Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
12/06/2023, 03:39
230612-d7n2gsaf66 607/02/2023, 06:16
230207-g1qhhsch4v 616/06/2022, 07:32
220616-jddasahadk 6Analysis
-
max time kernel
123s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
16/06/2022, 07:32
Static task
static1
Behavioral task
behavioral1
Sample
brbbot.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
brbbot.exe
Resource
win10-20220414-en
Behavioral task
behavioral3
Sample
brbbot.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral4
Sample
brbbot.exe
Resource
win11-20220223-en
General
-
Target
brbbot.exe
-
Size
74KB
-
MD5
1c7243c8f3586b799a5f9a2e4200aa92
-
SHA1
4db5a8e237937b6d7b435a8506b8584121a7e9e3
-
SHA256
f47060d0f7de5ee651878eb18dd2d24b5003bdb03ef4f49879f448f05034a21e
-
SHA512
56cdf52cfcc102d2c8cc90e5a298eeaefd44002061108b0d6b330bb93c3590b3f8b2c3c4e1fa208fafeefa7dafa092bd0f57d3cf905382f88b9f66a5d84357fd
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\brbbot = "C:\\Users\\Admin\\AppData\\Roaming\\brbbot.exe" brbbot.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 4124 brbbot.exe 4124 brbbot.exe 4124 brbbot.exe 4124 brbbot.exe 4124 brbbot.exe 4124 brbbot.exe 4124 brbbot.exe 4124 brbbot.exe 4124 brbbot.exe 4124 brbbot.exe 4124 brbbot.exe 4124 brbbot.exe 4124 brbbot.exe 4124 brbbot.exe 4124 brbbot.exe 4124 brbbot.exe 4124 brbbot.exe 4124 brbbot.exe 4124 brbbot.exe 4124 brbbot.exe 4124 brbbot.exe 4124 brbbot.exe 4124 brbbot.exe 4124 brbbot.exe 4124 brbbot.exe 4124 brbbot.exe 4124 brbbot.exe 4124 brbbot.exe 4124 brbbot.exe 4124 brbbot.exe