Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    4s
  • max time network
    4s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/03/2025, 14:21

Errors

Reason
Machine shutdown

General

  • Target

    JaffaCakes118_87419cb6f1e5f701cdcb756106371e2c.exe

  • Size

    308KB

  • MD5

    87419cb6f1e5f701cdcb756106371e2c

  • SHA1

    02b16c73e50afb72267fa3dcaee386cb4f0f50f3

  • SHA256

    1b5245e601685a58e4d2a3c3707deac6b79168c4a7ce82e4708f4060fdcc1b77

  • SHA512

    7a2e7d5afa01569a599d4363a9128344b7056ca138cefb1b34638f5aa994c79f147af25832ae7e815339aa4997adacdd7451767e80074cb3cfc2e2c6517b418c

  • SSDEEP

    6144:t1VQ6WIEn19wCeQMBbnTLUVp4NU/IQ8N//F7oat0nXleSq4lgwfLOZyCK/V:tjQ6Wfn1p4ZTLUXOGId/6g6XESq4awak

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

Cyber

C2

cyberserver.no-ip.biz:3080

Mutex

156FV6SGEVUD87

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    WinRT32.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    123456

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Cybergate family
  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3440
      • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_87419cb6f1e5f701cdcb756106371e2c.exe
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_87419cb6f1e5f701cdcb756106371e2c.exe"
        2⤵
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of UnmapMainImage
        • Suspicious use of WriteProcessMemory
        PID:932
        • C:\Users\Admin\AppData\Local\Temp\winhost.exe
          C:\Users\Admin\AppData\Local\Temp\winhost.exe
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1952
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • System Location Discovery: System Language Discovery
            PID:1784
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 144
              5⤵
              • Program crash
              PID:2144
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:4636
            • C:\Users\Admin\AppData\Local\Temp\winhost.exe
              "C:\Users\Admin\AppData\Local\Temp\winhost.exe"
              4⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:1348
            • C:\Windows\SysWOW64\install\WinRT32.exe
              "C:\Windows\system32\install\WinRT32.exe"
              4⤵
                PID:4356
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1784 -ip 1784
          1⤵
            PID:4192

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\Admin2.txt

            Filesize

            224KB

            MD5

            c726e64d6fa2c26ba0586d5d9e2f756b

            SHA1

            83e18a5e19a23a8597dc4ab7ce4fca5fe688c0b5

            SHA256

            436171fbccc7069fec70168a4eeb79b0a1c093eca9f43c67aa01bd5ee3b5ca8e

            SHA512

            0a6df6304288f07a02979e3241a86027a3ec00d4fa9116d857189fa9bf08b1d76ae4b1510c9d4d84d7aeca84287b37ad26fc7ee10805cde0b948710999d661d5

          • C:\Users\Admin\AppData\Local\Temp\winhost.exe

            Filesize

            34KB

            MD5

            e118330b4629b12368d91b9df6488be0

            SHA1

            ce90218c7e3b90df2a3409ec253048bb6472c2fd

            SHA256

            3a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9

            SHA512

            ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0

          • memory/932-12-0x0000000074930000-0x0000000074EE1000-memory.dmp

            Filesize

            5.7MB

          • memory/932-2-0x0000000074930000-0x0000000074EE1000-memory.dmp

            Filesize

            5.7MB

          • memory/932-1-0x0000000074930000-0x0000000074EE1000-memory.dmp

            Filesize

            5.7MB

          • memory/932-0-0x0000000074932000-0x0000000074933000-memory.dmp

            Filesize

            4KB

          • memory/1348-94-0x0000000010560000-0x00000000105C5000-memory.dmp

            Filesize

            404KB

          • memory/1784-20-0x0000000000990000-0x0000000000991000-memory.dmp

            Filesize

            4KB

          • memory/1784-21-0x0000000001090000-0x0000000001091000-memory.dmp

            Filesize

            4KB

          • memory/1952-16-0x0000000010410000-0x0000000010475000-memory.dmp

            Filesize

            404KB

          • memory/1952-6-0x0000000000400000-0x0000000000451000-memory.dmp

            Filesize

            324KB

          • memory/1952-10-0x0000000000400000-0x0000000000451000-memory.dmp

            Filesize

            324KB

          • memory/1952-19-0x0000000010480000-0x00000000104E5000-memory.dmp

            Filesize

            404KB

          • memory/1952-24-0x0000000010480000-0x00000000104E5000-memory.dmp

            Filesize

            404KB

          • memory/1952-28-0x00000000104F0000-0x0000000010555000-memory.dmp

            Filesize

            404KB

          • memory/1952-31-0x0000000010560000-0x00000000105C5000-memory.dmp

            Filesize

            404KB

          • memory/1952-9-0x0000000000400000-0x0000000000451000-memory.dmp

            Filesize

            324KB

          • memory/1952-8-0x0000000000400000-0x0000000000451000-memory.dmp

            Filesize

            324KB