Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
3s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
24/12/2023, 22:19
Behavioral task
behavioral1
Sample
1533c81b22c38bf7f7e16ac587c91116.exe
Resource
win7-20231129-en
General
-
Target
1533c81b22c38bf7f7e16ac587c91116.exe
-
Size
604KB
-
MD5
1533c81b22c38bf7f7e16ac587c91116
-
SHA1
ab97ab39e34b44f06bba7f4c7a68df83742d4708
-
SHA256
3d74cfe784a7cfebb08ea78ff2c67b673833c3c710931d663444c645d9a5ba48
-
SHA512
a96110db4dde048b95314a1ac653c8c31bff40d96a970dcd8ed016a8772b17a5bc8ad0b3904ea31cb5219b243a4c0512990fb7283444c1862ee7fe1d940393c5
-
SSDEEP
12288:D3DOrVS2k0CIxhNm/74WLap2Q4SAqz2BBx5pD1aqA5nNfmHUv7+0N1R7:D3yrVW09NmDM2/c2BjzD1uNe0vaKR7
Malware Config
Extracted
cybergate
v1.07.5
KinG
7osam.no-ip.biz:1604
07FG30XG66S10O
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
svchost.exe
-
install_dir
install
-
install_file
server.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
123456789
-
regkey_hkcu
Cyber
-
regkey_hklm
Cyber
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 1533c81b22c38bf7f7e16ac587c91116.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" 1533c81b22c38bf7f7e16ac587c91116.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 1533c81b22c38bf7f7e16ac587c91116.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" 1533c81b22c38bf7f7e16ac587c91116.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{6L63005T-Q215-3VB6-6S73-403D1XJL547J} 1533c81b22c38bf7f7e16ac587c91116.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6L63005T-Q215-3VB6-6S73-403D1XJL547J}\StubPath = "C:\\Windows\\system32\\install\\server.exe Restart" 1533c81b22c38bf7f7e16ac587c91116.exe -
resource yara_rule behavioral1/memory/1560-1-0x0000000000400000-0x0000000000590000-memory.dmp upx behavioral1/memory/1560-6-0x0000000000400000-0x0000000000590000-memory.dmp upx behavioral1/memory/668-536-0x0000000010480000-0x00000000104E5000-memory.dmp upx behavioral1/memory/2544-586-0x0000000001DE0000-0x0000000001F70000-memory.dmp upx behavioral1/memory/1384-588-0x0000000000400000-0x0000000000590000-memory.dmp upx behavioral1/memory/1384-845-0x00000000104F0000-0x0000000010555000-memory.dmp upx behavioral1/memory/1932-854-0x0000000000400000-0x0000000000590000-memory.dmp upx behavioral1/memory/1932-875-0x0000000000400000-0x0000000000590000-memory.dmp upx behavioral1/memory/2260-881-0x0000000000400000-0x0000000000590000-memory.dmp upx behavioral1/memory/668-884-0x0000000010480000-0x00000000104E5000-memory.dmp upx behavioral1/memory/1384-1118-0x00000000104F0000-0x0000000010555000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cyber = "C:\\Windows\\system32\\install\\server.exe" 1533c81b22c38bf7f7e16ac587c91116.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Cyber = "C:\\Windows\\system32\\install\\server.exe" 1533c81b22c38bf7f7e16ac587c91116.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\install\server.exe 1533c81b22c38bf7f7e16ac587c91116.exe File opened for modification C:\Windows\SysWOW64\install\server.exe 1533c81b22c38bf7f7e16ac587c91116.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1560 set thread context of 2544 1560 1533c81b22c38bf7f7e16ac587c91116.exe 25 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2544 1533c81b22c38bf7f7e16ac587c91116.exe 2544 1533c81b22c38bf7f7e16ac587c91116.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeBackupPrivilege 668 explorer.exe Token: SeRestorePrivilege 668 explorer.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2544 1533c81b22c38bf7f7e16ac587c91116.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1560 1533c81b22c38bf7f7e16ac587c91116.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1560 wrote to memory of 2544 1560 1533c81b22c38bf7f7e16ac587c91116.exe 25 PID 1560 wrote to memory of 2544 1560 1533c81b22c38bf7f7e16ac587c91116.exe 25 PID 1560 wrote to memory of 2544 1560 1533c81b22c38bf7f7e16ac587c91116.exe 25 PID 1560 wrote to memory of 2544 1560 1533c81b22c38bf7f7e16ac587c91116.exe 25 PID 1560 wrote to memory of 2544 1560 1533c81b22c38bf7f7e16ac587c91116.exe 25 PID 1560 wrote to memory of 2544 1560 1533c81b22c38bf7f7e16ac587c91116.exe 25 PID 1560 wrote to memory of 2544 1560 1533c81b22c38bf7f7e16ac587c91116.exe 25 PID 1560 wrote to memory of 2544 1560 1533c81b22c38bf7f7e16ac587c91116.exe 25 PID 1560 wrote to memory of 2544 1560 1533c81b22c38bf7f7e16ac587c91116.exe 25 PID 1560 wrote to memory of 2544 1560 1533c81b22c38bf7f7e16ac587c91116.exe 25 PID 1560 wrote to memory of 2544 1560 1533c81b22c38bf7f7e16ac587c91116.exe 25 PID 1560 wrote to memory of 2544 1560 1533c81b22c38bf7f7e16ac587c91116.exe 25 PID 1560 wrote to memory of 2544 1560 1533c81b22c38bf7f7e16ac587c91116.exe 25 PID 1560 wrote to memory of 2544 1560 1533c81b22c38bf7f7e16ac587c91116.exe 25 PID 2544 wrote to memory of 1276 2544 1533c81b22c38bf7f7e16ac587c91116.exe 8 PID 2544 wrote to memory of 1276 2544 1533c81b22c38bf7f7e16ac587c91116.exe 8 PID 2544 wrote to memory of 1276 2544 1533c81b22c38bf7f7e16ac587c91116.exe 8 PID 2544 wrote to memory of 1276 2544 1533c81b22c38bf7f7e16ac587c91116.exe 8 PID 2544 wrote to memory of 1276 2544 1533c81b22c38bf7f7e16ac587c91116.exe 8 PID 2544 wrote to memory of 1276 2544 1533c81b22c38bf7f7e16ac587c91116.exe 8 PID 2544 wrote to memory of 1276 2544 1533c81b22c38bf7f7e16ac587c91116.exe 8 PID 2544 wrote to memory of 1276 2544 1533c81b22c38bf7f7e16ac587c91116.exe 8 PID 2544 wrote to memory of 1276 2544 1533c81b22c38bf7f7e16ac587c91116.exe 8 PID 2544 wrote to memory of 1276 2544 1533c81b22c38bf7f7e16ac587c91116.exe 8 PID 2544 wrote to memory of 1276 2544 1533c81b22c38bf7f7e16ac587c91116.exe 8 PID 2544 wrote to memory of 1276 2544 1533c81b22c38bf7f7e16ac587c91116.exe 8 PID 2544 wrote to memory of 1276 2544 1533c81b22c38bf7f7e16ac587c91116.exe 8 PID 2544 wrote to memory of 1276 2544 1533c81b22c38bf7f7e16ac587c91116.exe 8 PID 2544 wrote to memory of 1276 2544 1533c81b22c38bf7f7e16ac587c91116.exe 8 PID 2544 wrote to memory of 1276 2544 1533c81b22c38bf7f7e16ac587c91116.exe 8 PID 2544 wrote to memory of 1276 2544 1533c81b22c38bf7f7e16ac587c91116.exe 8 PID 2544 wrote to memory of 1276 2544 1533c81b22c38bf7f7e16ac587c91116.exe 8 PID 2544 wrote to memory of 1276 2544 1533c81b22c38bf7f7e16ac587c91116.exe 8 PID 2544 wrote to memory of 1276 2544 1533c81b22c38bf7f7e16ac587c91116.exe 8 PID 2544 wrote to memory of 1276 2544 1533c81b22c38bf7f7e16ac587c91116.exe 8 PID 2544 wrote to memory of 1276 2544 1533c81b22c38bf7f7e16ac587c91116.exe 8 PID 2544 wrote to memory of 1276 2544 1533c81b22c38bf7f7e16ac587c91116.exe 8 PID 2544 wrote to memory of 1276 2544 1533c81b22c38bf7f7e16ac587c91116.exe 8 PID 2544 wrote to memory of 1276 2544 1533c81b22c38bf7f7e16ac587c91116.exe 8 PID 2544 wrote to memory of 1276 2544 1533c81b22c38bf7f7e16ac587c91116.exe 8 PID 2544 wrote to memory of 1276 2544 1533c81b22c38bf7f7e16ac587c91116.exe 8 PID 2544 wrote to memory of 1276 2544 1533c81b22c38bf7f7e16ac587c91116.exe 8 PID 2544 wrote to memory of 1276 2544 1533c81b22c38bf7f7e16ac587c91116.exe 8 PID 2544 wrote to memory of 1276 2544 1533c81b22c38bf7f7e16ac587c91116.exe 8 PID 2544 wrote to memory of 1276 2544 1533c81b22c38bf7f7e16ac587c91116.exe 8 PID 2544 wrote to memory of 1276 2544 1533c81b22c38bf7f7e16ac587c91116.exe 8 PID 2544 wrote to memory of 1276 2544 1533c81b22c38bf7f7e16ac587c91116.exe 8 PID 2544 wrote to memory of 1276 2544 1533c81b22c38bf7f7e16ac587c91116.exe 8 PID 2544 wrote to memory of 1276 2544 1533c81b22c38bf7f7e16ac587c91116.exe 8 PID 2544 wrote to memory of 1276 2544 1533c81b22c38bf7f7e16ac587c91116.exe 8 PID 2544 wrote to memory of 1276 2544 1533c81b22c38bf7f7e16ac587c91116.exe 8 PID 2544 wrote to memory of 1276 2544 1533c81b22c38bf7f7e16ac587c91116.exe 8 PID 2544 wrote to memory of 1276 2544 1533c81b22c38bf7f7e16ac587c91116.exe 8 PID 2544 wrote to memory of 1276 2544 1533c81b22c38bf7f7e16ac587c91116.exe 8 PID 2544 wrote to memory of 1276 2544 1533c81b22c38bf7f7e16ac587c91116.exe 8 PID 2544 wrote to memory of 1276 2544 1533c81b22c38bf7f7e16ac587c91116.exe 8 PID 2544 wrote to memory of 1276 2544 1533c81b22c38bf7f7e16ac587c91116.exe 8 PID 2544 wrote to memory of 1276 2544 1533c81b22c38bf7f7e16ac587c91116.exe 8 PID 2544 wrote to memory of 1276 2544 1533c81b22c38bf7f7e16ac587c91116.exe 8 PID 2544 wrote to memory of 1276 2544 1533c81b22c38bf7f7e16ac587c91116.exe 8 PID 2544 wrote to memory of 1276 2544 1533c81b22c38bf7f7e16ac587c91116.exe 8 PID 2544 wrote to memory of 1276 2544 1533c81b22c38bf7f7e16ac587c91116.exe 8 PID 2544 wrote to memory of 1276 2544 1533c81b22c38bf7f7e16ac587c91116.exe 8 PID 2544 wrote to memory of 1276 2544 1533c81b22c38bf7f7e16ac587c91116.exe 8
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\1533c81b22c38bf7f7e16ac587c91116.exe"C:\Users\Admin\AppData\Local\Temp\1533c81b22c38bf7f7e16ac587c91116.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\1533c81b22c38bf7f7e16ac587c91116.exeC:\Users\Admin\AppData\Local\Temp\1533c81b22c38bf7f7e16ac587c91116.exe3⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:668
-
-
C:\Users\Admin\AppData\Local\Temp\1533c81b22c38bf7f7e16ac587c91116.exe"C:\Users\Admin\AppData\Local\Temp\1533c81b22c38bf7f7e16ac587c91116.exe"4⤵PID:1384
-
C:\Windows\SysWOW64\install\server.exe"C:\Windows\system32\install\server.exe"5⤵PID:2260
-
C:\Windows\SysWOW64\install\server.exeC:\Windows\SysWOW64\install\server.exe6⤵PID:1620
-
-
-
-
C:\Windows\SysWOW64\install\server.exe"C:\Windows\system32\install\server.exe"4⤵PID:1932
-
C:\Windows\SysWOW64\install\server.exeC:\Windows\SysWOW64\install\server.exe5⤵PID:536
-
-
-
-