Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/07/2024, 07:34

General

  • Target

    383aeed2e83a9dd3d763d49f264e8586_JaffaCakes118.exe

  • Size

    353KB

  • MD5

    383aeed2e83a9dd3d763d49f264e8586

  • SHA1

    ea939564943e4cd1596871aaaba6e19f8655c54d

  • SHA256

    c067afb7d8acc54803d8b95d4f248afd69a5a4b97031f3a8894bdd34188710b8

  • SHA512

    43fe2e87db59339a87ca26fbe1afeb2eb94659009733f74bf51ae9760e2f09ee5fe0c8fa63fd9c55a09f52bdf65517d349fcb958a70da961afea944f793ad7d5

  • SSDEEP

    6144:CgqZlrSBVNenXrl4s30fkAzoydo263nvAlYRsBEZTfmStIZ8xQYl:KlfxL08A3o26YORKE95IZQQ

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

Cyber

C2

bc4l.No-ip.biz:100

Mutex

1P23V20HIP64ND

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    SearchIndexer.exe

  • install_dir

    System32

  • install_file

    SearchIndexer.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    123456

  • regkey_hkcu

    SearchIndexer.exe

  • regkey_hklm

    SearchIndexer.exe

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3520
      • C:\Users\Admin\AppData\Local\Temp\383aeed2e83a9dd3d763d49f264e8586_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\383aeed2e83a9dd3d763d49f264e8586_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:3916
        • C:\Users\Admin\AppData\Local\Temp\383aeed2e83a9dd3d763d49f264e8586_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\383aeed2e83a9dd3d763d49f264e8586_JaffaCakes118.exe"
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3296
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Suspicious use of AdjustPrivilegeToken
            PID:4592
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:3320
            • C:\Users\Admin\AppData\Local\Temp\383aeed2e83a9dd3d763d49f264e8586_JaffaCakes118.exe
              "C:\Users\Admin\AppData\Local\Temp\383aeed2e83a9dd3d763d49f264e8586_JaffaCakes118.exe"
              4⤵
              • Checks computer location settings
              • Modifies registry class
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:1136
              • C:\Users\Admin\AppData\Roaming\System32\SearchIndexer.exe
                "C:\Users\Admin\AppData\Roaming\System32\SearchIndexer.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:880
                • C:\Users\Admin\AppData\Roaming\System32\SearchIndexer.exe
                  "C:\Users\Admin\AppData\Roaming\System32\SearchIndexer.exe"
                  6⤵
                  • Executes dropped EXE
                  PID:3276
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 564
                    7⤵
                    • Program crash
                    PID:2000
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3276 -ip 3276
        1⤵
          PID:4492

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\Admin2.txt

          Filesize

          225KB

          MD5

          2cc66bf5cedf7e323626b64904484964

          SHA1

          4fd0084b192754435d9e07d2b3a426ed7def5b6b

          SHA256

          ce49bbda2970dd3641702ba09f8b7cf23aee2751eb997d795db27d0a83a3ab22

          SHA512

          e4fe333c77371a368eed6ecb0f96e25d9d875e8e7a7ed37088a85cccd2e91063d2323e9481ba19eb3b0c6b0003cbb5194c9fbebca6bbd4615cd46bd2ffee2c80

        • C:\Users\Admin\AppData\Local\Temp\Admin7

          Filesize

          8B

          MD5

          35b9f533020343243f78828c86444d82

          SHA1

          09233aadf8a759bf5adaf5032ba72a8eac27f30d

          SHA256

          8f8c13d18c5992c426917858075a77b0763c0c36e98f42d79394db6687e95548

          SHA512

          2521a93eecb09bc5e862c3e890ccd57aa75ecff631a514413d9b5ae0fff92dd549e70ae21a91d5ed857b4987633ff697b9f325e72199ea99d5302791fc41f26e

        • C:\Users\Admin\AppData\Local\Temp\Admin7

          Filesize

          8B

          MD5

          d639c4631bfe304ea6e3a748f36bbdaa

          SHA1

          2118d7e860c7960cddc00cda7b602dd06d437a9a

          SHA256

          f63210190a1385143dfa001d5c4d181535379146a00111867749c2a03191ba8c

          SHA512

          5f8d4d3d14e709ee570d2ddcc06854a1105f3bee4c918d7466debd4742fcfceab811c495e6f82793859754a1fe93c8a59c649f29ea8cce5dac17d464ae14e440

        • C:\Users\Admin\AppData\Local\Temp\Admin7

          Filesize

          8B

          MD5

          fba55021de48e88e0585657b492e11b8

          SHA1

          b45a23cad792970b5b1f25c69233c190d0c7472d

          SHA256

          857d97ab25e7cc8d6963b15059438c6665375ed253314594d87c1988a2a21473

          SHA512

          ed73a6d8b82f11b7991333ac3ff8a101e0012b10c21223c9e0a0a9b2202335a5f1607b6e418eef4ba5085fd1c3d40810039ba2e800af8fd394a6129d8f037d20

        • C:\Users\Admin\AppData\Local\Temp\Admin7

          Filesize

          8B

          MD5

          1f0a6912c0a40789658c0b10f45f38a5

          SHA1

          4b2dc0f67d001e0d23698766b0302d8125c43d62

          SHA256

          2edeb8f09ee69cb66a4270444acb103163ad724e74ed841ee86bc31a2d51aa65

          SHA512

          54d923c69042e9c88fbfda96bcc4390461e15e9ace888b83749eba42486cf258fb5f77262202d9f1cdcf3fbeb3a3427f736ea5e88a2b3625376d32d7257086c8

        • C:\Users\Admin\AppData\Local\Temp\Admin7

          Filesize

          8B

          MD5

          6c72f82b61a7bc45546d0353ebac7c55

          SHA1

          b48bbe193d21d69a009a6dc049857d0e3aa95290

          SHA256

          5b51be3996f9d0a281ccc33a2a344ec8b74cbfe8b82f2f0bec9cd0f86d42ed2e

          SHA512

          f979bfd2e90131620dc01cd5ca9a3ce4b737db3b5933753143272e22ff01ce689fbefcf57d06e867e31a49c45bae0510173ad655c7ba3850a78af094942f9fa9

        • C:\Users\Admin\AppData\Local\Temp\Admin7

          Filesize

          8B

          MD5

          d0078720bbe9a3f2f7bdc4a61af43a01

          SHA1

          b4339afa86e4e6027406b548a0f6797f87884d31

          SHA256

          40a3d1a98dfd9c25aabd20de6048dda7d170ea4b42b990e7746bc6eb967eec76

          SHA512

          cf7635baf648ad3be5aa4a18e8f9302345c8b28f843702e0e0bdc2c37087988af07ca32597cd0562d118a25efa62b6a4f40ddb867d0d7efabaeef1ac8f43c703

        • C:\Users\Admin\AppData\Local\Temp\Admin7

          Filesize

          8B

          MD5

          f30711d2f772a6780437eddd402d14d7

          SHA1

          f0059cd49615335bb80373cbb897e8ac1c1e082e

          SHA256

          af778e2816bf06d7f07e6be4895381436fe737cc62c410db1062013ace449631

          SHA512

          b8e3d16851dd3cd90d51a503ceca449d57248960e6478e66d23a52bd58b06083d170f6617090b1961063043fa1d73bc2133e464e11a2b822e88247aaeab8c16b

        • C:\Users\Admin\AppData\Local\Temp\Admin7

          Filesize

          8B

          MD5

          cff204f60180ba705ebfe22c873a302f

          SHA1

          8be4b58c24830d8c8859f49b2ca8409b5c49c1e1

          SHA256

          af0d4585217b21b297ad713948ccb403e99ae90b9341a82b8edd7f3f2697d143

          SHA512

          0480f312055238d959d072af78dcd47bb03dc4a9bd233b4bf66a78077fdde2a5d9dd2277b19931b5a446f6f25330b06882fc59ba4328574329c1695631488a1c

        • C:\Users\Admin\AppData\Local\Temp\Admin7

          Filesize

          8B

          MD5

          ca89b37dec3654fb71b0029dd01c7634

          SHA1

          98609a8826c6069943127777e34c1e6e95e95250

          SHA256

          ab7f3af6e8d016893edb3f0ed4e19a9e832b9763e25bcd52b2d7d8ff41a39349

          SHA512

          ea7bea0e2c8ff13f6a3b7ffac6c63390483f91d61acc2a230b4fe455ea29308f048ae64e7ca700092dc5be22c4464cf35ab39c352296274ad3f42e2a62636fb5

        • C:\Users\Admin\AppData\Local\Temp\Admin7

          Filesize

          8B

          MD5

          22d39105d4f8534db9ce8d777cdaddca

          SHA1

          002510f2a94dd080040062966bf63447e5dbf24e

          SHA256

          9b31f2b5bdf5a8e132f769014ec57a9750dda0862d832053b8d182df8dfbc792

          SHA512

          955be96b15b29713f92e9f1de690a7ec9cd7dcee99d5e432bf8fccb68f341642f26eb4df76c525c1299ac81d56fbfabb575c9ba3646fe2e99b5eb93347e90ae6

        • C:\Users\Admin\AppData\Local\Temp\Admin7

          Filesize

          8B

          MD5

          ed75cbd08779ed213d084b913ced4c1a

          SHA1

          de45e02af12fca65cc823b6de00a6fca2d2a8c47

          SHA256

          00344e8206859083535f5f2b43d7ea95dc90306ba36a4c0f76bf8c2909a3ebf7

          SHA512

          748ef50873b16f3354a62ec0064640ae9182870d1c6e6e710565939e6d159d6480e6eb7188b97b0f0b2cd09c3aeb39dec5e63c65c6161b7f34dcd80bb9641ed1

        • C:\Users\Admin\AppData\Local\Temp\Admin7

          Filesize

          8B

          MD5

          39bd1a349e12f19973b4700f1292d3b3

          SHA1

          94a0e14c73f47e5c65567e9a8432f91bcdd87eee

          SHA256

          540f33383a96d8f7d8b8ece4ffafb23c33b3273eb77184133f24ea4c2c593272

          SHA512

          292f036793dfcb30a8f74828c7d595de6b342caadbc45f14680dda8243415f1cf1bb6ba822b0a292ede8c6786bfae7b034c74065f941dd1e6d3af40101316241

        • C:\Users\Admin\AppData\Local\Temp\Admin7

          Filesize

          8B

          MD5

          55dbe6ded5d1f0e50f8a23cefd9ea320

          SHA1

          85b1cb7d617613619b892c56d072417b91542a37

          SHA256

          80e2509755d7caaee7b242930f4f9529ad9d991ed594aa5b1929560928201bf3

          SHA512

          5f62c18c1c165e510c00251cf24c70de83f17fc65046d125429937c03b241857a014dc5efc94ecb4f3bb94cd39749090a6008d82d0485e6132a2b83ba4e72c45

        • C:\Users\Admin\AppData\Local\Temp\Admin7

          Filesize

          8B

          MD5

          6b5ac2477337d24c335036f74c0ca70d

          SHA1

          a02d4c07bc0ca329c0db7af75d173f5cb6531c51

          SHA256

          b0da5cfdb583f482845101a7f967cfbd6c024e7657f9289d73c92a8700d0f80d

          SHA512

          afdc042b7d82259d7d27b22394cd89e4bdc67897fe5ffd4f1cefdcf3e5b49d4bfbbb2e8a27bc765fe9e42f9c6d2d2443ccf9171f3ab0482700423cc461113a38

        • C:\Users\Admin\AppData\Local\Temp\Admin7

          Filesize

          8B

          MD5

          1cefa47926de11106635fe1d5061c2dc

          SHA1

          b35967643f512559a7ab691abd516ad116869c19

          SHA256

          1c9c4b245143cb3601d04849d8c8742975e6a951bc849f1267501353b16e06c2

          SHA512

          66dcfc0a87c2b963d6c874ea647efe2e409288aefc85ba22938cbbeda4d1b5a041420210607382922fa2a94fefd60f05f06ebca470ab1e28e6bda93cd64fbeaf

        • C:\Users\Admin\AppData\Local\Temp\Admin7

          Filesize

          8B

          MD5

          dc09d3f1590506e51195a10bdcd6b891

          SHA1

          83bbab5baa7701d8b6290d6a0e9ccd018ece7ab2

          SHA256

          e850cdb7ca31ae15e1a6e8e657933d279e3572e2726aeaed4f00e3dde8b74649

          SHA512

          0d7677c1c46d30801fb36454ce993385b7b1fe3de4f7584b54a5b8c5c9c51215c9271877ae0e08ad1d025703b204f33deac666d949e9ef9ab548dc5f37d1d9c8

        • C:\Users\Admin\AppData\Local\Temp\Admin7

          Filesize

          8B

          MD5

          8ed02f33ab0112560e2414e9869d0ae3

          SHA1

          6d9ef6ffa2969e3b2aa3c47f3ea797bbd00278e2

          SHA256

          805cee606d56b5475a491ba0ec0b1711375bed89229de711ff1f1cfa641fda68

          SHA512

          1a6a194cc63c90705311b4e7b03f16194e4f639c04b7f7bb459e975ab4add48062bcbb8ba877fddd3dec8a4177b82dd70954961857e9effcb4668eeb5817d162

        • C:\Users\Admin\AppData\Local\Temp\Admin7

          Filesize

          8B

          MD5

          c8afee3619e2fd89a4bc423e9eb4c486

          SHA1

          be97d3b7c56f4c72c0e5fc7a2f475bc47889151a

          SHA256

          9af606c06305d6b60376ff748856edbf7a33b64065c641d02f320213149497a8

          SHA512

          197f17bad433d365515c0f9e8fa9c752ea3d626368a4a54423bd1f0585b164b50090d057d209bdb11d2d8fa8e1c9d41606028549182b587ad96cf158609ff299

        • C:\Users\Admin\AppData\Local\Temp\Admin7

          Filesize

          8B

          MD5

          752783a0c233a2cfdd81c98348f9477e

          SHA1

          3ba1e8872290ec389d33b567fa084b18c98726f7

          SHA256

          87a1184046966de6ae252f1bf101e68242679399f2ee5f978467698b022f4e58

          SHA512

          f2ce6e4d745dc498ab5835871e3b4092ee714bfa716d7ae551051ec33788e3d3e24c624b7d37bfa67d6218d55b67ea3cca18e5c705eb1ff613698120c5623e9a

        • C:\Users\Admin\AppData\Roaming\Adminlog.dat

          Filesize

          15B

          MD5

          bf3dba41023802cf6d3f8c5fd683a0c7

          SHA1

          466530987a347b68ef28faad238d7b50db8656a5

          SHA256

          4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d

          SHA512

          fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

        • C:\Users\Admin\AppData\Roaming\System32\SearchIndexer.exe

          Filesize

          353KB

          MD5

          383aeed2e83a9dd3d763d49f264e8586

          SHA1

          ea939564943e4cd1596871aaaba6e19f8655c54d

          SHA256

          c067afb7d8acc54803d8b95d4f248afd69a5a4b97031f3a8894bdd34188710b8

          SHA512

          43fe2e87db59339a87ca26fbe1afeb2eb94659009733f74bf51ae9760e2f09ee5fe0c8fa63fd9c55a09f52bdf65517d349fcb958a70da961afea944f793ad7d5

        • memory/1136-1441-0x0000000010560000-0x00000000105C5000-memory.dmp

          Filesize

          404KB

        • memory/1136-144-0x0000000010560000-0x00000000105C5000-memory.dmp

          Filesize

          404KB

        • memory/3296-2-0x0000000000400000-0x000000000044F000-memory.dmp

          Filesize

          316KB

        • memory/3296-1-0x0000000000400000-0x000000000044F000-memory.dmp

          Filesize

          316KB

        • memory/3296-3-0x0000000000400000-0x000000000044F000-memory.dmp

          Filesize

          316KB

        • memory/3296-7-0x0000000010410000-0x0000000010475000-memory.dmp

          Filesize

          404KB

        • memory/3296-67-0x0000000010480000-0x00000000104E5000-memory.dmp

          Filesize

          404KB

        • memory/3296-0-0x0000000000400000-0x000000000044F000-memory.dmp

          Filesize

          316KB

        • memory/3296-143-0x0000000000400000-0x000000000044F000-memory.dmp

          Filesize

          316KB

        • memory/4592-72-0x0000000010480000-0x00000000104E5000-memory.dmp

          Filesize

          404KB

        • memory/4592-987-0x0000000010480000-0x00000000104E5000-memory.dmp

          Filesize

          404KB

        • memory/4592-12-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

          Filesize

          4KB

        • memory/4592-11-0x0000000000F20000-0x0000000000F21000-memory.dmp

          Filesize

          4KB