Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
193s -
max time network
228s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24/11/2022, 00:04
Behavioral task
behavioral1
Sample
d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe
Resource
win7-20221111-en
General
-
Target
d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe
-
Size
276KB
-
MD5
eed6b6a8bfefc17d144e6e26179fa650
-
SHA1
f13ded6ff3f12ee3301ee6e2bb06cc50d7ab5563
-
SHA256
d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940
-
SHA512
06e22381810eca956ef46a0edef6707b3bcfd515b66f36d1071893345657ec55a670120ca2c85937ae9ea006c6b432319ec5a7cdcbef71480b9f7b9fe24a9313
-
SSDEEP
6144:Kk4qmKQpYgh9AATiSbgo1hTslHqSfV0RdoGFSZrZj:V9G9A4prcqjSZ
Malware Config
Extracted
cybergate
2.6
Kurban
connect.cryptr.org:1454
***MUTEX***
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
google
-
install_file
index.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
texto da mensagem
-
message_box_title
tÃtulo da mensagem
-
password
1453
-
regkey_hkcu
Google
-
regkey_hklm
Google
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 3868 index.exe 4696 index.exe -
resource yara_rule behavioral2/memory/2340-132-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/2340-134-0x0000000024010000-0x0000000024072000-memory.dmp upx behavioral2/memory/2340-139-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral2/memory/3528-142-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral2/files/0x000a000000022e01-145.dat upx behavioral2/memory/3528-143-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral2/memory/2340-147-0x00000000240F0000-0x0000000024152000-memory.dmp upx behavioral2/memory/4712-152-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/2340-153-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/4712-157-0x0000000024160000-0x00000000241C2000-memory.dmp upx behavioral2/memory/2340-154-0x0000000024160000-0x00000000241C2000-memory.dmp upx behavioral2/memory/4712-158-0x0000000024160000-0x00000000241C2000-memory.dmp upx behavioral2/memory/3528-159-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral2/memory/2340-160-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/files/0x000a000000022e01-162.dat upx behavioral2/memory/4712-163-0x0000000024160000-0x00000000241C2000-memory.dmp upx behavioral2/files/0x000a000000022e01-165.dat upx behavioral2/memory/4696-166-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/3868-167-0x0000000000400000-0x0000000000457000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google = "C:\\Program Files (x86)\\google\\index.exe" d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Google = "C:\\Program Files (x86)\\google\\index.exe" d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\google\ d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe File created C:\Program Files (x86)\google\index.exe d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe File opened for modification C:\Program Files (x86)\google\index.exe d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe File opened for modification C:\Program Files (x86)\google\index.exe d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 4 IoCs
pid pid_target Process procid_target 928 4696 WerFault.exe 90 3976 3868 WerFault.exe 87 3120 3868 WerFault.exe 87 1032 4696 WerFault.exe 90 -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4712 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4712 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe Token: SeDebugPrivilege 4712 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41 PID 2340 wrote to memory of 964 2340 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 41
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe"C:\Users\Admin\AppData\Local\Temp\d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe"2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵PID:3528
-
C:\Program Files (x86)\google\index.exe"C:\Program Files (x86)\google\index.exe"4⤵
- Executes dropped EXE
PID:3868 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 5725⤵
- Program crash
PID:3976
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 5725⤵
- Program crash
PID:3120
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵PID:3448
-
-
C:\Users\Admin\AppData\Local\Temp\d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe"C:\Users\Admin\AppData\Local\Temp\d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe"3⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4712 -
C:\Program Files (x86)\google\index.exe"C:\Program Files (x86)\google\index.exe"4⤵
- Executes dropped EXE
PID:4696 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 5325⤵
- Program crash
PID:928
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 5325⤵
- Program crash
PID:1032
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3868 -ip 38681⤵PID:1892
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 4696 -ip 46961⤵PID:1580
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
276KB
MD5eed6b6a8bfefc17d144e6e26179fa650
SHA1f13ded6ff3f12ee3301ee6e2bb06cc50d7ab5563
SHA256d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940
SHA51206e22381810eca956ef46a0edef6707b3bcfd515b66f36d1071893345657ec55a670120ca2c85937ae9ea006c6b432319ec5a7cdcbef71480b9f7b9fe24a9313
-
Filesize
276KB
MD5eed6b6a8bfefc17d144e6e26179fa650
SHA1f13ded6ff3f12ee3301ee6e2bb06cc50d7ab5563
SHA256d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940
SHA51206e22381810eca956ef46a0edef6707b3bcfd515b66f36d1071893345657ec55a670120ca2c85937ae9ea006c6b432319ec5a7cdcbef71480b9f7b9fe24a9313
-
Filesize
276KB
MD5eed6b6a8bfefc17d144e6e26179fa650
SHA1f13ded6ff3f12ee3301ee6e2bb06cc50d7ab5563
SHA256d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940
SHA51206e22381810eca956ef46a0edef6707b3bcfd515b66f36d1071893345657ec55a670120ca2c85937ae9ea006c6b432319ec5a7cdcbef71480b9f7b9fe24a9313
-
Filesize
229KB
MD56140e884cd7e3f886ffbb35213545047
SHA12c22704bf7123c2f7daf770db248f814490932ba
SHA256cb593a07369cc9ddcca7bc94b8ad7a7f76773074ebdd048aee3789259bf55c0f
SHA51288a6b1897c00d95f07b204fb5076f8a3f54dcfb583bbce63d703f05b88eaf444353bf5dc865990f14c120d70c8f4c6522cd89797b45fde008c0f9f74374e75d6