Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    12/01/2025, 18:06

General

  • Target

    JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe

  • Size

    270KB

  • MD5

    14ea1e956e06e6b5fa4bd1730705a79c

  • SHA1

    c1502b8759d28dabe3dfd31bede88030b80ee449

  • SHA256

    4ea730cddb5393d5c2d68b124548c7014c93cbafa9a0644b9390fda5f52615f0

  • SHA512

    89a4f0d7aebed543ad65024b089f6696ce0ee6ac482c1dd8580b0348f4df530ff0cdc1979d4e61a4ecdaba654f97649c5d2c082619b98d88725bee94b38fe186

  • SSDEEP

    6144:tjMWPd34vhpgf3462vvpu4HyAgI6f7fcw/4/qN:xD34ngA6wpXSvEw/QO

Malware Config

Extracted

Family

cybergate

Version

2.5

Botnet

Visual Basic

C2

127.0.0.1:81

Mutex

Virtual

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    SpyNet

  • install_file

    Virtual.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    Virtual

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Cybergate family
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Suspicious use of SetThreadContext 1 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\System32\smss.exe
    \SystemRoot\System32\smss.exe
    1⤵
      PID:256
    • C:\Windows\system32\csrss.exe
      %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
      1⤵
        PID:332
      • C:\Windows\system32\wininit.exe
        wininit.exe
        1⤵
          PID:372
          • C:\Windows\system32\services.exe
            C:\Windows\system32\services.exe
            2⤵
              PID:464
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k DcomLaunch
                3⤵
                  PID:608
                  • C:\Windows\system32\wbem\wmiprvse.exe
                    C:\Windows\system32\wbem\wmiprvse.exe
                    4⤵
                      PID:1560
                    • C:\Windows\system32\DllHost.exe
                      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                      4⤵
                        PID:1584
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k RPCSS
                      3⤵
                        PID:684
                      • C:\Windows\System32\svchost.exe
                        C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
                        3⤵
                          PID:748
                        • C:\Windows\System32\svchost.exe
                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
                          3⤵
                            PID:820
                            • C:\Windows\system32\Dwm.exe
                              "C:\Windows\system32\Dwm.exe"
                              4⤵
                                PID:1180
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k netsvcs
                              3⤵
                                PID:848
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k LocalService
                                3⤵
                                  PID:996
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k NetworkService
                                  3⤵
                                    PID:300
                                  • C:\Windows\System32\spoolsv.exe
                                    C:\Windows\System32\spoolsv.exe
                                    3⤵
                                      PID:768
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
                                      3⤵
                                        PID:1084
                                      • C:\Windows\system32\taskhost.exe
                                        "taskhost.exe"
                                        3⤵
                                          PID:1124
                                        • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
                                          "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
                                          3⤵
                                            PID:1312
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
                                            3⤵
                                              PID:2652
                                            • C:\Windows\system32\sppsvc.exe
                                              C:\Windows\system32\sppsvc.exe
                                              3⤵
                                                PID:2680
                                            • C:\Windows\system32\lsass.exe
                                              C:\Windows\system32\lsass.exe
                                              2⤵
                                                PID:480
                                              • C:\Windows\system32\lsm.exe
                                                C:\Windows\system32\lsm.exe
                                                2⤵
                                                  PID:488
                                              • C:\Windows\system32\csrss.exe
                                                %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
                                                1⤵
                                                  PID:380
                                                • C:\Windows\system32\winlogon.exe
                                                  winlogon.exe
                                                  1⤵
                                                    PID:420
                                                  • C:\Windows\Explorer.EXE
                                                    C:\Windows\Explorer.EXE
                                                    1⤵
                                                      PID:1212
                                                      • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe"
                                                        2⤵
                                                        • Suspicious use of SetThreadContext
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of SetWindowsHookEx
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2488
                                                        • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe
                                                          3⤵
                                                          • Boot or Logon Autostart Execution: Active Setup
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2568
                                                          • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe"
                                                            4⤵
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious behavior: GetForegroundWindowSpam
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:2968

                                                    Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

                                                      Filesize

                                                      200KB

                                                      MD5

                                                      d4f54f96ddd1810074f413285d28c9f8

                                                      SHA1

                                                      6243414a5c9df4bf5a6cd4a9baeb78ba5228b8ef

                                                      SHA256

                                                      d696e2f385b3ea3a15735a4602975193964a4d208776ea6a7e9c35b46e123a27

                                                      SHA512

                                                      db6633cb74d59cc490d1d7325ae7354e5afb0b4a7e9caf8ffb8766e7717df7d4159a3aa1de9028e642bd83e1caf22bc0a05188887f1d27bc68322b001ce075d3

                                                    • C:\Users\Admin\AppData\Roaming\logs.dat

                                                      Filesize

                                                      15B

                                                      MD5

                                                      4362e21af8686f5ebba224768d292a5b

                                                      SHA1

                                                      504510a4d10e230dcd1605ab3342525b38a10933

                                                      SHA256

                                                      b1b2cc9a6bf77f9e56955acbbce253c70fc25b92d1e150d9928b9183b19b93b3

                                                      SHA512

                                                      f2ee4b95d5c50b533de93f21f9d73a75ab8c755ab9f343b4848bd92b6827e76dc5e17fe27b0f2ad2049a1ee0fe20d0cb0398b1973277b85e84b6af004e945850

                                                    • memory/2568-2-0x0000000000400000-0x000000000044F000-memory.dmp

                                                      Filesize

                                                      316KB

                                                    • memory/2568-13-0x0000000000400000-0x000000000044F000-memory.dmp

                                                      Filesize

                                                      316KB

                                                    • memory/2568-11-0x0000000000400000-0x000000000044F000-memory.dmp

                                                      Filesize

                                                      316KB

                                                    • memory/2568-6-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/2568-5-0x0000000000400000-0x000000000044F000-memory.dmp

                                                      Filesize

                                                      316KB

                                                    • memory/2568-10-0x0000000000400000-0x000000000044F000-memory.dmp

                                                      Filesize

                                                      316KB

                                                    • memory/2568-4-0x0000000000400000-0x000000000044F000-memory.dmp

                                                      Filesize

                                                      316KB

                                                    • memory/2568-8-0x0000000000400000-0x000000000044F000-memory.dmp

                                                      Filesize

                                                      316KB

                                                    • memory/2568-16-0x0000000024010000-0x0000000024052000-memory.dmp

                                                      Filesize

                                                      264KB

                                                    • memory/2568-12-0x0000000000400000-0x000000000044F000-memory.dmp

                                                      Filesize

                                                      316KB

                                                    • memory/2568-264-0x0000000000400000-0x000000000044F000-memory.dmp

                                                      Filesize

                                                      316KB

                                                    • memory/2568-86-0x0000000000400000-0x000000000044F000-memory.dmp

                                                      Filesize

                                                      316KB

                                                    • memory/2968-21-0x00000000001D0000-0x00000000001D1000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/2968-29-0x0000000000350000-0x0000000000351000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/2968-269-0x0000000024010000-0x0000000024052000-memory.dmp

                                                      Filesize

                                                      264KB

                                                    • memory/2968-17-0x00000000001B0000-0x00000000001B1000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/2968-2726-0x0000000024010000-0x0000000024052000-memory.dmp

                                                      Filesize

                                                      264KB