Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    153s
  • max time network
    81s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    01/10/2022, 20:01

General

  • Target

    5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe

  • Size

    540KB

  • MD5

    60ac1843cc126d243721e7739f704bbf

  • SHA1

    acf60750c5e5aa79759c26e6b2cbb1e573181dcf

  • SHA256

    5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076

  • SHA512

    63b000df53636ae9c83fcf345e4f293a22a16a49bd79291d5ae794b71286c635658e82f2e2394032a95aa6abf438ad79d9d145e26d1b0ba060f597c314119acd

  • SSDEEP

    12288:SCeZPb6rNio2MY+c2TlbRcdTgioCL2oK764d5o0R6CUqxtKUlR:fRcd0ioCLUv/o0R6C5xtr/

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

Server

C2

panik0.no-ip.org:2000

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    spynet

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Executes dropped EXE 3 IoCs
  • UPX packed file 22 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1192
      • C:\Users\Admin\AppData\Local\Temp\5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe
        "C:\Users\Admin\AppData\Local\Temp\5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1992
        • C:\Users\Admin\AppData\Local\Temp\5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe
          C:\Users\Admin\AppData\Local\Temp\5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe
          3⤵
          • Suspicious use of SetThreadContext
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1972
          • C:\Users\Admin\AppData\Local\Temp\5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe
            C:\Users\Admin\AppData\Local\Temp\5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe
            4⤵
            • Adds policy Run key to start application
            • Adds Run key to start application
            • Drops file in System32 directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:1700
            • C:\Windows\SysWOW64\explorer.exe
              explorer.exe
              5⤵
                PID:1224
              • C:\Program Files\Internet Explorer\iexplore.exe
                "C:\Program Files\Internet Explorer\iexplore.exe"
                5⤵
                  PID:2036
                • C:\Users\Admin\AppData\Local\Temp\5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe
                  "C:\Users\Admin\AppData\Local\Temp\5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe"
                  5⤵
                  • Loads dropped DLL
                  • Drops file in System32 directory
                  • Suspicious behavior: GetForegroundWindowSpam
                  • Suspicious use of AdjustPrivilegeToken
                  PID:584
                  • C:\Windows\SysWOW64\spynet\server.exe
                    "C:\Windows\system32\spynet\server.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Suspicious use of SetWindowsHookEx
                    PID:1608
                    • C:\Windows\SysWOW64\spynet\server.exe
                      C:\Windows\SysWOW64\spynet\server.exe
                      7⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Suspicious use of SetWindowsHookEx
                      PID:968
                      • C:\Windows\SysWOW64\spynet\server.exe
                        C:\Windows\SysWOW64\spynet\server.exe
                        8⤵
                        • Executes dropped EXE
                        • Suspicious behavior: EnumeratesProcesses
                        PID:1976

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

          Filesize

          229KB

          MD5

          901f5657426558bb410202051200b4b5

          SHA1

          afaf3894559ca2e2ed62fd167e7b4eba9308f5fd

          SHA256

          0ac9ee60047d3c862fdfdf6083e8f7a7feeb4018aeef4fa1ed33f45fd232d3e5

          SHA512

          58b31b09f76d7f0079103488d1c99d995d25df4d881870fef295633880dad435f58f0c619b5e1749002fb90ad6c7f5deab870237da4289b1cd9a8e8f730a116a

        • C:\Users\Admin\AppData\Local\Temp\who.txt

          Filesize

          201B

          MD5

          e6931696a293309856fb0dd79a26045c

          SHA1

          b6f2396760a0c592340aa99008af3619a6130410

          SHA256

          01be0c5471962da7687728f5a063a5857bf5203f9813e81a0fb23ef4dca87dda

          SHA512

          9044829afccf78533e13f1d241392ee650702acd70e48d5376384a0d49c89999df93442115eccc4f6fb625d27733b0fa8c3c7292001c6a6558a4fd8be5825a66

        • C:\Windows\SysWOW64\spynet\server.exe

          Filesize

          540KB

          MD5

          60ac1843cc126d243721e7739f704bbf

          SHA1

          acf60750c5e5aa79759c26e6b2cbb1e573181dcf

          SHA256

          5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076

          SHA512

          63b000df53636ae9c83fcf345e4f293a22a16a49bd79291d5ae794b71286c635658e82f2e2394032a95aa6abf438ad79d9d145e26d1b0ba060f597c314119acd

        • C:\Windows\SysWOW64\spynet\server.exe

          Filesize

          540KB

          MD5

          60ac1843cc126d243721e7739f704bbf

          SHA1

          acf60750c5e5aa79759c26e6b2cbb1e573181dcf

          SHA256

          5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076

          SHA512

          63b000df53636ae9c83fcf345e4f293a22a16a49bd79291d5ae794b71286c635658e82f2e2394032a95aa6abf438ad79d9d145e26d1b0ba060f597c314119acd

        • C:\Windows\SysWOW64\spynet\server.exe

          Filesize

          540KB

          MD5

          60ac1843cc126d243721e7739f704bbf

          SHA1

          acf60750c5e5aa79759c26e6b2cbb1e573181dcf

          SHA256

          5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076

          SHA512

          63b000df53636ae9c83fcf345e4f293a22a16a49bd79291d5ae794b71286c635658e82f2e2394032a95aa6abf438ad79d9d145e26d1b0ba060f597c314119acd

        • C:\Windows\SysWOW64\spynet\server.exe

          Filesize

          540KB

          MD5

          60ac1843cc126d243721e7739f704bbf

          SHA1

          acf60750c5e5aa79759c26e6b2cbb1e573181dcf

          SHA256

          5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076

          SHA512

          63b000df53636ae9c83fcf345e4f293a22a16a49bd79291d5ae794b71286c635658e82f2e2394032a95aa6abf438ad79d9d145e26d1b0ba060f597c314119acd

        • \Windows\SysWOW64\spynet\server.exe

          Filesize

          540KB

          MD5

          60ac1843cc126d243721e7739f704bbf

          SHA1

          acf60750c5e5aa79759c26e6b2cbb1e573181dcf

          SHA256

          5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076

          SHA512

          63b000df53636ae9c83fcf345e4f293a22a16a49bd79291d5ae794b71286c635658e82f2e2394032a95aa6abf438ad79d9d145e26d1b0ba060f597c314119acd

        • \Windows\SysWOW64\spynet\server.exe

          Filesize

          540KB

          MD5

          60ac1843cc126d243721e7739f704bbf

          SHA1

          acf60750c5e5aa79759c26e6b2cbb1e573181dcf

          SHA256

          5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076

          SHA512

          63b000df53636ae9c83fcf345e4f293a22a16a49bd79291d5ae794b71286c635658e82f2e2394032a95aa6abf438ad79d9d145e26d1b0ba060f597c314119acd

        • memory/584-112-0x0000000024160000-0x00000000241C2000-memory.dmp

          Filesize

          392KB

        • memory/584-110-0x0000000024160000-0x00000000241C2000-memory.dmp

          Filesize

          392KB

        • memory/584-146-0x0000000024160000-0x00000000241C2000-memory.dmp

          Filesize

          392KB

        • memory/968-139-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/1192-83-0x0000000024010000-0x0000000024072000-memory.dmp

          Filesize

          392KB

        • memory/1224-144-0x0000000024080000-0x00000000240E2000-memory.dmp

          Filesize

          392KB

        • memory/1224-95-0x0000000024080000-0x00000000240E2000-memory.dmp

          Filesize

          392KB

        • memory/1224-94-0x0000000024080000-0x00000000240E2000-memory.dmp

          Filesize

          392KB

        • memory/1224-88-0x0000000074C81000-0x0000000074C83000-memory.dmp

          Filesize

          8KB

        • memory/1700-105-0x0000000024160000-0x00000000241C2000-memory.dmp

          Filesize

          392KB

        • memory/1700-66-0x0000000000400000-0x0000000000457000-memory.dmp

          Filesize

          348KB

        • memory/1700-97-0x00000000240F0000-0x0000000024152000-memory.dmp

          Filesize

          392KB

        • memory/1700-78-0x0000000000400000-0x0000000000457000-memory.dmp

          Filesize

          348KB

        • memory/1700-77-0x0000000000400000-0x0000000000457000-memory.dmp

          Filesize

          348KB

        • memory/1700-76-0x0000000000400000-0x0000000000457000-memory.dmp

          Filesize

          348KB

        • memory/1700-80-0x0000000024010000-0x0000000024072000-memory.dmp

          Filesize

          392KB

        • memory/1700-75-0x0000000076141000-0x0000000076143000-memory.dmp

          Filesize

          8KB

        • memory/1700-67-0x0000000000400000-0x0000000000457000-memory.dmp

          Filesize

          348KB

        • memory/1700-74-0x0000000000400000-0x0000000000457000-memory.dmp

          Filesize

          348KB

        • memory/1700-111-0x0000000000400000-0x0000000000457000-memory.dmp

          Filesize

          348KB

        • memory/1700-70-0x0000000000400000-0x0000000000457000-memory.dmp

          Filesize

          348KB

        • memory/1700-89-0x0000000024080000-0x00000000240E2000-memory.dmp

          Filesize

          392KB

        • memory/1700-69-0x0000000000400000-0x0000000000457000-memory.dmp

          Filesize

          348KB

        • memory/1972-56-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/1972-73-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/1972-61-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/1972-59-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/1972-57-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/1976-142-0x0000000000400000-0x0000000000457000-memory.dmp

          Filesize

          348KB

        • memory/1976-141-0x0000000000400000-0x0000000000457000-memory.dmp

          Filesize

          348KB

        • memory/1976-143-0x0000000000400000-0x0000000000457000-memory.dmp

          Filesize

          348KB

        • memory/1976-145-0x0000000000400000-0x0000000000457000-memory.dmp

          Filesize

          348KB