHA1 2b0e39ea71db29b4cc36364d40e50b8c92d11bf9
SHA256 a71f0863ef77f53d69a386e88e028c0c45ac9e03bfa0329062bdee694537ab8f
SHA512 70e93f59aa8b5829ecc66a3ba7dcd70084f8963f7f4ee93c01cb6a3c00ee2524d22399ca017adcaf4ef001b765c28687558c4229999a728e39a47dfc77d6e3fb

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 0603c54eb75c5826738fc9bd81488899
SHA1 236cdf7accc37f22c1165c796791fc1eb9d8f51c
SHA256 b1657193688dffc25eaa45e8613259aea50ec124a87de8986a59fce578091319
SHA512 8d6c42337abaff938be0c01a946aaf0cd8ba33c9cbbabb8f8a6daa221fe7dea6762aeceb0da9e16af763d963d8b22063b8af9863786a00af7ba5d666c3c32083

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-03 21:02

Reported

2024-12-03 21:05

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

151s

Command Line

C:\Windows\Explorer.EXE

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Cybergate family

cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\temp\moof32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\temp\moof32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\temp\moof32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\temp\moof32.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{N8XQBNGL-D00W-W0E5-57AQ-VM2MRLI058WI} C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{N8XQBNGL-D00W-W0E5-57AQ-VM2MRLI058WI}\StubPath = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{N8XQBNGL-D00W-W0E5-57AQ-VM2MRLI058WI} C:\Windows\temp\moof32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{N8XQBNGL-D00W-W0E5-57AQ-VM2MRLI058WI}\StubPath = "C:\\Windows\\system32\\WinDir\\Svchost.exe Restart" C:\Windows\temp\moof32.exe N/A

Disables Task Manager via registry modification

evasion

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation C:\Windows\temp\moof32.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\temp\moof32.exe N/A
N/A N/A C:\Windows\SysWOW64\WinDir\Svchost.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\temp\moof32.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\temp\moof32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\temp\moof32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1XEUBHaiXDyyxCng = "C:\\Users\\Admin\\AppData\\Roaming\\system32.exe" C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\WinDir\Svchost.exe C:\Windows\temp\moof32.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\Svchost.exe C:\Windows\temp\moof32.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\Svchost.exe C:\Windows\temp\moof32.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\ C:\Windows\temp\moof32.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3784 set thread context of 2000 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\temp\moof32.exe

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\temp\moof32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\temp\moof32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WinDir\Svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Windows\temp\moof32.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\REG.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\temp\moof32.exe N/A
N/A N/A C:\Windows\temp\moof32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\temp\moof32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\temp\moof32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\temp\moof32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\temp\moof32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\temp\moof32.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\temp\moof32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3784 wrote to memory of 4968 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 3784 wrote to memory of 4968 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 3784 wrote to memory of 4968 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 3784 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 3784 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 3784 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 3784 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 3784 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 3784 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 3784 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 3784 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 3784 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 3784 wrote to memory of 3188 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\temp\moof32.exe
PID 3784 wrote to memory of 3188 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\temp\moof32.exe
PID 3784 wrote to memory of 3188 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\temp\moof32.exe
PID 3784 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\temp\moof32.exe
PID 3784 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\temp\moof32.exe
PID 3784 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\temp\moof32.exe
PID 3784 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\temp\moof32.exe
PID 3784 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\temp\moof32.exe
PID 3784 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\temp\moof32.exe
PID 3784 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\temp\moof32.exe
PID 3784 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\temp\moof32.exe
PID 3784 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\temp\moof32.exe
PID 3784 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\temp\moof32.exe
PID 3784 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\temp\moof32.exe
PID 3784 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\temp\moof32.exe
PID 3784 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe C:\Windows\temp\moof32.exe
PID 2000 wrote to memory of 3432 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 2000 wrote to memory of 3432 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 2000 wrote to memory of 3432 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 2000 wrote to memory of 3432 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 2000 wrote to memory of 3432 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 2000 wrote to memory of 3432 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 2000 wrote to memory of 3432 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 2000 wrote to memory of 3432 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 2000 wrote to memory of 3432 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 2000 wrote to memory of 3432 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 2000 wrote to memory of 3432 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 2000 wrote to memory of 3432 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 2000 wrote to memory of 3432 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 2000 wrote to memory of 3432 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 2000 wrote to memory of 3432 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 2000 wrote to memory of 3432 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 2000 wrote to memory of 3432 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 2000 wrote to memory of 3432 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 2000 wrote to memory of 3432 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 2000 wrote to memory of 3432 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 2000 wrote to memory of 3432 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 2000 wrote to memory of 3432 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 2000 wrote to memory of 3432 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 2000 wrote to memory of 3432 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 2000 wrote to memory of 3432 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 2000 wrote to memory of 3432 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 2000 wrote to memory of 3432 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 2000 wrote to memory of 3432 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 2000 wrote to memory of 3432 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 2000 wrote to memory of 3432 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 2000 wrote to memory of 3432 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 2000 wrote to memory of 3432 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 2000 wrote to memory of 3432 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 2000 wrote to memory of 3432 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 2000 wrote to memory of 3432 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE
PID 2000 wrote to memory of 3432 N/A C:\Windows\temp\moof32.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\bf386eaf13614a52a48785127a706e30_JaffaCakes118.exe"

C:\Windows\SysWOW64\REG.exe

REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\REG.exe

REG add HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\REG.exe

REG add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoFolderOptions /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\REG.exe

REG add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoFolderOptions /t REG_DWORD /d 1 /f

C:\Windows\temp\moof32.exe

C:\Windows\temp\moof32.exe

C:\Windows\temp\moof32.exe

C:\Windows\temp\moof32.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Windows\temp\moof32.exe

"C:\Windows\temp\moof32.exe"

C:\Windows\SysWOW64\WinDir\Svchost.exe

"C:\Windows\system32\WinDir\Svchost.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 www.server.com udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 106.209.201.84.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp

Files

memory/3784-0-0x00000000752A2000-0x00000000752A3000-memory.dmp

memory/3784-1-0x00000000752A0000-0x0000000075851000-memory.dmp

memory/3784-2-0x00000000752A0000-0x0000000075851000-memory.dmp

C:\Windows\Temp\moof32.exe

MD5 d881de17aa8f2e2c08cbb7b265f928f9
SHA1 08936aebc87decf0af6e8eada191062b5e65ac2a
SHA256 b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA512 5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

memory/2000-10-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2000-8-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2000-12-0x0000000000400000-0x0000000000451000-memory.dmp

memory/3784-13-0x00000000752A0000-0x0000000075851000-memory.dmp

memory/2000-17-0x0000000010410000-0x0000000010475000-memory.dmp

memory/3900-23-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

memory/3900-22-0x0000000000D30000-0x0000000000D31000-memory.dmp

memory/2000-21-0x0000000010480000-0x00000000104E5000-memory.dmp

memory/3900-83-0x0000000075290000-0x0000000075898000-memory.dmp

memory/3900-84-0x0000000075290000-0x0000000075898000-memory.dmp

memory/3900-85-0x0000000075290000-0x0000000075898000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

MD5 4818824b297b801e767c88038ebef589
SHA1 52cad64b90f7c0fcaab6d0d61a13122c435d3058
SHA256 6ed133a0eab3ee482d9a861d6651eea7c24ded10f1c98c7a9ad81632d7081dc3
SHA512 9a18d89d630793f858602d8cc111984eb1e0b6305c6de27da4d2450aa0573cb98a6f06507071d238338590b7b592d80a95baa837b7c5ac4ec62757f895344775

C:\Users\Admin\AppData\Roaming\Adminlog.dat

MD5 bf3dba41023802cf6d3f8c5fd683a0c7
SHA1 466530987a347b68ef28faad238d7b50db8656a5
SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
SHA512 fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 e03fb636c32b6addff8e231534d0eb3b
SHA1 c5f8ecac21a7e103164a11d0a4b022da58d87da2
SHA256 e90b9ae25db9c1d3ce5589a4c40b03d7ba3bf29fb96e7997b3def1e54c9d9a12
SHA512 996acae9a492060437cd3a6a71ebc5d3d86bf2594c636a1ee2ec3a15a64028f3a78e7994306575975c371cfdf4a120e8281d905e295e99a7b1a63cfac61b07d6

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 fb054f669995dbb0d62e9c5efd970a2c
SHA1 959b87b6b0b799e38ebdd00f2eeba9f12f5b0148
SHA256 a1673d666b34aaec287e54c4f96107b9511be9c7166a815eba86d79c5808c951
SHA512 2a85472f3d250a99f83be3cf6439524262ed7f78895992d7b281de76a63b758e5da2941ba7eead87b367182297e9cafd6cf7e9d11e4640d61be97775e046a7eb

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 b93b0b9e9980d44791759a5186d3fe77
SHA1 68dd1682129c9283d38c8039f9071a8bf9f24d69
SHA256 baa22d91b63bdf56241fe2bda827570675fc2b2c9a09da60a9e9ca8aed4c6b0d
SHA512 ddce7a503d890f542004c7aed68f618c74f639c9e941d6d144d6a51385799c55211b61d110836325244150c419ea6d4ae82abb9debdf77f4b3ace6fe5287eed1

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 0d0815f16ef86f57e1748499567b27b2
SHA1 b1de1e65f9e68ea733553086daf3bbcd3d750403
SHA256 969ebd13dd11633d9b9c0ebe0914f43ebe3732623ad17ff6e997e6561f20776a
SHA512 aaebb2d47f779f4dd5a3d2630f4a69c53ff8af8c2fd2bc73ab951cb49d06b499430047437f933a79ace34d524389085222b8e859c2078f9740c132eae7bded23

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 3fd0ffeb2aee0e53828b85530b5dba66
SHA1 b488cb17d815fa6b8a2cb17137c5384adccb1697
SHA256 a7ab071a5e93067fe89ca4c200292c6a739c50356a65fe05f3c2cc79ed873527
SHA512 45aecad86bf8617b6903eac4a040c3be1b56e1d2e486dcebc98d7111c519368873697de15b2a70cde302ce66b409bd95419b58cd3eab2a1f5d6357b3ed728604

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 cce9efbe5561c559c745f207d773b58a
SHA1 363dd8c1e15cce592b8950f1ebe9acf99fd34f43
SHA256 3555759bd716c9d7cabb0d910c76a0f1653f0d767201e8b4e71e5ad82d1fe43b
SHA512 39e515ad01cc0db3d61d874aadaef0ac41afff6285dbfa60370902cd2e145d1ad1ace80fc0b4587d0c0375f91cee3678b347160cca590be749e61f47161fbb72

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 fa0a0ac7b2c76c01987127e72c75180b
SHA1 45074a12878137ec3bd60928e53094f5991e8506
SHA256 202eb4ba5eb610da618f0e5f4220740e95b0159202349ef829c80b91c8df97ff
SHA512 c23c084d410b3e6deca59dd8a05d51603dbf1f77b5f37efdc2a909ca68b4432621c5689a51eb14a892178123c2f49f264e348992c15bc86d7d11d2b72823be80

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 5aaeb444693fafe17ca335fabb55d4fc
SHA1 1128a2fe1a0ca59d8977803fc0afc6af37964eb4
SHA256 80eb02fc90a634fa42b536650362a8db59241a8dd1b1a418dfbd241e816c1778
SHA512 633e2cf3d15e049e2241fb7bfb65f5a558540414d963e2657633293aea401cf28c2c7fe31649d9bd09869e059c9f1cabd4da9100e154eb30bd20466286ccb56f

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 a2c0a64f15dfda45862dab0f572deb21
SHA1 03ee0e02dc731349fb1bc77458604e94bf710b0e
SHA256 f93097262ab86f926855f2f318ad2325aaa87e208c37554cca36b7dd28afc193
SHA512 45d60453a1e5262e0e8caa4f402b3dfa01a10a9b0dbb4479c032cde8a398d8c6f5cce69a12851b42bc34c2a1d8f06db12144f5084e2b3f4a969231011ebb33f1

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 f81c82178ece7811bdafe9fbe3b91bf6
SHA1 2c91228133d92bcaf000e55e23e442bc70c57732
SHA256 2bab7e3463083d3cb342a8e894e346838d301932bf8156e467271c3d27580a48
SHA512 4816319a04e8abc9e40479a83aed2c56c05696937027b59e5624cd3573ff1b5cc045778b31122d8ebcce025f1f0712cf3f3f2a8e4e15627ed124b3a30c07435d

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 73451183e39eb697e3f9897648bdd577
SHA1 d2e8cee97d42fe5aa620660667126475340c59c6
SHA256 010e0a2b266dfa56cddda27df9ed2ccca964a29305cd9f3779a3f045dbc6359b
SHA512 83b741cf640a1631b3808aab10108bc68950e58c0023ffb9f88e7feb296663d6d43bf64666e2aadc1170b2407aeef706918deba4d246a275356bc4dfd34a2e28

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 3ab67e2df9a24e0b526b387b95fbdd8c
SHA1 5699c62ba249ef0df2eca2499f6a3a9623a1904d
SHA256 0e9ff5ff0d7a062dbd22100895da773a7ba989e6cf6acac238ccf77a077e5992
SHA512 be7dacd1c08138927ff10ed16980249c387905243bbc8cb5ff4319501b94a62da398395af55f86b442ec15fb5ee6b21eb76be23615208f2de5f26ea3dc173cc0

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 59dd89ed571bcdd3ede95a81770025b2
SHA1 b710a7f078fa443f8d3db959dbf1b97ad187f961
SHA256 171451c66205ee026f6a36aebceee81dedcb365f288b8fb5eaf10e80fbb42051
SHA512 fedb8483876569f946b548b296d5788f8e774dd28faae7e5d659ab43e821ed432a1dd10e5d25f2160038f6bcda4770666e8e653d848e9eb5739e5c21157f22db

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 8be03437155f2253f391dcdbf31be5e4
SHA1 19d7b7f92c2a9517df1126526b5865cc152027ce
SHA256 5bcca639f3916099bc8a53e8315d452e693e4a2686aa762bd47055b2eafbdb40
SHA512 0c766e5f7ed35049c2fbe61c55432581248b6b5d219b91977d1800f71267fd9c927e57785239b5ae83384c8187861ef490b8995b92a5678e3aba4701712a5633

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 1ccdbcaa197e66d7879fbe0a8012fb86
SHA1 4541a5ead36172fe6d01137b39d22dba1b78ce79
SHA256 f0f5636b22f2f691eec201cfabd9755a606f180026251b994dc67c1ad2d03885
SHA512 e3d030f0e1454226b8da0004197fb31518e6f68c52de257ab24850bf3c4c5e32b7d9fd197e1af4d7cc0cac032eeda4f8ff27dc897b5069ee41ac39805e94ccfa

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 03573b1627730da35899cd56e17e9446
SHA1 42a822a1fa928eb083743fefbcc5266cae522254
SHA256 852e6e68e888488ffeac8dc88773c3bd7cd69c7d13ad9be4e2d4dc7d52f4718c
SHA512 51d8238293c633e67745bea3a6894098e914862ff7af29c9fd6c9b49b9efbf91b115fb38209ea93322c3248efaa25c4d70bc49da9c3d0146c67416709c9b0ce7

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 deace1fca21ec08dd804031f0685a5b2
SHA1 abbed419c663edc8001d2d072a34a6f1a559f090
SHA256 59d604a0e3fa734b22c46f2cd7c6bec195a5f99f4a8b4a9fd6fbd46633e94cf7
SHA512 76f01bd0747aae3b73b14db6bd0b9933b007dd3ab167c3cffb92a1008a73de5f64ab22504ea2c453e878e5494456a41dcbaab123caf50ce81d5931a6ae13de24

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 efe306cdd286df56083d187b11a7cd82
SHA1 293e47cffc983cac1d89b4b52044f9d362bff6e0
SHA256 4746b6d1db20d61ca73eb343a195642aa22ab5b40ccc27637bae50474c141b61
SHA512 fb150026dc382b70300fa9ffd72ce30015bf764af85f57af25f6ef35df278662f2c728d2ea8c66e8a1c3ea2e0b7367314c0f6acd96547e3130a04d9ab0432434