Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    19/01/2025, 14:03

General

  • Target

    JaffaCakes118_c9cc2f4fd15aedd895a64956462c4724.exe

  • Size

    325KB

  • MD5

    c9cc2f4fd15aedd895a64956462c4724

  • SHA1

    cdec2bf4a75fce07d6ebd1eb85bba73e893613e0

  • SHA256

    a45c2448a9875f61c6f77340c69358a7bb777c7bcd55aa42962ccf294c078488

  • SHA512

    f08fbb505000ff71817e48f4ab5ede7e4090b3542640ac2b5d44282d42079acbc3e823af939bc09bb1b0b1d3e0a542ad576d7b080c7970db7dff91ea9d580e1e

  • SSDEEP

    6144:OHU8KBcYBimUsOAfcN9jGqjGSpqrVSx/1gGqgg5HOl0A:OH7a1ifsXfyKyGSp6vBggtA

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

admin

C2

hackerdefrance.no-ip.biz:4666

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    WinUpdate

  • install_file

    WindUpdate.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Net.Framework 3.5 Error

  • message_box_title

    Net.Framework

  • password

    admin

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Cybergate family
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c9cc2f4fd15aedd895a64956462c4724.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c9cc2f4fd15aedd895a64956462c4724.exe"
    1⤵
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1912
    • C:\Program Files\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2480
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2480 CREDAT:275457 /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2292

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1abe40d097b6563ba44f6137c804a49a

    SHA1

    d54564c941fa1cf99731b12afb7d46a0a395683d

    SHA256

    ac59f180efd4cd77182291696bb9da7e1650ffbd34971d3f065bcc3258d9da4b

    SHA512

    51f35e22f5955be0406ec851ecba9631293d5099707cf32a60d67fbb4cb816e233789d2f088ec849086b850b725b4e49308a170a84c0b769cf875a9373b52ff6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e6c8e0c708ce93e7fd75742210032292

    SHA1

    63903e22b3af3ded644bfc39eacfda210c6d4fae

    SHA256

    30bc15e974667b125a27fd3c1f235d959d21a0991a881dea957b7e2bc7421a15

    SHA512

    8e1827ad3107e9813febcb3182b91034c867e07ef5eb292521d7dd242cf5fdec6a05d8470cc7a6d38b855ce61ec35ba8a25fda69b7dc70aa1cffc9a433674db9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b913b12aeb0ad4cdc8e2e193dcfe8eb2

    SHA1

    cf45aeee922295642d57410b8062f3f03cd0c524

    SHA256

    6da28618dbca27e0e29f5672f3482bd6cf3a9a2a343eae690ef99197f8f94fd3

    SHA512

    533d26f8fddd903ca7327fb0770123a26d324427d892f8de64886f22c57b2eaaf673f5b1f551510dc444d567aec67fe1dc0c33b6a72dd5925ab5d1e66b38a4a2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f3f4337fa32e68ab1706e1aef136a926

    SHA1

    f86dcd4ed529ee2a7e5ea80bcbb78186eaac29d6

    SHA256

    1823ea94e4099139909bf38d63259e14d7d33e0335b22c380a40fa7e94e9b9ef

    SHA512

    40cb91162139b7e9d20aadc421af1b022ee23299f1f7b6307b976ab00f0bfedd6252de64ccfde40973bbb4f35f2fc8854cf9efd2ff1e656d7ef7c5582075db65

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    22572e2f4fb911155a36736f864b5823

    SHA1

    453058841ffd9eddcbb2a0a9c78acf624f1599b9

    SHA256

    ed38d1f66b6d5920e17e99eadccbe6af2d5541e07ccbfc6b5b3efdaa997b0d4f

    SHA512

    0a674f5f3fa963468dcfe811d4e424ea57df02095169dc17d2849d56508123c9adecc8175998a1355e201aa234b470bb670856cde95f9426692a4edfd2faee77

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4ed12ae185b6d1bc4592cb90448c9615

    SHA1

    a3c2423e5819e1940ffb945f3a174e726988a09c

    SHA256

    c23a21823013278779b4bf984d87c339aa5be98a7cd1c66259a250a994b56658

    SHA512

    31427f16f1249880f66fe5c634fbf93c13b220e95cc5d54b53002cc7c4669e1abb857eacbaae1056d95911e48c4697c79bbdab87ac83148ba2f437a75855d6e6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    0c404cf4a3fe71c14905710ae537bed3

    SHA1

    11c191c3c9d00b8966257f2b92f9b9c10c93b515

    SHA256

    9488356756709e8eeaa98a403f465d72bd52087a6e05216d26ceb1add688dbfd

    SHA512

    a69988c4df4169963210ccf316396b1f0dffa97befaa795e3162d796326cb875ba776923f694a06cd3325fe24903536e5b4b0e1e8afa2caf7804805a4eb23310

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a7190e01ef11c61126b46b6466640c8c

    SHA1

    9279f23f6d4d559de785af7bea437ca54bc90fc1

    SHA256

    58af11457becfb6a939a4aa54c929b8aad17eff48e51b6e4ca488e93bbe2eff9

    SHA512

    b29ba30f9db55b5ae0f16bcfb874abedd20120713b03a28af3eb97e4ebecc1035b2f11e98918c4224a54c8f67ede783c043f96a1298fff95d53b468006247d80

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6f633dc2dca87e1f4e86214e4d79db9f

    SHA1

    b27008698b0e5241cdf6000ab3c5a8c5e71d802d

    SHA256

    a7aa7019b10d8b7f867b51127ce8949c17b5f792d1e4e86cc61c73b92c60d7fd

    SHA512

    78bc2f0ee3064c64e5270ef9126eff2edf595b8e93dd61e99a848d69d7743e635b67a49dd210c12b785173f77814782af6d1fc23bd6446892bfb59d8a02f9cd8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f8e55b835bcd3f9cc25b8c194b7993e3

    SHA1

    8dcc74dbe4ff6a256a4ebb87767182824d5a6289

    SHA256

    0ce94a074f05cbbdf33a1d5ee33fd5ca769453df4deec8663173fb4959c5a14c

    SHA512

    a424feddbb4bb87763758ad0997d9c021e9e131a9cb5fc3968a2004802c02fbe689a827038ffc4645e491fb8373458c0edd29d2cf12d6947770a51d26c8c0f83

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2038371470c2bfd42eb970607e4dabd8

    SHA1

    d242bab36e915c646120206d5b41f143602a06d4

    SHA256

    0be37edb087085ee25246d9dc81456952b8d0744df98384adc9c1fba77fa7113

    SHA512

    ce335dca12fe103e76ac8cc668c2551eef2587f0529b6fede92d32f5629ad7093366e1595be6cb7bc2502f8f22f2b93858fc846a7bb5eedcb7ccea94c44fbad1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9a3834bcba73b1319fbc86224ff0b21f

    SHA1

    305bc8cae07c57c7aae8d830e55b9678aeed67ef

    SHA256

    d758e213fb95f246dde9a5db023b0bb59ce1d8579711d07438ba3451d9966934

    SHA512

    361357e3812f149d0013aedc56a610d3267f2d1acf2c96fa5074c69dfc357223bdb78bb5151bbbd82d7dd471b75b162169bc2046331ba0ef01e8cff1eb335952

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    0f3acb1f21f3ef01f002e8e3a5c87a9b

    SHA1

    bcc31e267d0bd06a3205db3efed67d00103beb8b

    SHA256

    e0319fc2fa00f3a42d746ec6afbd18306f366030e14a5ccc70f1ff5cba0061e2

    SHA512

    fa737deead4cd3c7a121b47dc2c2d3cc5037d3b8cd57cf708948162de326757793eb01a90078ea6e60994b7ce570bee57806cfb38161d0f1619326b3cc64ce97

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f94dbc7cf3b0fff25516f071401ad5b2

    SHA1

    d7ef7e8cf11f4bc3196fb3331dc8c746e1ac66b3

    SHA256

    ae3856198104fccb75978899b1a25a508eea9f7b2e85289db25caa4bca0777e4

    SHA512

    72fa0a7f52f0cc98a2a8c62eed445f13fd62f2bc49222df8abc2963827ff68d926921d2e3aae77667573e00a213cc28fed12e2f961307dae0896b6d03982ecfe

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    507a5c306cf1f1882730a0a21699326c

    SHA1

    5adec628a63ab661d11c46ee5cec4b8754024f66

    SHA256

    9286ef422317b6cf95890651d4809147e63b0a037b3ce207b70af73ceb065242

    SHA512

    7f931b23fb137ebc6948caf90b0939b673db6312f1f09a89eb45990a624bfc53e19df96bbb8a2bb19fb8c1cc5e99bc8d8e491972318c499b52186b6d9b67d938

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    015c369c05d1de50cb0900575731d50a

    SHA1

    a37c0348186d259804b7ad49286242191fc58c38

    SHA256

    2170c954d076b007058741cc46ce6c663fd3a810554af99207e1e3bb1258b563

    SHA512

    d2865e5ef8ef2a8065065342f1bdb8ea5201e9a1eb03faec44248a6f50a94bc354a7f413bba1b12f8d3ecc113bf52081f40e68ead25ec0502e23616a985e0489

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b73e8b8fdfb5e95862923bf3393948a4

    SHA1

    2828fef951deab77476007237c39315f5987ed40

    SHA256

    9cac25729401f21964a1ab6a67e6dcbebc31f26d686db95e3a3d7e83d3a4aa5c

    SHA512

    2b79f79d3e9bd1a7dd7001365174af4505d62d73405828d21e08b60cd97653fab7a5e82346e86622d128a1705cceeadd429fecd7ae8e941c0f4eda47feb854ca

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    aee68b35884d38b671ae8893e61e4e74

    SHA1

    683812c700311244faa897fd07d5f18cf2fd9100

    SHA256

    1e77b47c7e7db14dcfa879bee40b164a39ab4c630bb2de96634b92956d0bc1c2

    SHA512

    2b75f1d15fa699431811fa9fa7fdddfd661b9f24b5d1fc432df31f0f7f7eb458d8af6867423fb449af4f2f532a9b038ed66d8f840c9a6c9a72aae14d023a880f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3e8b5e523108b004fd388b8e31856394

    SHA1

    4730d9a2531316f76370c728cf7ffe61ddb9e8ea

    SHA256

    8941e40f74a86981134733a6babf41617035f0fbdd512f840e9353a5b8b5c2e9

    SHA512

    e98f7a6768919815c020950e85f8abd8422ba63b8a6e64af0e8969a5df72966838a38686a19a1d69cc9c12246a1017d2a568fb66e047f407b3cefa61c5b814e4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    241a51f7973902d0d05641ad2a1c1c80

    SHA1

    4b1bec5d28e9fa4e7b55833942cdfb1b2b54da61

    SHA256

    73b1e063fc4527c5eb02a4b4dd2916d6f1a791ffebef5faa028c0ac2060030d8

    SHA512

    200a52074d3275a7732c01740da3f47197d68832e5fb73e06754255f5357009f96cd1daf03b16ff25d9542d97b0b8ab4433319601274dbaa0837ac0cf38604bd

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    19f7a9de7889ff8fd365300bf5a0852d

    SHA1

    9224d51791ac485b76119be5fa1f375fd3ff58a2

    SHA256

    518a082bdb46bd9404e5fae550fde7c7c4ed76b2d5a4ea83aa505355e521e534

    SHA512

    1918f92c0919ac563440519623c9b5a6f26a2520d1089093f2513971d9aa4518e6f13aaa29686ffa511cacab82ef08501f0321ec6997bd171713c8cb64fd4731

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4b8b22406036cd8440b510d130349953

    SHA1

    e5e69a1aa4d170d3c2fc560f8c1d527271a320e0

    SHA256

    109d8355a57f16d40b62bedd904d6ac8fe9b5ee70d609057f0bdde025c7329f5

    SHA512

    7a217c2e59c8f13a9663a1e3712efb0f3d9d1be5a38869294b4584a2728ae4df7c55a9441d00e45501a1e7ed48d803ed62d610311d74c543659c4c80007fd4fe

  • C:\Users\Admin\AppData\Local\Temp\CabB6C4.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarB735.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • memory/2480-1-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB