cybergate | e7e91b96152faa1d08c037da177b7a45d3423688db2c6f30a74d4d473ae1d54c

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
07/12/2024, 02:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
Size

294KB
MD5

d03fca4da489a5254d73c05a87daefa5
SHA1

acc9984e1e8544966bf3703717781c5eb286f23e
SHA256

e7e91b96152faa1d08c037da177b7a45d3423688db2c6f30a74d4d473ae1d54c
SHA512

4ed24fe8296c280b427d346a2d110c5c7747c7f230e1cc110bd4eb41aba5ba76fd7d3128f3f012c009c87d0d3332c0b4585cafbf91cd2de6ee463bda1c48b4d9
SSDEEP

6144:y4XjZEMfH0MYXhrynDPIP9GlmBcPxunGw7MgyZdi3QTFaTy//V:y4XFEuUMYxrSDPI1ymBoYYgyPi3s7

Score

10^/10

cybergate vítima discovery persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

vítima

hackersrm112.no-ip.biz:3460

Mutex

***MUTEX***435435

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
realtek.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
abcd1234
regkey_hkcu
realtek
regkey_hklm
realtek

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate
Cybergate family
cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\install\\realtek.exe"	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\install\\realtek.exe"	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}\StubPath = "C:\\install\\realtek.exe Restart"	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}\StubPath = "C:\\install\\realtek.exe"	explorer.exe

Executes dropped EXE 2 IoCs

pid	Process
528	realtek.exe
2856	realtek.exe

Loads dropped DLL 2 IoCs

pid	Process
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\realtek = "C:\\install\\realtek.exe"	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\realtek = "C:\\install\\realtek.exe"	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2624 set thread context of 2640	2624	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	30
PID 528 set thread context of 2856	528	realtek.exe	35

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2640-3-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral1/memory/2640-5-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral1/memory/2640-8-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral1/memory/2640-9-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral1/memory/2640-10-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral1/memory/2640-315-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral1/memory/960-545-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/2640-879-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral1/memory/2856-3715-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral1/memory/960-3716-0x0000000024080000-0x00000000240E2000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	realtek.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
Token: SeDebugPrivilege	1552	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2624	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
528	realtek.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 2640	2624	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	30
PID 2624 wrote to memory of 2640	2624	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	30
PID 2624 wrote to memory of 2640	2624	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	30
PID 2624 wrote to memory of 2640	2624	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	30
PID 2624 wrote to memory of 2640	2624	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	30
PID 2624 wrote to memory of 2640	2624	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	30
PID 2624 wrote to memory of 2640	2624	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	30
PID 2624 wrote to memory of 2640	2624	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	30
PID 2624 wrote to memory of 2640	2624	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	30
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21
PID 2640 wrote to memory of 1204	2640	d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe	21

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
PID:256

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:332

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:384
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:476
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:592
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:1624
  - - C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe
      4⤵
      PID:1096
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
      4⤵
      PID:5636
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
      4⤵
      PID:4912
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
      4⤵
      PID:5776
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:672
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:764
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:812
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1176
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:852
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:972
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:268
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:352
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1044
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1116
- - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    3⤵
    PID:276
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:2748
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:2864
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:492
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:500

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:396

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1204
- C:\Users\Admin\AppData\Local\Temp\d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2624
- - C:\Users\Admin\AppData\Local\Temp\d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe"
    3⤵
    - Adds policy Run key to start application
    - Boot or Logon Autostart Execution: Active Setup
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2640
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      System Location Discovery: System Language Discovery
      PID:960
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:2208
  - - C:\Users\Admin\AppData\Local\Temp\d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\d03fca4da489a5254d73c05a87daefa5_JaffaCakes118.exe"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:1552
    - - C:\install\realtek.exe
        
        "C:\install\realtek.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:528
      - C:\install\realtek.exe
        
        "C:\install\realtek.exe"
        6⤵
        Executes dropped EXE
        
        PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

Filesize
240KB

MD5
40bd6008a6a8041120882ceea5dc9854

SHA1
0c7987f6d96c51e7665772b6a7e5ea62adbf96a5

SHA256
3ce59a69affa7e4c63255c527c86cda5a5de3e717d5d6afeec7fb28f89df700d

SHA512
21abacdb5e8facaedceb0c90ad3372ba20726a5b23899a0eca5b16be6524730df6f66ae3ac92ecbab574459c54ccf57a3531d71d33165f7ae770128e02f9ae07

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
df8b355b1bde23d3c2c5ee27684f6dfc

SHA1
d6bf11a7a8bf9110fd1f383499a8f6fa9911a605

SHA256
70312fe05cc65f4d08aac38efce4a5d59a3e8993ec14d030d184c069cc14f318

SHA512
26db8a20e15588790e44163d48e6b960d604bf833c7c50e8f350739a54dadf594e4b9d19c62c0f21f9f86319ba60fd70555130fc4fb2298da2e98ef0fd894eab

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
313f01b2ce6aba40bca3223e0ddcaf39

SHA1
b86b648ad971ea76da07224b681ffd8d3dcd9ca8

SHA256
01b03a6ffa96c8890ecc4be04ffcd36e01966c6b461c21cd8d36c01704bd0688

SHA512
d4e78ed47f6fbb34f6c846b8cc9b1be1a52c00faf9d65af9d96673a35c60ff66035d85af692ec57e73c895e51db38f4f4418dbf40f0b8fd593a320c65f03f627

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
769dae09a86df1ced8d9fc40da860846

SHA1
965ec13b70306ba7b747d7eb7c1acfb2512dc111

SHA256
1b85c8cedf77d77a89a7fe12248d678312ed44b660ad12db1bedf3ca49fd9cd8

SHA512
5bff2487bf3b5d331c6f3e228a234f64b4840d20ce67621bd28b490a04169e5a01adf3df008a45294aaff69795e010b3cf95be50c878a354c00e9618303cd1d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
eef934126130450138fe40e6fe058c0b

SHA1
366a1764cc17e22aa9bdbcb9e5edb57ad4edd79e

SHA256
9f58cb06c3621ea54d6a03253fa55e95f3f6c38a8e934dace9c7e89a31df6524

SHA512
d6474f5c7fb1f8fd7c53750b392307cb66bcdcae81add984fa5b9d698f03832610717d24c29d21ae29344b130a0d0e1e5495450dcf9888ca5257bd503eaa3766

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
89c1ab2cf72f1123ed5767b25570a4e2

SHA1
c2071f70ed76fbec3e700679c806b33d7c4c791d

SHA256
3cdeb7bd9e7fdb81620554496843e03a884120e5d255101408a8c968eecb2088

SHA512
612d4decd6583fa697a11189769aeb54d5fbefdb531e6308257e9f2ce32d129ab950de4d107a5c8afa70a48cd65d9e3d2e7efecfd3f4c8c68de06bf92a437c56

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
9262d9bf06a5d6911eacd27d3677767a

SHA1
a6e62c90fff7717a7a73ba4333197c6f8e4e6dbf

SHA256
95ddeddca2a883dff432a8cc38dc8bdd642774559412113755d525c4758f32e1

SHA512
d6860b9f3e0a41ecf9a4e4d938331e6c73fbdc3bee67b223f51c229c4214d9a86f6cc4563ac8788acd7b824351ca5299e84213a80e69931c8d7dc509c710daa3

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
33b196c59439f0238bc394da29629e1d

SHA1
7f1d5f2f09ea3e1b1d6ae2f9de3a713772cea30b

SHA256
efcda7180441fa6fed3bb0d18547587cced910f635f392d558e5fa2f957f8bad

SHA512
c9884cb5affe029ffe08592adca771c9975376f6fa26834d550bb23138c7f1c2dd9224eb58c60c24e81c50bfe1e4faaddff3a20a63bf230b27d1538e0a8fe065

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
88204015cb8002e9c6fef63eb2c2e89c

SHA1
174a48143a6dcdd9909893f707c846f03cb18b0d

SHA256
2572be09d836be73db4ef58c42489d261f87f138b3dd7496406a04e20b101126

SHA512
50eb1945a120e491bea3f67925126132bb0617d25e5ed6c967df0a92d87823422b1b968bfe03f28f587238f60ee54ccc99780509b6079df62c953dd63bd98734

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
5d224ff70342a6483259690cee3a6652

SHA1
4fbaffef87d11808b739f3dbb4795f26ce8d9d01

SHA256
a1ab912757a55e3d76addfc5f575daa7a48bc38fb4e04f03f48d6e0cc61d84ac

SHA512
9cb966fd032122bd1f75e6a1a48a97996f42b9325eb21c54344fb917389c52094d4880f30d0cfd816e025ad0a714470161451f912c6b4660fdc961fce14802ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
0976b2c119cbee93a0f691f634a5dd72

SHA1
15a1d67eba5a5a7a32b6bd03f23ba1fdec71c8c6

SHA256
dfd259f7c6bc966c1d248a1a26b4dd2bb0b62fba634067cb9cd136909ebe9f5e

SHA512
db751b5411b515679723d909d80252d6b421b1a1f9e7578bfa11c9b94003d15beeb9756f309af8863b5e0a79c688ea8979bc9854f4aef9d2c5133cb32d764a86

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
d05193bb4e0a4773d85664b9e8e48972

SHA1
3a359eda7ab208841894beb9b401292ec85a656f

SHA256
3ace79d0fec94772e62a244d8f2edc0acc8b1882d28cedb1bdd26c092f5fe73d

SHA512
bf89dd83f261797c166acb6741a0c7430dc30d9f68f3c4f11f9443752e863d489359ad66e0292aeaf66e4ed6fdfacbf006f4927d34d27a14d8214b9b0ef2889c

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
f5f2f12b7148c40ee243f08844327e51

SHA1
b108a9421d5bb74e1e6a964a604f3aa5a0853ae8

SHA256
2df2cbd74ace8343071b8b31edfb25c9a48f8f474ce35fe01f29dbc1077f10c9

SHA512
a96b4e0f8af416d8cd1037fc91f69c94a8d3aaec61a5ec981b11592043bd927b9942dd6fecaa4e7e76d2942d2154805505afacab43e2a088e6d2475d72a4bfd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
58d6464c5ffdaa321198b998ed928b17

SHA1
783db70b9f6347b29fc074b07f688c36e9b1807d

SHA256
4e496ce70ef60bc7677f560b8cf059c5b677795eb00685ee3e677b5b840936fa

SHA512
c71018d47b9cbdf78ae0745075e818522eba94243e81bf00209029461d49d4e0c6de1db4df094465f87b9a43ba04f0bc481a739152b22d8a0d20979948823b64

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
fd76af9c0d91efeadd918d14a57ae776

SHA1
6738e3e6ebbc954c2e18d420ccdd3b33b00a5ce9

SHA256
b9985fdbe5b340e23dd63acfa7bb412be8368fac999823d631f28da703f6d432

SHA512
101a198a5d0c7d5e6f9b91eb0c87404250bfab3db1b9f63ea263ee53fd2da4f1d5894c67b442f723c4e683f7645ddc39b1c2ce3158ae6793a16bb10d0ad4c930

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
8544a68537e0bd67d9403dce5726d920

SHA1
9684e8bf8444909bc5f752ba63d7e70cfb89bed6

SHA256
28bc00664d811ebc506316452334f9757200c79a90d1ebd2e75ea57a4bd6b07b

SHA512
b2222303160fe4bc17ab68edb089c2d87a3ac03468a8f4777553e97a35e730aeb5e780486aed6c7f8d85f25b2a037e370c36925f2e8169dfc90ec306abfeeb8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
7b828dd7628efddba786dd157cfcc6b4

SHA1
3cf6b8bc60d6a08089a7b537efbd00024a016480

SHA256
7434aa71ebee13c55f4c2e2fc965ec5c7cb558e8a0217c7d1509b076a15e9239

SHA512
f8c5830c40caedf26db84f0ea7479f67b444cd841c3c2ed4cfe2114219b5bfc295748564d484f2e3ea8ae48c3449b166756bbef87cd4b30ce5f4b240cad2b584

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
016d5df476bc1f4c2d7b777c84a91caa

SHA1
ecfdf0b58388dc03b1651d1238838a553066752a

SHA256
e50abdf1510b8349422132d4f6706c91f760d56895bfeb57e213b182d38e1def

SHA512
f87cc15a117640fd773eab7571773f485e2503de1e5dcbcb66190d102b6b6885247c6b7043afe33e8209ba6ea1da63d31ec7fda9a617d346aaf5b814c5c63117

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
160cafce3e837c48d8ba5bb038959235

SHA1
ad1fa4180b45d1778a30347a76b1b7d019defa25

SHA256
90a4ce1f212be7b2624c4123a6349d6282f4da64c764a32dcbb188b4c04b3d9f

SHA512
6dfe92bcfde1497641b92cab0bcc773b23a0d6e2c24cc0630bc02ae2bae015ea5fec6ca6547a647b95538a3068800e0ee9c8264118ef365a48abe2d0b6312b5a

Download Submit
C:\Users\Admin\AppData\Roaming\logs.dat

Filesize
15B

MD5
e21bd9604efe8ee9b59dc7605b927a2a

SHA1
3240ecc5ee459214344a1baac5c2a74046491104

SHA256
51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46

SHA512
42052ad5744ad76494bfa71d78578e545a3b39bfed4c4232592987bd28064b6366a423084f1193d137493c9b13d9ae1faac4cf9cc75eb715542fa56e13ca1493

Download Submit
C:\install\realtek.exe

Filesize
294KB

MD5
d03fca4da489a5254d73c05a87daefa5

SHA1
acc9984e1e8544966bf3703717781c5eb286f23e

SHA256
e7e91b96152faa1d08c037da177b7a45d3423688db2c6f30a74d4d473ae1d54c

SHA512
4ed24fe8296c280b427d346a2d110c5c7747c7f230e1cc110bd4eb41aba5ba76fd7d3128f3f012c009c87d0d3332c0b4585cafbf91cd2de6ee463bda1c48b4d9

Download Submit
memory/528-968-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/528-916-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/960-3716-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/960-545-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/960-259-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download
memory/960-257-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/1204-14-0x0000000002620000-0x0000000002621000-memory.dmp

Filesize
4KB

Download
memory/1552-914-0x0000000004D80000-0x0000000004D87000-memory.dmp

Filesize
28KB

Download
memory/1552-570-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1552-915-0x0000000004D80000-0x0000000004D87000-memory.dmp

Filesize
28KB

Download
memory/1552-3717-0x0000000004D80000-0x0000000004D87000-memory.dmp

Filesize
28KB

Download
memory/2624-7-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2624-0-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2640-569-0x0000000000220000-0x0000000000227000-memory.dmp

Filesize
28KB

Download
memory/2640-879-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2640-315-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2640-10-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2640-9-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2640-8-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2640-5-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2640-3-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2856-3715-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download