Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    NEAS.d9a43961c899fc2947ec5a26cd263c30.exe

  • Size

    341KB

  • Sample

    231105-2173saeb7t

  • MD5

    d9a43961c899fc2947ec5a26cd263c30

  • SHA1

    0770410f5e9e3c1a58afbf8211ada5df36894236

  • SHA256

    35cf3ad040e370ea6febd200318776837ece71f06fc7e46392f2f6e55e860851

  • SHA512

    b65acb18ce381c9fd6976205d3802b49063e173e7f620b328a8d89317056b378eb2db328fcd52c652bb44ed13cbcee6b066d5efb2de71b62baf39cba6a2b22e1

  • SSDEEP

    6144:grnkP+6bB0H9rj3fMMICM4kfBbSVtxzcdNg/SOPOoUkZUuOsOjbSMu6l3bS64u5U:gQ+Qu9yus9exo/iSuU8OsitH5og+

Malware Config

Targets

    • Target

      NEAS.d9a43961c899fc2947ec5a26cd263c30.exe

    • Size

      341KB

    • MD5

      d9a43961c899fc2947ec5a26cd263c30

    • SHA1

      0770410f5e9e3c1a58afbf8211ada5df36894236

    • SHA256

      35cf3ad040e370ea6febd200318776837ece71f06fc7e46392f2f6e55e860851

    • SHA512

      b65acb18ce381c9fd6976205d3802b49063e173e7f620b328a8d89317056b378eb2db328fcd52c652bb44ed13cbcee6b066d5efb2de71b62baf39cba6a2b22e1

    • SSDEEP

      6144:grnkP+6bB0H9rj3fMMICM4kfBbSVtxzcdNg/SOPOoUkZUuOsOjbSMu6l3bS64u5U:gQ+Qu9yus9exo/iSuU8OsitH5og+

    • Malware Backdoor - Berbew

      Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.

    • Modifies WinLogon for persistence

    • Drops file in Drivers directory

    • Sets service image path in registry

    • Modifies system executable filetype association

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

    • Modifies WinLogon

MITRE ATT&CK Enterprise v15

Tasks