Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2022, 20:53
Static task
static1
Behavioral task
behavioral1
Sample
5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe
Resource
win7-20220812-en
General
-
Target
5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe
-
Size
383KB
-
MD5
001886eaf911b60eb7f4d6a0386ddf52
-
SHA1
4055a42afdc92ea0677de3b5c98f1c50418c2dcd
-
SHA256
5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197
-
SHA512
7b09761698b49ed884640766c203a37be705e326bc5e694405a0e050eadbbe56374aa2b2395009a6ab62389055d2320177501f30247eb84ba973e6276c1b2266
-
SSDEEP
6144:KpNuoZB8CycM3Dssdg2/Cj+UeojKzJzkI89sxLFQslZB0InorWY1KV5PPByWj5xu:yLM3DXdg26jkuKdkI89Rq0EGWlEW9U
Malware Config
Extracted
cybergate
v1.15.3
remote
gazbe.no-ip.biz:82
MHH2YBWUI65A5E
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
server.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
lolalola
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{305HA15F-V2A4-240I-8F3U-MI58E003G7L2} 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{305HA15F-V2A4-240I-8F3U-MI58E003G7L2}\StubPath = "C:\\Windows\\system32\\install\\server.exe Restart" 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{305HA15F-V2A4-240I-8F3U-MI58E003G7L2} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{305HA15F-V2A4-240I-8F3U-MI58E003G7L2}\StubPath = "C:\\Windows\\system32\\install\\server.exe" explorer.exe -
resource yara_rule behavioral2/memory/4648-140-0x0000000010410000-0x0000000010482000-memory.dmp upx behavioral2/memory/4648-145-0x0000000010490000-0x0000000010502000-memory.dmp upx behavioral2/memory/1992-148-0x0000000010490000-0x0000000010502000-memory.dmp upx behavioral2/memory/1992-149-0x0000000010490000-0x0000000010502000-memory.dmp upx behavioral2/memory/4648-153-0x0000000010510000-0x0000000010582000-memory.dmp upx behavioral2/memory/4648-158-0x0000000010590000-0x0000000010602000-memory.dmp upx behavioral2/memory/2252-161-0x0000000010590000-0x0000000010602000-memory.dmp upx behavioral2/memory/2252-162-0x0000000010590000-0x0000000010602000-memory.dmp upx behavioral2/memory/1992-164-0x0000000010490000-0x0000000010502000-memory.dmp upx behavioral2/memory/2252-165-0x0000000010590000-0x0000000010602000-memory.dmp upx -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\server.exe" 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\server.exe" 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\install\server.exe 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe File opened for modification C:\Windows\SysWOW64\install\server.exe 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe File opened for modification C:\Windows\SysWOW64\install\server.exe 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe File opened for modification C:\Windows\SysWOW64\install\ 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3036 set thread context of 4648 3036 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 85 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2252 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeBackupPrivilege 1992 explorer.exe Token: SeRestorePrivilege 1992 explorer.exe Token: SeBackupPrivilege 2252 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe Token: SeRestorePrivilege 2252 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe Token: SeDebugPrivilege 2252 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe Token: SeDebugPrivilege 2252 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3036 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3036 wrote to memory of 4648 3036 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 85 PID 3036 wrote to memory of 4648 3036 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 85 PID 3036 wrote to memory of 4648 3036 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 85 PID 3036 wrote to memory of 4648 3036 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 85 PID 3036 wrote to memory of 4648 3036 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 85 PID 3036 wrote to memory of 4648 3036 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 85 PID 3036 wrote to memory of 4648 3036 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 85 PID 3036 wrote to memory of 4648 3036 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 85 PID 3036 wrote to memory of 4648 3036 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 85 PID 3036 wrote to memory of 4648 3036 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 85 PID 3036 wrote to memory of 4648 3036 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 85 PID 3036 wrote to memory of 4648 3036 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 85 PID 3036 wrote to memory of 4648 3036 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 85 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47 PID 4648 wrote to memory of 2756 4648 5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe 47
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe"C:\Users\Admin\AppData\Local\Temp\5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exeC:\Users\Admin\AppData\Local\Temp\5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe3⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
- Modifies Installed Components in the registry
- Suspicious use of AdjustPrivilegeToken
PID:1992
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵PID:2212
-
-
C:\Users\Admin\AppData\Local\Temp\5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe"C:\Users\Admin\AppData\Local\Temp\5f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197.exe"4⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2252
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
238KB
MD5f14346d1c608bf7e26ec007111cdac85
SHA1036e9d7d23d2ac8795db62c2db239de6f9a4d9a0
SHA2567fae42f8796e1d1a358f78a5fe8e2f4c85e0169fffd40c1f8f11cd6dbe9fcde8
SHA5125b4555086fc1e6ca3a3c3f27c958addff7822653e20cf869878dbad273566e96353779ef7c501bea5dd402e33aa7af430382355c1c0e3bd543d61c45f5301ef6
-
Filesize
383KB
MD5001886eaf911b60eb7f4d6a0386ddf52
SHA14055a42afdc92ea0677de3b5c98f1c50418c2dcd
SHA2565f1e1785ec629e87d8ffcd49e2d05e77c5ce9c4fcb58be3191382ad2251a9197
SHA5127b09761698b49ed884640766c203a37be705e326bc5e694405a0e050eadbbe56374aa2b2395009a6ab62389055d2320177501f30247eb84ba973e6276c1b2266