Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

937ce1d09a...0N.exe

windows7-x64

10

937ce1d09a...0N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    937ce1d09a5b621c41ebd7b3c5808b42a9bfe5aac40fd2d4d948ec6ae1d83600N

  • Size

    88KB

  • Sample

    240928-fnwcka1bqe

  • MD5

    53e96ca6e2e217c48a603beec8b7a810

  • SHA1

    a1b63bc1d62cf4f031a38e818d28826620d12229

  • SHA256

    937ce1d09a5b621c41ebd7b3c5808b42a9bfe5aac40fd2d4d948ec6ae1d83600

  • SHA512

    d7f6018cb639be19809106fbe25e18c50036db0eac3f6f5c161dff3ed0dad09d1feea2ed262f227e8a42c1b84486c7676e5b6db09538b10144a8179603c0c7e0

  • SSDEEP

    1536:irbXl/Sumc0kVAeXCxHf43OojQe9E4nC9TnIVSZJg8hnouy8L:i/l/klkWi44oGSId8BoutL

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      937ce1d09a5b621c41ebd7b3c5808b42a9bfe5aac40fd2d4d948ec6ae1d83600N

    • Size

      88KB

    • MD5

      53e96ca6e2e217c48a603beec8b7a810

    • SHA1

      a1b63bc1d62cf4f031a38e818d28826620d12229

    • SHA256

      937ce1d09a5b621c41ebd7b3c5808b42a9bfe5aac40fd2d4d948ec6ae1d83600

    • SHA512

      d7f6018cb639be19809106fbe25e18c50036db0eac3f6f5c161dff3ed0dad09d1feea2ed262f227e8a42c1b84486c7676e5b6db09538b10144a8179603c0c7e0

    • SSDEEP

      1536:irbXl/Sumc0kVAeXCxHf43OojQe9E4nC9TnIVSZJg8hnouy8L:i/l/klkWi44oGSId8BoutL

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks