Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    80s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    16/09/2024, 16:04

General

  • Target

    Backdoor.Win32.Padodor.SK.exe

  • Size

    80KB

  • MD5

    b3ee581a1555d4957f344dae7f5e8600

  • SHA1

    2a75920942e03050a17adec7ebbb7e05ad08b5db

  • SHA256

    eed17cb561c3c0f502e114cc22dd632261579f6bfe3fa2bbe52278604b970d63

  • SHA512

    ab3515d36f9ea25c9088b99251baf2a72dd47754e44edc64b0d322a3e7136678fe9ac171eac039f8ef060686892299b0ed11edfe2a8f6d2fa4988c13b036afa8

  • SSDEEP

    1536:oRzlGB3ty199HdEyqTrFZY8D11hcWyFdezeaDOFeJuqnhCN:oRIy1DuyqvFZF1VKdeznOFeJLCN

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

  • Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 16 IoCs
  • Berbew

    Berbew is a backdoor written in C++.

  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 19 IoCs
  • Drops file in System32 directory 26 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 27 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Backdoor.Win32.Padodor.SK.exe
    "C:\Users\Admin\AppData\Local\Temp\Backdoor.Win32.Padodor.SK.exe"
    1⤵
    • Adds autorun key to be loaded by Explorer.exe on startup
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2192
    • C:\Windows\SysWOW64\Cbblda32.exe
      C:\Windows\system32\Cbblda32.exe
      2⤵
      • Adds autorun key to be loaded by Explorer.exe on startup
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2300
      • C:\Windows\SysWOW64\Cgoelh32.exe
        C:\Windows\system32\Cgoelh32.exe
        3⤵
        • Adds autorun key to be loaded by Explorer.exe on startup
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2636
        • C:\Windows\SysWOW64\Cnimiblo.exe
          C:\Windows\system32\Cnimiblo.exe
          4⤵
          • Adds autorun key to be loaded by Explorer.exe on startup
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:776
          • C:\Windows\SysWOW64\Cebeem32.exe
            C:\Windows\system32\Cebeem32.exe
            5⤵
            • Adds autorun key to be loaded by Explorer.exe on startup
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:2676
            • C:\Windows\SysWOW64\Cgaaah32.exe
              C:\Windows\system32\Cgaaah32.exe
              6⤵
              • Adds autorun key to be loaded by Explorer.exe on startup
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in System32 directory
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:2452
              • C:\Windows\SysWOW64\Cnmfdb32.exe
                C:\Windows\system32\Cnmfdb32.exe
                7⤵
                • Adds autorun key to be loaded by Explorer.exe on startup
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in System32 directory
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                PID:2060
                • C:\Windows\SysWOW64\Cfhkhd32.exe
                  C:\Windows\system32\Cfhkhd32.exe
                  8⤵
                  • Adds autorun key to be loaded by Explorer.exe on startup
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Drops file in System32 directory
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  • Suspicious use of WriteProcessMemory
                  PID:1656
                  • C:\Windows\SysWOW64\Dpapaj32.exe
                    C:\Windows\system32\Dpapaj32.exe
                    9⤵
                    • Executes dropped EXE
                    • Drops file in System32 directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:2732
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 144
                      10⤵
                      • Loads dropped DLL
                      • Program crash
                      PID:2164

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\Cnimiblo.exe

    Filesize

    80KB

    MD5

    c77c8677a9958ae44149a2e4ea543fbc

    SHA1

    11f20cacc3672fe16d5f3b385d14584eda83f322

    SHA256

    ea4845f1662744d16544a61391a44c8fb26929070d6e007480c42219259c3ba6

    SHA512

    56ad95d61904534b59713648c1f6753a5ae9b129be9c6ede5968b7b344fe99dc9b73b0454b49522a51b2880fdeb06bbec71ed1bc1ec41e412e5cb3a2a36e50c8

  • C:\Windows\SysWOW64\Kaqnpc32.dll

    Filesize

    7KB

    MD5

    4f972a7592e0c7dd63ca0739bc6a9230

    SHA1

    0d6a69edbfe329e44ed2b1f95f0e3eba62fd27ad

    SHA256

    972b38488b74ebf82e887b8f9ea290a74defd26f67be7b681abd2694c46fea9b

    SHA512

    45b73becca4b6161a20066aaddfde0c88deb277b4afc9a9c2f8abeaca96acbc12b2537458da69c3a58e541b54af88ac7c10b96bb9bf4db8763177026d69f989e

  • \Windows\SysWOW64\Cbblda32.exe

    Filesize

    80KB

    MD5

    acc967b6198de6ac859d69fe395a2e61

    SHA1

    d50a51570062e6bf53eb9705ad81ac2517f44303

    SHA256

    85a04780330a41ca9c49a107fd6f3ed95a6a0adc832962f8411dda4fb924d6db

    SHA512

    118ad27a49773fcdcc7f24964e1fb9a0454225c30d707e15720d9dab0802ce44b368b04ffa8a738dd33d331462d2e7c6d709e4c5c3594678d117cabda9c5b640

  • \Windows\SysWOW64\Cebeem32.exe

    Filesize

    80KB

    MD5

    636dac539f42777bb5a223a5ff76a42d

    SHA1

    e82b94702908d3ba52e1e7a84dd3f1e26d9337eb

    SHA256

    d332e7f227cac4818eb3ce205d2c2ceb4f5cf761525e5810f69028073a70dc82

    SHA512

    ec8bd8ae39a39eec28b5db56ccddca6ab87106f256b61fc2fe53a3ddc4824d5279bd3eb145a261a382225699642a19da62a89336020eed629c3059f8c99b8f21

  • \Windows\SysWOW64\Cfhkhd32.exe

    Filesize

    80KB

    MD5

    ea625d283ca44debb5a678fc2eeb2384

    SHA1

    0d12912599bdba0653ec47d719b9e1f7aed05a3a

    SHA256

    e760e306c50fc43a6ff02568311c99801d535a0e7188fb36f866386cb3ddf143

    SHA512

    575f2d691ad83dd5872d013c468e057fa5930644e96cee4d4d26947984651167ea5a885ec1b7cf428168c353f8924fda127c9de97af984b61a0d27f07e60e5cf

  • \Windows\SysWOW64\Cgaaah32.exe

    Filesize

    80KB

    MD5

    fd8d1d17611cbb3d1be225ce1dfeb5c6

    SHA1

    cbd7eda77133f642c528da2401d177d1371ddde9

    SHA256

    5a5d66eed5917f8e9569bf7b980b1b66005efe26261964d945dc59b3eab1d262

    SHA512

    974b3225c232e61f351f76411e6fdf163a72e0bd3b8a7a5c5066db7120a155b0c1678e168c4944eddaa172ed067fcb677a547e3b62914680fa6ef37233e77e6c

  • \Windows\SysWOW64\Cgoelh32.exe

    Filesize

    80KB

    MD5

    9fbf184ea03e2e5dfa49275f1cf42e1b

    SHA1

    10e9659ca5b3af9823fc60ec6d95fab87b46210a

    SHA256

    5fe63d39dd7424d7805bd5597787ba57cfef721cf86a2f7622e88c5a8f1d1c75

    SHA512

    ae20467a4bbec58af7c3ecad5647dc08d2c0bba58de5f3b06ccb9d1e04a77b4f48ec7e8676701a473ebc27591b7457f43470d436761d0d13d4f65d5876deb6e1

  • \Windows\SysWOW64\Cnmfdb32.exe

    Filesize

    80KB

    MD5

    efa99c0636caf366c867cf24d645fbf6

    SHA1

    d9f3fac836c5057e6061f3e2eada42cebfb74bbf

    SHA256

    acbecce322e42a7c26f8a9819fd12a8d8c074831429a66251488c49670c9f2ad

    SHA512

    6c1c7cc0df6e7b09a63d8a1f11673cb55db60852e2cc74ea2634e788b123da38bbf7b93b8b773146c754ff2acdf257d1d09bed054d1cac42fc04e08050833845

  • \Windows\SysWOW64\Dpapaj32.exe

    Filesize

    80KB

    MD5

    bd2b4153283e32d994ea25a332c245ee

    SHA1

    7ad9da038e478346153c4661ab1a3986a4c73a71

    SHA256

    db34caac1e6361163ec7146a3dc2da3456ab0983ebb162c3cf928674d1615907

    SHA512

    4926d35b9710253b3262b07949ba6cb6ab0d504a1974ea6d7347718f828718ce8876410587d9aad0b9381bac619e28a65335e00e5848d2bc6a2b0af56ff78815

  • memory/776-40-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/776-115-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/1656-119-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/2060-88-0x0000000000250000-0x0000000000285000-memory.dmp

    Filesize

    212KB

  • memory/2060-118-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/2060-80-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/2192-113-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/2192-0-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/2192-12-0x0000000000250000-0x0000000000285000-memory.dmp

    Filesize

    212KB

  • memory/2192-13-0x0000000000250000-0x0000000000285000-memory.dmp

    Filesize

    212KB

  • memory/2300-14-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/2300-114-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/2452-117-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/2452-67-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/2636-38-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/2676-57-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/2676-116-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/2676-60-0x0000000000280000-0x00000000002B5000-memory.dmp

    Filesize

    212KB

  • memory/2732-106-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/2732-120-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB