Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
169s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23/11/2022, 21:49
Static task
static1
Behavioral task
behavioral1
Sample
f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe
Resource
win10v2004-20220812-en
General
-
Target
f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe
-
Size
281KB
-
MD5
34cc1d20e22310220b73994c25eaa954
-
SHA1
e14dde246b82f989f9aab8010393a213a399c470
-
SHA256
f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9
-
SHA512
32385ffc1ac4becd5e53dab55123ebd564dee4204b78275e8a1ed3e66c0d052029fa6629dc5a7cdf4cdfd4ef517f46a073e92e01d6eb1489f4032f4b56be6655
-
SSDEEP
6144:uVNR1nOabwU+pMtSprmPdrCZUF4tj/xENa7O94TD4yMG:mD1Oab++tSmwZRtj/xEN94wy7
Malware Config
Extracted
cybergate
v1.07.5
NEW-P2P-110425
teddypoisonwide.no-ip.org:2050
127.0.0.1:2050
R4EJ8HN82UXK10
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
csrss.exe
-
install_dir
System
-
install_file
mplay32.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
hedge
-
regkey_hkcu
Multimedia Manager
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\System\\mplay32.exe" f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\System\\mplay32.exe" f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe -
Executes dropped EXE 2 IoCs
pid Process 908 mplay32.exe 1920 mplay32.exe -
resource yara_rule behavioral1/memory/1812-105-0x0000000000340000-0x0000000000387000-memory.dmp upx behavioral1/memory/1812-109-0x0000000000340000-0x0000000000387000-memory.dmp upx behavioral1/memory/1812-110-0x0000000000340000-0x0000000000387000-memory.dmp upx behavioral1/memory/1812-107-0x0000000000340000-0x0000000000387000-memory.dmp upx behavioral1/memory/1812-106-0x0000000000340000-0x0000000000387000-memory.dmp upx behavioral1/memory/1812-113-0x0000000000340000-0x0000000000387000-memory.dmp upx behavioral1/memory/1812-115-0x0000000000340000-0x0000000000387000-memory.dmp upx behavioral1/memory/1812-114-0x0000000000340000-0x0000000000387000-memory.dmp upx behavioral1/memory/1812-111-0x0000000000340000-0x0000000000387000-memory.dmp upx behavioral1/memory/1812-117-0x0000000000340000-0x0000000000387000-memory.dmp upx behavioral1/memory/860-28943-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/860-28947-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/1696-28965-0x0000000010480000-0x00000000104E5000-memory.dmp upx behavioral1/memory/860-28979-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/296-28981-0x0000000010560000-0x00000000105C5000-memory.dmp upx behavioral1/memory/1696-33467-0x0000000010480000-0x00000000104E5000-memory.dmp upx behavioral1/memory/296-34662-0x0000000010560000-0x00000000105C5000-memory.dmp upx behavioral1/memory/1920-57881-0x0000000000400000-0x0000000000456000-memory.dmp upx -
Loads dropped DLL 2 IoCs
pid Process 296 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 296 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\Multimedia Manager = "C:\\Users\\Admin\\AppData\\Roaming\\System\\mplay32.exe" f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1812 set thread context of 860 1812 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 28 PID 908 set thread context of 1920 908 mplay32.exe 33 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 296 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeBackupPrivilege 1696 explorer.exe Token: SeRestorePrivilege 1696 explorer.exe Token: SeBackupPrivilege 296 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe Token: SeRestorePrivilege 296 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe Token: SeDebugPrivilege 296 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe Token: SeDebugPrivilege 296 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1812 wrote to memory of 860 1812 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 28 PID 1812 wrote to memory of 860 1812 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 28 PID 1812 wrote to memory of 860 1812 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 28 PID 1812 wrote to memory of 860 1812 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 28 PID 1812 wrote to memory of 860 1812 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 28 PID 1812 wrote to memory of 860 1812 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 28 PID 1812 wrote to memory of 860 1812 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 28 PID 1812 wrote to memory of 860 1812 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 28 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17 PID 860 wrote to memory of 1244 860 f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe 17
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe"C:\Users\Admin\AppData\Local\Temp\f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe"C:\Users\Admin\AppData\Local\Temp\f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe"3⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1696
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵PID:632
-
-
C:\Users\Admin\AppData\Local\Temp\f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe"C:\Users\Admin\AppData\Local\Temp\f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9.exe"4⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:296 -
C:\Users\Admin\AppData\Roaming\System\mplay32.exe"C:\Users\Admin\AppData\Roaming\System\mplay32.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:908 -
C:\Users\Admin\AppData\Roaming\System\mplay32.exe"C:\Users\Admin\AppData\Roaming\System\mplay32.exe"6⤵
- Executes dropped EXE
PID:1920
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
MD5ccdbb3a838ccf6829738e4e1d734752e
SHA1c2864a17dc0aa344c6f95b0fc5d199fdaaccab7a
SHA256e4f8e67a13763bc79d9c4131b76837d9261b9dba6a5ca3566461f77742271a71
SHA512c6ee357190c0d86b7978dbf023806168297fd574f23d7530e63127367c03244d38192ab2e0aeec1e7a965a9859edc67a9c2d4c06fc2005d89bc33ca235629671
-
Filesize
281KB
MD534cc1d20e22310220b73994c25eaa954
SHA1e14dde246b82f989f9aab8010393a213a399c470
SHA256f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9
SHA51232385ffc1ac4becd5e53dab55123ebd564dee4204b78275e8a1ed3e66c0d052029fa6629dc5a7cdf4cdfd4ef517f46a073e92e01d6eb1489f4032f4b56be6655
-
Filesize
281KB
MD534cc1d20e22310220b73994c25eaa954
SHA1e14dde246b82f989f9aab8010393a213a399c470
SHA256f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9
SHA51232385ffc1ac4becd5e53dab55123ebd564dee4204b78275e8a1ed3e66c0d052029fa6629dc5a7cdf4cdfd4ef517f46a073e92e01d6eb1489f4032f4b56be6655
-
Filesize
281KB
MD534cc1d20e22310220b73994c25eaa954
SHA1e14dde246b82f989f9aab8010393a213a399c470
SHA256f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9
SHA51232385ffc1ac4becd5e53dab55123ebd564dee4204b78275e8a1ed3e66c0d052029fa6629dc5a7cdf4cdfd4ef517f46a073e92e01d6eb1489f4032f4b56be6655
-
Filesize
281KB
MD534cc1d20e22310220b73994c25eaa954
SHA1e14dde246b82f989f9aab8010393a213a399c470
SHA256f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9
SHA51232385ffc1ac4becd5e53dab55123ebd564dee4204b78275e8a1ed3e66c0d052029fa6629dc5a7cdf4cdfd4ef517f46a073e92e01d6eb1489f4032f4b56be6655
-
Filesize
281KB
MD534cc1d20e22310220b73994c25eaa954
SHA1e14dde246b82f989f9aab8010393a213a399c470
SHA256f15135de1e31e302b74253c3d3a4328fb9f443d8905330cc1da749f459add2c9
SHA51232385ffc1ac4becd5e53dab55123ebd564dee4204b78275e8a1ed3e66c0d052029fa6629dc5a7cdf4cdfd4ef517f46a073e92e01d6eb1489f4032f4b56be6655