cybergate | 46cc921ccfa72cd4ba72250d772f224c44d8df905fd7cd18dd3bded468d8e8e8

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10-12-2024 02:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
Size

425KB
MD5

dca2f3102d93ac34ff4e7c05ff230369
SHA1

92d757aa9aa48b35fe0e816f37e110521b251fac
SHA256

46cc921ccfa72cd4ba72250d772f224c44d8df905fd7cd18dd3bded468d8e8e8
SHA512

f418a0d55f2022d753ca7346405791ecb4e008e8819dc79a51127acd43f71e93815d590996d1d7d14cccc1c9289d3d3df8766663fd961ece8bacb3a6b6653c0c
SSDEEP

6144:x6BsG/zrxuWBmiiByRFluBW69c0GtUFLtzPDcsEkSmh8Stw+E8PrIrM+NW6o2SW5:IBsG/As6m8Pr4/xS2hdEbA6

Score

10^/10

cybergate vítima discovery stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

2.5

Botnet

vítima

127.0.0.1:81

cynic25.zapto.org:80

Mutex

***MUTEX***

Attributes

enable_keylogger
false
enable_message_box
true
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
Windl
install_file
win32.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Congrats trojan connects to remote pc
message_box_title
yay
password
abcd1234

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate
Cybergate family
cybergate

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
1504	calc.exe

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3576-0-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral2/memory/3576-4-0x0000000024010000-0x0000000024052000-memory.dmp	upx
behavioral2/memory/3576-24-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral2/memory/3576-56-0x0000000024060000-0x00000000240A2000-memory.dmp	upx
behavioral2/memory/2188-61-0x0000000024060000-0x00000000240A2000-memory.dmp	upx
behavioral2/files/0x000b000000023b8f-63.dat	upx
behavioral2/memory/2188-60-0x0000000024060000-0x00000000240A2000-memory.dmp	upx
behavioral2/memory/3576-64-0x00000000240B0000-0x00000000240F2000-memory.dmp	upx
behavioral2/memory/3576-68-0x0000000024100000-0x0000000024142000-memory.dmp	upx
behavioral2/memory/3576-65-0x00000000240B0000-0x00000000240F2000-memory.dmp	upx
behavioral2/memory/1568-73-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral2/memory/3576-123-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral2/memory/1568-122-0x0000000024100000-0x0000000024142000-memory.dmp	upx
behavioral2/memory/2188-481-0x0000000024060000-0x00000000240A2000-memory.dmp	upx
behavioral2/memory/1568-525-0x0000000024100000-0x0000000024142000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Windl\win32.exe	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
File opened for modification	C:\Windows\Windl\win32.exe	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
Token: SeDebugPrivilege	1568	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56
PID 3576 wrote to memory of 3516	3576	dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe	56

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:616
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:784
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:332

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:672

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:804
- C:\Windows\system32\wbem\unsecapp.exe
  C:\Windows\system32\wbem\unsecapp.exe -Embedding
  2⤵
  PID:3144
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3816
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3904
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3972
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:4056
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4120
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:3496
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:968
- C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
  2⤵
  PID:216
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4712
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:5104
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:2796
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:2176
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
  2⤵
  PID:1352
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:5100
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:1436
- C:\Windows\System32\mousocoreworker.exe
  C:\Windows\System32\mousocoreworker.exe -Embedding
  2⤵
  PID:3304
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:1328
- C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
  C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
  2⤵
  PID:2204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:392

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1044

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1148
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2748

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1464
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1496

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1640

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1668

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1716

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1784

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1792

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:1388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1384

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1012

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2156

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2212

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2812

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2836

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3416

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3516
- C:\Users\Admin\AppData\Local\Temp\dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3576
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2188
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:516
- - C:\Users\Admin\AppData\Local\Temp\dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\dca2f3102d93ac34ff4e7c05ff230369_JaffaCakes118.exe"
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1568
  - - C:\Users\Admin\AppData\Local\Temp\calc.exe
      "C:\Users\Admin\AppData\Local\Temp\calc.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4904

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:3752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:1360

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:3588

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:4036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:2556

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 24756672e8c2921e1dc46e349c90fc97 naF0KwJ53UWk1wxnogVv9Q.0.1.0.0.0
1⤵
PID:3004
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:3724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:1136

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:1516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:3700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\UuU.uUu

Filesize
8B

MD5
ef8030df2575ebd019db173093044eed

SHA1
bc2113050d1ce27ec30736108927c6663349875f

SHA256
f8a70b1b76525ee717cc66ff304a058dbfd6e32c8e822d1d496d1f336f6815a6

SHA512
b7c9fa77c741fbd8e95491f23d0adce24122bd3a2bfc47ebe524e4f0b16e728517b98349c2f1c6f6da5dbebe6db4d9ff7d07983ee91d6376d1d089227b2030cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

Filesize
312KB

MD5
6279884b1b05300634f439ae1c9ad9b6

SHA1
ccea7647efa324a3651d6a9ce649e554397a8b8e

SHA256
0ada257d6a303c3127244609ae6bcdcf2818bf538d730c88c376eddfb0eda513

SHA512
834659360296dc08a71a0f42ddedea0dc227e6718c77a5526b3a986692de1247ac78999dafbc299854522c031dae94ab4b315ded02bb7f0c307309dd4608a018

Download Submit
C:\Users\Admin\AppData\Local\Temp\calc.exe

Filesize
112KB

MD5
829e4805b0e12b383ee09abdc9e2dc3c

SHA1
5a272b7441328e09704b6d7eabdbd51b8858fde4

SHA256
37121ecb7c1e112b735bd21b0dfe3e526352ecb98c434c5f40e6a2a582380cdd

SHA512
356fe701e6788c9e4988ee5338c09170311c2013d6b72d7756b7ada5cda44114945f964668feb440d262fb1c0f9ca180549aafd532d169ceeadf435b9899c8f6

Download Submit
C:\Windows\Windl\win32.exe

Filesize
425KB

MD5
dca2f3102d93ac34ff4e7c05ff230369

SHA1
92d757aa9aa48b35fe0e816f37e110521b251fac

SHA256
46cc921ccfa72cd4ba72250d772f224c44d8df905fd7cd18dd3bded468d8e8e8

SHA512
f418a0d55f2022d753ca7346405791ecb4e008e8819dc79a51127acd43f71e93815d590996d1d7d14cccc1c9289d3d3df8766663fd961ece8bacb3a6b6653c0c

Download Submit
memory/1568-525-0x0000000024100000-0x0000000024142000-memory.dmp

Filesize
264KB

Download
memory/1568-122-0x0000000024100000-0x0000000024142000-memory.dmp

Filesize
264KB

Download
memory/1568-73-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2188-61-0x0000000024060000-0x00000000240A2000-memory.dmp

Filesize
264KB

Download
memory/2188-481-0x0000000024060000-0x00000000240A2000-memory.dmp

Filesize
264KB

Download
memory/2188-59-0x0000000003210000-0x0000000003211000-memory.dmp

Filesize
4KB

Download
memory/2188-60-0x0000000024060000-0x00000000240A2000-memory.dmp

Filesize
264KB

Download
memory/2188-8-0x0000000000750000-0x0000000000751000-memory.dmp

Filesize
4KB

Download
memory/2188-9-0x0000000000A10000-0x0000000000A11000-memory.dmp

Filesize
4KB

Download
memory/3576-56-0x0000000024060000-0x00000000240A2000-memory.dmp

Filesize
264KB

Download
memory/3576-65-0x00000000240B0000-0x00000000240F2000-memory.dmp

Filesize
264KB

Download
memory/3576-123-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/3576-68-0x0000000024100000-0x0000000024142000-memory.dmp

Filesize
264KB

Download
memory/3576-64-0x00000000240B0000-0x00000000240F2000-memory.dmp

Filesize
264KB

Download
memory/3576-0-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/3576-24-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/3576-4-0x0000000024010000-0x0000000024052000-memory.dmp

Filesize
264KB

Download