Malware Analysis Report

2025-01-02 12:27

Sample ID 241205-zae8za1jcz
Target c94b5ed31851d3ca7d8e2240984c6d31_JaffaCakes118
SHA256 b8d2e36634a58afe21c3b9a31c6bcde5c7f159fef9a8d8e59447c4ca06f63588
Tags
cybergate cyber discovery persistence stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b8d2e36634a58afe21c3b9a31c6bcde5c7f159fef9a8d8e59447c4ca06f63588

Threat Level: Known bad

The file c94b5ed31851d3ca7d8e2240984c6d31_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

cybergate cyber discovery persistence stealer trojan upx

Cybergate family

CyberGate, Rebhip

Adds policy Run key to start application

Boot or Logon Autostart Execution: Active Setup

Executes dropped EXE

Loads dropped DLL

Uses the VBS compiler for execution

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in System32 directory

UPX packed file

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-05 20:30

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-05 20:30

Reported

2024-12-05 20:33

Platform

win7-20241010-en

Max time kernel

148s

Max time network

148s

Command Line

C:\Windows\Explorer.EXE

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Cybergate family

cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\windows\\svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\windows\\svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8B0LCDMG-48AX-SJ8Y-WSLH-3F6FT81JW0XJ}\StubPath = "C:\\Windows\\system32\\windows\\svchost.exe" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{8B0LCDMG-48AX-SJ8Y-WSLH-3F6FT81JW0XJ} C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8B0LCDMG-48AX-SJ8Y-WSLH-3F6FT81JW0XJ}\StubPath = "C:\\Windows\\system32\\windows\\svchost.exe Restart" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{8B0LCDMG-48AX-SJ8Y-WSLH-3F6FT81JW0XJ} C:\Windows\SysWOW64\explorer.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\windows\svchost.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Uses the VBS compiler for execution

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\windows\\svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\windows\\svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\windows\svchost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\windows\svchost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\windows\svchost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\windows\ C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2552 set thread context of 2468 N/A C:\Users\Admin\AppData\Local\Temp\c94b5ed31851d3ca7d8e2240984c6d31_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c94b5ed31851d3ca7d8e2240984c6d31_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\windows\svchost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2552 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\c94b5ed31851d3ca7d8e2240984c6d31_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2552 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\c94b5ed31851d3ca7d8e2240984c6d31_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2552 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\c94b5ed31851d3ca7d8e2240984c6d31_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2552 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\c94b5ed31851d3ca7d8e2240984c6d31_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2552 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\c94b5ed31851d3ca7d8e2240984c6d31_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2552 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\c94b5ed31851d3ca7d8e2240984c6d31_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2552 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\c94b5ed31851d3ca7d8e2240984c6d31_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2552 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\c94b5ed31851d3ca7d8e2240984c6d31_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2552 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\c94b5ed31851d3ca7d8e2240984c6d31_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2552 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\c94b5ed31851d3ca7d8e2240984c6d31_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2552 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\c94b5ed31851d3ca7d8e2240984c6d31_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2552 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\c94b5ed31851d3ca7d8e2240984c6d31_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2468 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\c94b5ed31851d3ca7d8e2240984c6d31_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\c94b5ed31851d3ca7d8e2240984c6d31_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"

C:\Windows\SysWOW64\windows\svchost.exe

"C:\Windows\system32\windows\svchost.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.server.com udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp

Files

memory/2552-0-0x0000000074A01000-0x0000000074A02000-memory.dmp

memory/2552-1-0x0000000074A00000-0x0000000074FAB000-memory.dmp

memory/2552-2-0x0000000074A00000-0x0000000074FAB000-memory.dmp

memory/2468-3-0x0000000000400000-0x000000000044D000-memory.dmp

memory/2468-9-0x0000000000400000-0x000000000044D000-memory.dmp

memory/2468-13-0x0000000000400000-0x000000000044D000-memory.dmp

memory/2468-12-0x0000000000400000-0x000000000044D000-memory.dmp

memory/2468-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2468-8-0x0000000000400000-0x000000000044D000-memory.dmp

memory/2468-7-0x0000000000400000-0x000000000044D000-memory.dmp

memory/2468-6-0x0000000000400000-0x000000000044D000-memory.dmp

memory/2468-5-0x0000000000400000-0x000000000044D000-memory.dmp

memory/2468-4-0x0000000000400000-0x000000000044D000-memory.dmp

memory/2468-14-0x0000000000400000-0x000000000044D000-memory.dmp

memory/2468-16-0x0000000000400000-0x000000000044D000-memory.dmp

memory/2552-15-0x0000000074A00000-0x0000000074FAB000-memory.dmp

memory/1200-20-0x00000000024A0000-0x00000000024A1000-memory.dmp

memory/2484-263-0x00000000000E0000-0x00000000000E1000-memory.dmp

memory/2484-267-0x0000000000120000-0x0000000000121000-memory.dmp

memory/2468-316-0x0000000000400000-0x000000000044D000-memory.dmp

memory/2484-548-0x0000000024070000-0x00000000240CF000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

MD5 8cdc1dc6662d029a4ab77257452302a7
SHA1 9b9eb5c24f1dfecd54d321e1c6a27d5d46001c8b
SHA256 267496251106daab1e6a84b9a7a914563166209a3246b84ac09b4305d12d01c9
SHA512 3b7510bc3db520287752a75697b610127e204c003db3169a4e2f981c4a14b07e4413dc938485ae1760013c7e029ed962e505fb3c588d6d3f46e63a1a9965278d

C:\Windows\SysWOW64\windows\svchost.exe

MD5 34aa912defa18c2c129f1e09d75c1d7e
SHA1 9c3046324657505a30ecd9b1fdb46c05bde7d470
SHA256 6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512 d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

memory/2468-879-0x0000000000400000-0x000000000044D000-memory.dmp

memory/2484-895-0x0000000024070000-0x00000000240CF000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 7360065d78ebb8933d975751e424785b
SHA1 7a365580a0d63664bf5365325f90a6f9eab1d592
SHA256 d6672fe712e377d91b8cfa01ef1c319e271093bb874524ddecf2f8baeb53bd77
SHA512 c15b93cc5b962f572b88fcdbb17f04efce9c4de5aeac2ad4adef5b2e073c56afca6b27236d855a582ec22463bbb726eab7f116c1148405a39cc3c5325b806e84

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 73f6aa1d5e9f599c80651f72ce2a0fb4
SHA1 7d8c2cf211a72a181a4333fde80151a7ca846641
SHA256 a48e5a93b94aa5c2f7301e6b06a36a5c76ca77be917b221dbeae1d4c4708a3de
SHA512 3025f949ead40f6a98745183563f89ebcf55d8e94d3e6d86743e03ca2642026b3875e4e14a69a5635b7ba0a1a87d8a904a6f6867f0b0df94be73c1c89230243d

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 b832864e657f2851dcd0314d539cdd78
SHA1 48e6845989ef32bdabc2d95b9bb9d6ca7babb945
SHA256 d3eb7608ae921ef0e49d9af5ca3999df034ce33f33ad9c032b7a918aa2c9064e
SHA512 f253a84663764b85625e1c567ab3958c262d826dede45fc26e9cd7860541c7863c302c5b18ecb4609f7c055369db4728dbc4ac92024b95040418486f3789c134

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 b1aa5bb33db43428dac970656bef6889
SHA1 f690e945df1b7808dedb580f524a8d5b7be6b7fd
SHA256 5f9277a6e1a13f92070a836630795b344e5802b7f8626b4a649e5cd7b4869ebc
SHA512 e94e71b311fc7c98e90273782a3dd0fb4cc9df2135f4af751c111918379d3e86cc9708d32db14364e5b364c5b2c1e888e57ed002f607c753f0b5934b4366596b

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 1719ad45bcfeb03cf3c84ff6f6c7d72b
SHA1 4e8afd6792e48c4babdf992f705ab7650a14470a
SHA256 017fc9e6e4faa782530d4676cd99cf7033fb7481c15d881ae4ade2dc15f8641e
SHA512 9e28d6528831830e7602d6b898cdbd3ec4839e6731e2975555802ff20d8c18d040141ea8888d08c7ca65ab005ca831575fcd74977495a5497a1594bb3ea0a6d7

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 4f7503333fb52321771e6d5d708a6f29
SHA1 59d6259db8209a643af84cf8b6d2efdae6e40d97
SHA256 6efe4d3173cf40071b3162d6545c2f32b2923060d4405ce459a1406d9bf1218d
SHA512 ff30e9128d5142425db3cf7088ee2403ccdd4c61c328a86b9c9f684c8de32d0c5e96749c658a44eede3adb32ea44d635d89cd6cb063002347aa7f6a2d52ebd8d

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 77c208dcfe3f2ab0021600a4b5a0ee82
SHA1 4aff5152eee3f7d74bb0b2bf08a3bd6eddf7f959
SHA256 5fd6ab1337e77f92f2a795b2a1d3c4e6b659e235b27f6085d1c413ed77246fcb
SHA512 0989c5895ad388ef14c88fadbfef8096beedb596843929e87f80d6f355e3aab9fba6c2b56592b20afab5359ac8f00312ca66e58578da849e486e40e3a16cc006

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 91915e75624e5fbb777d6e3f0e30aa6e
SHA1 cd1501393d75e8f3323f2c0463a33fe8f6ccb0d8
SHA256 849178d7a02ab40df3b690d83b8392325e15ae850f312f8817f5a2a24f9e6475
SHA512 c2c0a8ad74e0b7421421678d65c1fd60acd01cba67275106f409650043b3f70f95316675ad0e1bbd4c534037677e65795dd0962704933a952d2c76f067ef0807

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 96fc8d2f112a0cbf4d1d191391f60e5b
SHA1 327de101eca39fed71788aa10515919e5c46185f
SHA256 bb7a690a4d52a34fb1aabcefda75817ed431f4e35d90266fdeca2716479ca895
SHA512 31d757f62eb79805cae6a4f4ff4ce1ee2f164b052172abc205bc9ebd940d526f897acab285fde6a16900ee31ab5db9b9b67fb53716101d422de486914bdfbeb2

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 860fd30ada22d14ab7ce2f763932a0b7
SHA1 debc34ae9ae42bf43d4b0b8b31657e5032e8cf8a
SHA256 266dacd401a2c14be60243003c7c3a26cf73f534f47f7d87eec66a2e76d463bb
SHA512 3338c8f1d698c4f50a8c445bf4f4680fad7e1cb46e7f18fdaea0deefffec0327d3eb0d5158070df0549a004761473eaa10f11498175cc81b00a4757a8be3522b

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 1bdd39b6321aea9cd715d802ecdbc3d5
SHA1 373de7b6ce372f1f49f0404ab1635aa975eddd8a
SHA256 597833c49427d0bc21727b5fdb049f1d7baf28bf453a3b8be9dea2e26c333e59
SHA512 f98f7f3fe536fe83c06cb16fc8adcf71726c780cd1430e56dc6e1359b17b65f011c59de7f8a75874839faab605e94b8e177696a019576eae6bb1edcbe4ef6045

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 d66bf498b775fb3aa19260e2eb4fe72d
SHA1 d890930a32d74ef4389163bba4a13d58e7304675
SHA256 e753a067c32035ffd21b6cc67bbe3947f13306d5f6ffa57f6344084c6bd90ca5
SHA512 75da9a8595e311ac3a29b699ed26646f45238f3ac1fd014d4d3bd0a2fdc7e1fe3e33b621accc739019ea0d5a0797de4e1b983a991658bad44e5040daec4dee3f

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 1dcd997b85603f47544c2deb76969a83
SHA1 91a1a86bb5f0d618b4af1789a2fa78c645dbe738
SHA256 42454da39921276390247e13c10bcba6ec1fdcd96dd9ebfde2eb7d95c62d381a
SHA512 c7ae8050db9148738dc951dbd3dce8aa3fb00cd7da8b3d237d298fa7e1702b9d470e4d3b136cccb94b9db4fe726922e5c8d72fd468008fec5551cf09a0bced62

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 2531c4c8c54527ff3b117d48e4c57d9a
SHA1 edd5e83ea6fac4c878b229ceb4fec226c2fae4e8
SHA256 441b21f986f7b4e93bd2652296d7f7b1d356d5311a48f9b2b023a28c0924e404
SHA512 2e3a0ea281e77ab106662b1532304493b21a123b66cb1bb88a96a5e041107c164e1c6d32f7a38ad7c8b9c8f266e1a45a89b5983fc054d4f8e8173ab67ec9ce89

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 c4ec5c1bb01b9267cc7a6a5a7fee8613
SHA1 2804c11cfbf59e15c92a8f0621c8171857a048c0
SHA256 5467526a55914c9b627f3b341e33cde06c00d1145960876910533184d5629b66
SHA512 0acd31ab60bdbcae01f545d231dd35c8845e09fb3b51b7d658562ca49aa3e4c9599c28a3227e12cdb325b6b6994a1c30fb4be5b8b77fe58e5b81574307938def

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 2e638c47cb6707b29632f6ad4042e878
SHA1 7613d20cd89a653b8c9dc9bd50c64a58124673cc
SHA256 47d21bdb557a09d2b80016d8d8acc7320ea4f82bc44480043cf90adfa381ee2d
SHA512 248c7cf6b67fc95329982e81a3966718c309f6fd1478792d1336fd5ee7aa90a3b972d0c8a80589e7c9e42cd816568e32f60c42567376b78cb556b10fc8e36dcc

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 efb631a97c4c1e74f5979d4db065c894
SHA1 ba4ddbd98383f95d880657ddb2336c9550434841
SHA256 8a45d393ea977d0ffcffbdcf4471a29e6b8659f47dddccbee562e3d0fd1a7022
SHA512 f98b516c1ff221fcd8e48133dabe3ce7f67ade748b8d190f85252d0be8d6d276d48e7f75a1582cebb5a3fae40eeb6f034fcb850530f344c491158c573acabe13

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 86c18007627ce4601ec53301754c4bf9
SHA1 bdefc07cba14ba8ac6d0dbbe014f09f5e2c82f95
SHA256 fc543d50fae237002fc74eb6397b76c3542e105e0245480f62ebdec0fdd9a37f
SHA512 1adb0265a5fb46cb1d338f508102c41d210087fb298aa35642722a10de47ddd5412bbb1ef326f0d04635d4c4c0e1a5aa97f79f9f4d691a7835fec86a5cabb336

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 a9d409ab95f29248586ac5dad9b4b6d7
SHA1 e4cdf73d859cbac4f6c65274819bb72e2477aba7
SHA256 5c297aa8948457fc0c6dd4f52198a70294203ab431ca396ddc61dbf2a8bd28bc
SHA512 c8690bc56c83e4bdbf992987bfa4abf92371fecc2bf198aeeef846d3d4be635ca0e0a4d76065057c6168ed3b158ca3d84b8fd2c55a490c28877df0adc6e680c1

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-05 20:30

Reported

2024-12-05 20:33

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

150s

Command Line

C:\Windows\Explorer.EXE

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Cybergate family

cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\windows\\svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\windows\\svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{8B0LCDMG-48AX-SJ8Y-WSLH-3F6FT81JW0XJ} C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8B0LCDMG-48AX-SJ8Y-WSLH-3F6FT81JW0XJ}\StubPath = "C:\\Windows\\system32\\windows\\svchost.exe" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{8B0LCDMG-48AX-SJ8Y-WSLH-3F6FT81JW0XJ} C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8B0LCDMG-48AX-SJ8Y-WSLH-3F6FT81JW0XJ}\StubPath = "C:\\Windows\\system32\\windows\\svchost.exe Restart" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\windows\svchost.exe N/A

Uses the VBS compiler for execution

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\windows\\svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\windows\\svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\windows\svchost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\windows\svchost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\windows\svchost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\windows\ C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4420 set thread context of 1052 N/A C:\Users\Admin\AppData\Local\Temp\c94b5ed31851d3ca7d8e2240984c6d31_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\windows\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c94b5ed31851d3ca7d8e2240984c6d31_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4420 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\c94b5ed31851d3ca7d8e2240984c6d31_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4420 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\c94b5ed31851d3ca7d8e2240984c6d31_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4420 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\c94b5ed31851d3ca7d8e2240984c6d31_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4420 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\c94b5ed31851d3ca7d8e2240984c6d31_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4420 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\c94b5ed31851d3ca7d8e2240984c6d31_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4420 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\c94b5ed31851d3ca7d8e2240984c6d31_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4420 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\c94b5ed31851d3ca7d8e2240984c6d31_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4420 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\c94b5ed31851d3ca7d8e2240984c6d31_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4420 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\c94b5ed31851d3ca7d8e2240984c6d31_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4420 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\c94b5ed31851d3ca7d8e2240984c6d31_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4420 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\c94b5ed31851d3ca7d8e2240984c6d31_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4420 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\c94b5ed31851d3ca7d8e2240984c6d31_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4420 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\c94b5ed31851d3ca7d8e2240984c6d31_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1052 wrote to memory of 3460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\c94b5ed31851d3ca7d8e2240984c6d31_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\c94b5ed31851d3ca7d8e2240984c6d31_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"

C:\Windows\SysWOW64\windows\svchost.exe

"C:\Windows\system32\windows\svchost.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 133.130.81.91.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 www.server.com udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 90.210.23.2.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp

Files

memory/4420-0-0x0000000074B92000-0x0000000074B93000-memory.dmp

memory/4420-1-0x0000000074B90000-0x0000000075141000-memory.dmp

memory/4420-2-0x0000000074B90000-0x0000000075141000-memory.dmp

memory/1052-4-0x0000000000400000-0x000000000044D000-memory.dmp

memory/1052-3-0x0000000000400000-0x000000000044D000-memory.dmp

memory/1052-5-0x0000000000400000-0x000000000044D000-memory.dmp

memory/1052-7-0x0000000000400000-0x000000000044D000-memory.dmp

memory/4420-8-0x0000000074B90000-0x0000000075141000-memory.dmp

memory/1052-12-0x0000000024010000-0x000000002406F000-memory.dmp

memory/1844-17-0x0000000000440000-0x0000000000441000-memory.dmp

memory/1844-16-0x0000000000180000-0x0000000000181000-memory.dmp

memory/1052-30-0x0000000000400000-0x000000000044D000-memory.dmp

memory/1052-73-0x0000000024070000-0x00000000240CF000-memory.dmp

memory/1844-78-0x0000000024070000-0x00000000240CF000-memory.dmp

C:\Windows\SysWOW64\windows\svchost.exe

MD5 d881de17aa8f2e2c08cbb7b265f928f9
SHA1 08936aebc87decf0af6e8eada191062b5e65ac2a
SHA256 b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA512 5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

MD5 8cdc1dc6662d029a4ab77257452302a7
SHA1 9b9eb5c24f1dfecd54d321e1c6a27d5d46001c8b
SHA256 267496251106daab1e6a84b9a7a914563166209a3246b84ac09b4305d12d01c9
SHA512 3b7510bc3db520287752a75697b610127e204c003db3169a4e2f981c4a14b07e4413dc938485ae1760013c7e029ed962e505fb3c588d6d3f46e63a1a9965278d

memory/1052-150-0x0000000000400000-0x000000000044D000-memory.dmp

memory/3040-147-0x0000000024130000-0x000000002418F000-memory.dmp

memory/1844-164-0x0000000024070000-0x00000000240CF000-memory.dmp

memory/3040-165-0x0000000024130000-0x000000002418F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 b832864e657f2851dcd0314d539cdd78
SHA1 48e6845989ef32bdabc2d95b9bb9d6ca7babb945
SHA256 d3eb7608ae921ef0e49d9af5ca3999df034ce33f33ad9c032b7a918aa2c9064e
SHA512 f253a84663764b85625e1c567ab3958c262d826dede45fc26e9cd7860541c7863c302c5b18ecb4609f7c055369db4728dbc4ac92024b95040418486f3789c134

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 b1aa5bb33db43428dac970656bef6889
SHA1 f690e945df1b7808dedb580f524a8d5b7be6b7fd
SHA256 5f9277a6e1a13f92070a836630795b344e5802b7f8626b4a649e5cd7b4869ebc
SHA512 e94e71b311fc7c98e90273782a3dd0fb4cc9df2135f4af751c111918379d3e86cc9708d32db14364e5b364c5b2c1e888e57ed002f607c753f0b5934b4366596b

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 1719ad45bcfeb03cf3c84ff6f6c7d72b
SHA1 4e8afd6792e48c4babdf992f705ab7650a14470a
SHA256 017fc9e6e4faa782530d4676cd99cf7033fb7481c15d881ae4ade2dc15f8641e
SHA512 9e28d6528831830e7602d6b898cdbd3ec4839e6731e2975555802ff20d8c18d040141ea8888d08c7ca65ab005ca831575fcd74977495a5497a1594bb3ea0a6d7

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 4f7503333fb52321771e6d5d708a6f29
SHA1 59d6259db8209a643af84cf8b6d2efdae6e40d97
SHA256 6efe4d3173cf40071b3162d6545c2f32b2923060d4405ce459a1406d9bf1218d
SHA512 ff30e9128d5142425db3cf7088ee2403ccdd4c61c328a86b9c9f684c8de32d0c5e96749c658a44eede3adb32ea44d635d89cd6cb063002347aa7f6a2d52ebd8d

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 77c208dcfe3f2ab0021600a4b5a0ee82
SHA1 4aff5152eee3f7d74bb0b2bf08a3bd6eddf7f959
SHA256 5fd6ab1337e77f92f2a795b2a1d3c4e6b659e235b27f6085d1c413ed77246fcb
SHA512 0989c5895ad388ef14c88fadbfef8096beedb596843929e87f80d6f355e3aab9fba6c2b56592b20afab5359ac8f00312ca66e58578da849e486e40e3a16cc006

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 91915e75624e5fbb777d6e3f0e30aa6e
SHA1 cd1501393d75e8f3323f2c0463a33fe8f6ccb0d8
SHA256 849178d7a02ab40df3b690d83b8392325e15ae850f312f8817f5a2a24f9e6475
SHA512 c2c0a8ad74e0b7421421678d65c1fd60acd01cba67275106f409650043b3f70f95316675ad0e1bbd4c534037677e65795dd0962704933a952d2c76f067ef0807

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 96fc8d2f112a0cbf4d1d191391f60e5b
SHA1 327de101eca39fed71788aa10515919e5c46185f
SHA256 bb7a690a4d52a34fb1aabcefda75817ed431f4e35d90266fdeca2716479ca895
SHA512 31d757f62eb79805cae6a4f4ff4ce1ee2f164b052172abc205bc9ebd940d526f897acab285fde6a16900ee31ab5db9b9b67fb53716101d422de486914bdfbeb2

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 860fd30ada22d14ab7ce2f763932a0b7
SHA1 debc34ae9ae42bf43d4b0b8b31657e5032e8cf8a
SHA256 266dacd401a2c14be60243003c7c3a26cf73f534f47f7d87eec66a2e76d463bb
SHA512 3338c8f1d698c4f50a8c445bf4f4680fad7e1cb46e7f18fdaea0deefffec0327d3eb0d5158070df0549a004761473eaa10f11498175cc81b00a4757a8be3522b

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 1bdd39b6321aea9cd715d802ecdbc3d5
SHA1 373de7b6ce372f1f49f0404ab1635aa975eddd8a
SHA256 597833c49427d0bc21727b5fdb049f1d7baf28bf453a3b8be9dea2e26c333e59
SHA512 f98f7f3fe536fe83c06cb16fc8adcf71726c780cd1430e56dc6e1359b17b65f011c59de7f8a75874839faab605e94b8e177696a019576eae6bb1edcbe4ef6045

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 d66bf498b775fb3aa19260e2eb4fe72d
SHA1 d890930a32d74ef4389163bba4a13d58e7304675
SHA256 e753a067c32035ffd21b6cc67bbe3947f13306d5f6ffa57f6344084c6bd90ca5
SHA512 75da9a8595e311ac3a29b699ed26646f45238f3ac1fd014d4d3bd0a2fdc7e1fe3e33b621accc739019ea0d5a0797de4e1b983a991658bad44e5040daec4dee3f

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 1dcd997b85603f47544c2deb76969a83
SHA1 91a1a86bb5f0d618b4af1789a2fa78c645dbe738
SHA256 42454da39921276390247e13c10bcba6ec1fdcd96dd9ebfde2eb7d95c62d381a
SHA512 c7ae8050db9148738dc951dbd3dce8aa3fb00cd7da8b3d237d298fa7e1702b9d470e4d3b136cccb94b9db4fe726922e5c8d72fd468008fec5551cf09a0bced62

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 2531c4c8c54527ff3b117d48e4c57d9a
SHA1 edd5e83ea6fac4c878b229ceb4fec226c2fae4e8
SHA256 441b21f986f7b4e93bd2652296d7f7b1d356d5311a48f9b2b023a28c0924e404
SHA512 2e3a0ea281e77ab106662b1532304493b21a123b66cb1bb88a96a5e041107c164e1c6d32f7a38ad7c8b9c8f266e1a45a89b5983fc054d4f8e8173ab67ec9ce89

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 c4ec5c1bb01b9267cc7a6a5a7fee8613
SHA1 2804c11cfbf59e15c92a8f0621c8171857a048c0
SHA256 5467526a55914c9b627f3b341e33cde06c00d1145960876910533184d5629b66
SHA512 0acd31ab60bdbcae01f545d231dd35c8845e09fb3b51b7d658562ca49aa3e4c9599c28a3227e12cdb325b6b6994a1c30fb4be5b8b77fe58e5b81574307938def

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 2e638c47cb6707b29632f6ad4042e878
SHA1 7613d20cd89a653b8c9dc9bd50c64a58124673cc
SHA256 47d21bdb557a09d2b80016d8d8acc7320ea4f82bc44480043cf90adfa381ee2d
SHA512 248c7cf6b67fc95329982e81a3966718c309f6fd1478792d1336fd5ee7aa90a3b972d0c8a80589e7c9e42cd816568e32f60c42567376b78cb556b10fc8e36dcc

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 efb631a97c4c1e74f5979d4db065c894
SHA1 ba4ddbd98383f95d880657ddb2336c9550434841
SHA256 8a45d393ea977d0ffcffbdcf4471a29e6b8659f47dddccbee562e3d0fd1a7022
SHA512 f98b516c1ff221fcd8e48133dabe3ce7f67ade748b8d190f85252d0be8d6d276d48e7f75a1582cebb5a3fae40eeb6f034fcb850530f344c491158c573acabe13

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 86c18007627ce4601ec53301754c4bf9
SHA1 bdefc07cba14ba8ac6d0dbbe014f09f5e2c82f95
SHA256 fc543d50fae237002fc74eb6397b76c3542e105e0245480f62ebdec0fdd9a37f
SHA512 1adb0265a5fb46cb1d338f508102c41d210087fb298aa35642722a10de47ddd5412bbb1ef326f0d04635d4c4c0e1a5aa97f79f9f4d691a7835fec86a5cabb336

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 a9d409ab95f29248586ac5dad9b4b6d7
SHA1 e4cdf73d859cbac4f6c65274819bb72e2477aba7
SHA256 5c297aa8948457fc0c6dd4f52198a70294203ab431ca396ddc61dbf2a8bd28bc
SHA512 c8690bc56c83e4bdbf992987bfa4abf92371fecc2bf198aeeef846d3d4be635ca0e0a4d76065057c6168ed3b158ca3d84b8fd2c55a490c28877df0adc6e680c1

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 225cb54b9c6ff3526d9c03961837627d
SHA1 aef8264dfa8264e8215a3f23d0868e2e71a1096d
SHA256 68ee655f5cd497637db3e4b3abaae3af7a7172a9b145f967a92520bb882c9ba2
SHA512 b74861c246f8d95d852031a2729b6a250b8b1354dc9c1164385683b6cca85d2bde8e5efb319622fbf5db052cf3e633be0f38fc4cd6a7d1e0a1c9b037f3ffe03e