Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21/01/2025, 06:52

General

  • Target

    JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe

  • Size

    437KB

  • MD5

    02c92a0d1d31087dc181020969e5b1f3

  • SHA1

    274977e3f1cebbd7b90ae450652b5cf9d22313d2

  • SHA256

    110cda2677c1e22cb1d0c989f0e98b1d1e2194874356b74c5660a31a1b05448e

  • SHA512

    8c2849a1029da3c4a74a83ac70aabea0c0dcf6c11e4435020c724104eb5f468b88880692b4f6f46f8064fbda6ff79a144ef22a76fd384f148df6ef9d4314e0df

  • SSDEEP

    6144:o7yqzqTobmMXWkypkwlciR+9V8rh0U2MpafHvRF7A2bK3/szcBGWw/hDIcqn0:o7yMqTozXeaZw+I9y/vXAfkwoDhscR

Malware Config

Extracted

Family

cybergate

Version

2.5

Botnet

vítima

C2

lecoa286.no-ip.org:81

192.168.254.1:81

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Cybergate family
  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\System32\smss.exe
    \SystemRoot\System32\smss.exe
    1⤵
      PID:256
    • C:\Windows\system32\csrss.exe
      %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
      1⤵
        PID:336
      • C:\Windows\system32\wininit.exe
        wininit.exe
        1⤵
          PID:384
          • C:\Windows\system32\services.exe
            C:\Windows\system32\services.exe
            2⤵
              PID:476
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k DcomLaunch
                3⤵
                  PID:592
                  • C:\Windows\system32\wbem\wmiprvse.exe
                    C:\Windows\system32\wbem\wmiprvse.exe
                    4⤵
                      PID:840
                    • C:\Windows\system32\DllHost.exe
                      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                      4⤵
                        PID:1636
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k RPCSS
                      3⤵
                        PID:676
                      • C:\Windows\System32\svchost.exe
                        C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
                        3⤵
                          PID:740
                        • C:\Windows\System32\svchost.exe
                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
                          3⤵
                            PID:820
                            • C:\Windows\system32\Dwm.exe
                              "C:\Windows\system32\Dwm.exe"
                              4⤵
                                PID:1172
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k netsvcs
                              3⤵
                                PID:848
                                • \\?\C:\Windows\system32\wbem\WMIADAP.EXE
                                  wmiadap.exe /F /T /R
                                  4⤵
                                    PID:584
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k LocalService
                                  3⤵
                                    PID:972
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k NetworkService
                                    3⤵
                                      PID:276
                                    • C:\Windows\System32\spoolsv.exe
                                      C:\Windows\System32\spoolsv.exe
                                      3⤵
                                        PID:328
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
                                        3⤵
                                          PID:1064
                                        • C:\Windows\system32\taskhost.exe
                                          "taskhost.exe"
                                          3⤵
                                            PID:1108
                                          • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
                                            "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
                                            3⤵
                                              PID:556
                                            • C:\Windows\system32\svchost.exe
                                              C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
                                              3⤵
                                                PID:2544
                                              • C:\Windows\system32\sppsvc.exe
                                                C:\Windows\system32\sppsvc.exe
                                                3⤵
                                                  PID:2292
                                              • C:\Windows\system32\lsass.exe
                                                C:\Windows\system32\lsass.exe
                                                2⤵
                                                  PID:492
                                                • C:\Windows\system32\lsm.exe
                                                  C:\Windows\system32\lsm.exe
                                                  2⤵
                                                    PID:500
                                                • C:\Windows\system32\csrss.exe
                                                  %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
                                                  1⤵
                                                    PID:396
                                                  • C:\Windows\system32\winlogon.exe
                                                    winlogon.exe
                                                    1⤵
                                                      PID:432
                                                    • C:\Windows\Explorer.EXE
                                                      C:\Windows\Explorer.EXE
                                                      1⤵
                                                        PID:1196
                                                        • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe"
                                                          2⤵
                                                          • Suspicious use of SetThreadContext
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of SetWindowsHookEx
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:3016
                                                          • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe
                                                            3⤵
                                                            • Adds policy Run key to start application
                                                            • Boot or Logon Autostart Execution: Active Setup
                                                            • Adds Run key to start application
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2160
                                                            • C:\Program Files\Internet Explorer\iexplore.exe
                                                              "C:\Program Files\Internet Explorer\iexplore.exe"
                                                              4⤵
                                                                PID:2844
                                                              • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe"
                                                                4⤵
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious behavior: GetForegroundWindowSpam
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:1104

                                                        Network

                                                        MITRE ATT&CK Enterprise v15

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        • C:\Users\Admin\AppData\Local\Temp\UuU.uUu

                                                          Filesize

                                                          8B

                                                          MD5

                                                          2ab128f16d93dc0625236c0e2d551f08

                                                          SHA1

                                                          0ada904f737ecfab54022198e46a414b7c7ec8f5

                                                          SHA256

                                                          136455dea5ea1932d6ae5544c7ff740dfa57a355f2fdc222487b990438ce790e

                                                          SHA512

                                                          72afe50390c514daa94d3a0226e1a7cd69832b8508d215a920e19b6ca828443a201eddf1b22d924b4156faf45cc69e7b944a078a75fb327c6dd0c8dee051740a

                                                        • C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

                                                          Filesize

                                                          200KB

                                                          MD5

                                                          08a8d98488ac6f78c6e76f21d79c0879

                                                          SHA1

                                                          fdfd84a9fe6bf5657c631eaee1ad22746292f68c

                                                          SHA256

                                                          2295e27e006281c5ef7ea137c0e298009295b7be6a2141945b4d73c31ad21848

                                                          SHA512

                                                          4a210bb393682ccce390fc29714eeb621f62fa367c1db5f54433c9d08ef9683596bee96be1cc728cce77bb371c1f3cfa0ef5946ae8dd5eb2627e136d06a2abb9

                                                        • C:\Users\Admin\AppData\Roaming\logs.dat

                                                          Filesize

                                                          15B

                                                          MD5

                                                          4362e21af8686f5ebba224768d292a5b

                                                          SHA1

                                                          504510a4d10e230dcd1605ab3342525b38a10933

                                                          SHA256

                                                          b1b2cc9a6bf77f9e56955acbbce253c70fc25b92d1e150d9928b9183b19b93b3

                                                          SHA512

                                                          f2ee4b95d5c50b533de93f21f9d73a75ab8c755ab9f343b4848bd92b6827e76dc5e17fe27b0f2ad2049a1ee0fe20d0cb0398b1973277b85e84b6af004e945850

                                                        • memory/1104-39-0x0000000000350000-0x0000000000351000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/1104-46-0x0000000000400000-0x000000000042D000-memory.dmp

                                                          Filesize

                                                          180KB

                                                        • memory/1104-29-0x00000000001B0000-0x00000000001B1000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/1104-32-0x00000000001D0000-0x00000000001D1000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/2160-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/2160-12-0x0000000000400000-0x0000000000448000-memory.dmp

                                                          Filesize

                                                          288KB

                                                        • memory/2160-19-0x0000000000400000-0x0000000000448000-memory.dmp

                                                          Filesize

                                                          288KB

                                                        • memory/2160-20-0x0000000000400000-0x0000000000448000-memory.dmp

                                                          Filesize

                                                          288KB

                                                        • memory/2160-21-0x0000000000400000-0x0000000000448000-memory.dmp

                                                          Filesize

                                                          288KB

                                                        • memory/2160-24-0x0000000024010000-0x0000000024052000-memory.dmp

                                                          Filesize

                                                          264KB

                                                        • memory/2160-8-0x0000000000400000-0x0000000000448000-memory.dmp

                                                          Filesize

                                                          288KB

                                                        • memory/2160-4-0x0000000000400000-0x0000000000448000-memory.dmp

                                                          Filesize

                                                          288KB

                                                        • memory/2160-2-0x0000000000400000-0x0000000000448000-memory.dmp

                                                          Filesize

                                                          288KB

                                                        • memory/2160-28-0x0000000024060000-0x00000000240A2000-memory.dmp

                                                          Filesize

                                                          264KB

                                                        • memory/2160-18-0x0000000000400000-0x0000000000448000-memory.dmp

                                                          Filesize

                                                          288KB

                                                        • memory/2160-118-0x0000000000400000-0x0000000000448000-memory.dmp

                                                          Filesize

                                                          288KB

                                                        • memory/2160-280-0x0000000000400000-0x0000000000448000-memory.dmp

                                                          Filesize

                                                          288KB

                                                        • memory/2160-14-0x0000000000400000-0x0000000000448000-memory.dmp

                                                          Filesize

                                                          288KB

                                                        • memory/2160-10-0x0000000000400000-0x0000000000448000-memory.dmp

                                                          Filesize

                                                          288KB

                                                        • memory/2160-6-0x0000000000400000-0x0000000000448000-memory.dmp

                                                          Filesize

                                                          288KB