cybergate | 46cc921ccfa72cd4ba72250d772f224c44d8df905fd7cd18dd3bded468d8e8e8

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-12-2024 02:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
Size

425KB
MD5

dca2f3102d93ac34ff4e7c05ff230369
SHA1

92d757aa9aa48b35fe0e816f37e110521b251fac
SHA256

46cc921ccfa72cd4ba72250d772f224c44d8df905fd7cd18dd3bded468d8e8e8
SHA512

f418a0d55f2022d753ca7346405791ecb4e008e8819dc79a51127acd43f71e93815d590996d1d7d14cccc1c9289d3d3df8766663fd961ece8bacb3a6b6653c0c
SSDEEP

6144:x6BsG/zrxuWBmiiByRFluBW69c0GtUFLtzPDcsEkSmh8Stw+E8PrIrM+NW6o2SW5:IBsG/As6m8Pr4/xS2hdEbA6

Score

10^/10

cybergate vítima discovery stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

2.5

Botnet

vítima

127.0.0.1:81

cynic25.zapto.org:80

Mutex

***MUTEX***

Attributes

enable_keylogger
false
enable_message_box
true
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
Windl
install_file
win32.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Congrats trojan connects to remote pc
message_box_title
yay
password
abcd1234

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate
Cybergate family
cybergate

Executes dropped EXE 1 IoCs

pid	Process
1952	calc.exe

Loads dropped DLL 2 IoCs

pid	Process
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2668-0-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/2668-3-0x0000000024010000-0x0000000024052000-memory.dmp	upx
behavioral1/memory/2668-265-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/1492-444-0x0000000024060000-0x00000000240A2000-memory.dmp	upx
behavioral1/files/0x0031000000016dd0-443.dat	upx
behavioral1/memory/2832-467-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/2668-466-0x0000000000390000-0x00000000003FB000-memory.dmp	upx
behavioral1/memory/2668-723-0x0000000000400000-0x000000000046B000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Windl\win32.exe	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
File opened for modification	C:\Windows\Windl\win32.exe	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
Token: SeDebugPrivilege	2832	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21
PID 2668 wrote to memory of 1204	2668	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	21

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
PID:256

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:332

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:384
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:476
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:600
  - - C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe
      4⤵
      PID:1044
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:1620
  - - C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe -Embedding
      4⤵
      PID:3432
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:684
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:760
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:820
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1164
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:848
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:968
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:108
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:336
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1072
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1108
- - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    3⤵
    PID:816
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:2404
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:2448
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:492
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:500

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:392

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1204
- C:\Users\Admin\AppData\Local\Temp\dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1492
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:572
- - C:\Users\Admin\AppData\Local\Temp\dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2832
  - - C:\Users\Admin\AppData\Local\Temp\calc.exe
      "C:\Users\Admin\AppData\Local\Temp\calc.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

Filesize
312KB

MD5
6279884b1b05300634f439ae1c9ad9b6

SHA1
ccea7647efa324a3651d6a9ce649e554397a8b8e

SHA256
0ada257d6a303c3127244609ae6bcdcf2818bf538d730c88c376eddfb0eda513

SHA512
834659360296dc08a71a0f42ddedea0dc227e6718c77a5526b3a986692de1247ac78999dafbc299854522c031dae94ab4b315ded02bb7f0c307309dd4608a018

Download Submit
C:\Windows\Windl\win32.exe

Filesize
425KB

MD5
dca2f3102d93ac34ff4e7c05ff230369

SHA1
92d757aa9aa48b35fe0e816f37e110521b251fac

SHA256
46cc921ccfa72cd4ba72250d772f224c44d8df905fd7cd18dd3bded468d8e8e8

SHA512
f418a0d55f2022d753ca7346405791ecb4e008e8819dc79a51127acd43f71e93815d590996d1d7d14cccc1c9289d3d3df8766663fd961ece8bacb3a6b6653c0c

Download Submit
\Users\Admin\AppData\Local\Temp\calc.exe

Filesize
112KB

MD5
829e4805b0e12b383ee09abdc9e2dc3c

SHA1
5a272b7441328e09704b6d7eabdbd51b8858fde4

SHA256
37121ecb7c1e112b735bd21b0dfe3e526352ecb98c434c5f40e6a2a582380cdd

SHA512
356fe701e6788c9e4988ee5338c09170311c2013d6b72d7756b7ada5cda44114945f964668feb440d262fb1c0f9ca180549aafd532d169ceeadf435b9899c8f6

Download Submit
memory/1204-4-0x0000000002DF0000-0x0000000002DF1000-memory.dmp

Filesize
4KB

Download
memory/1492-444-0x0000000024060000-0x00000000240A2000-memory.dmp

Filesize
264KB

Download
memory/1492-213-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/1492-205-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download
memory/2668-265-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2668-0-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2668-466-0x0000000000390000-0x00000000003FB000-memory.dmp

Filesize
428KB

Download
memory/2668-723-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2668-3-0x0000000024010000-0x0000000024052000-memory.dmp

Filesize
264KB

Download
memory/2832-467-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download