Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

0244bfc901...67.exe

windows7-x64

10

0244bfc901...67.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0244bfc901c3bfcc3b02f03eded4f227b72c2914253118f7adfc975f479cbd67

  • Size

    100KB

  • Sample

    241013-wscn1svdjm

  • MD5

    b23c09fcd79a65b15641f5907729e7da

  • SHA1

    7bc0a5bab79f270b1b9451c789507f199b9d02e0

  • SHA256

    0244bfc901c3bfcc3b02f03eded4f227b72c2914253118f7adfc975f479cbd67

  • SHA512

    4fee8b87e5d377b4214fce3b65b4179a11572e22a6e59e054bca6b702e684dc46ad99db0709987479c445d56f5dd7d12d6777217db60e83cd8175c42702d4a2a

  • SSDEEP

    3072:VkZtW8o/9STDMjjmcsCPi8Ca/Uwrw3lqwYX1Jm75tDqgb3a3+X13XRzT:VkZU8o/QTAWcsCPiDa/Uwrw1qwYX1JmZ

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      0244bfc901c3bfcc3b02f03eded4f227b72c2914253118f7adfc975f479cbd67

    • Size

      100KB

    • MD5

      b23c09fcd79a65b15641f5907729e7da

    • SHA1

      7bc0a5bab79f270b1b9451c789507f199b9d02e0

    • SHA256

      0244bfc901c3bfcc3b02f03eded4f227b72c2914253118f7adfc975f479cbd67

    • SHA512

      4fee8b87e5d377b4214fce3b65b4179a11572e22a6e59e054bca6b702e684dc46ad99db0709987479c445d56f5dd7d12d6777217db60e83cd8175c42702d4a2a

    • SSDEEP

      3072:VkZtW8o/9STDMjjmcsCPi8Ca/Uwrw3lqwYX1Jm75tDqgb3a3+X13XRzT:VkZU8o/QTAWcsCPiDa/Uwrw1qwYX1JmZ

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks