Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    23s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    08/12/2024, 03:16

General

  • Target

    85a5a630a173c3d6f007ce11c20a681b90cc1c13a697e2d21ef0076bcfccec12N.exe

  • Size

    55KB

  • MD5

    b186a5f554c87e64e6395ca84119d7b0

  • SHA1

    fc85d47489ebf9778d6dc5d074eca02223197cb8

  • SHA256

    85a5a630a173c3d6f007ce11c20a681b90cc1c13a697e2d21ef0076bcfccec12

  • SHA512

    a738c9233c76f5df825d99bb18c2534466b5de2e09e969752a4a0c87e4692f7123a47c6df6d5f3a490d7a90f5f7142f8ab1137939782b23df3e5e258f6381f19

  • SSDEEP

    1536:e4CaNpnc031u1dIuAmphjjs+NSoNSd0A3shxD6T:Tlu1dzprjjs+NXNW0A8hho

Malware Config

Extracted

Family

berbew

C2

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Signatures

  • Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 18 IoCs
  • Berbew

    Berbew is a backdoor written in C++.

  • Berbew family
  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 22 IoCs
  • Drops file in System32 directory 27 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 30 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\85a5a630a173c3d6f007ce11c20a681b90cc1c13a697e2d21ef0076bcfccec12N.exe
    "C:\Users\Admin\AppData\Local\Temp\85a5a630a173c3d6f007ce11c20a681b90cc1c13a697e2d21ef0076bcfccec12N.exe"
    1⤵
    • Adds autorun key to be loaded by Explorer.exe on startup
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2816
    • C:\Windows\SysWOW64\Bbgnak32.exe
      C:\Windows\system32\Bbgnak32.exe
      2⤵
      • Adds autorun key to be loaded by Explorer.exe on startup
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2972
      • C:\Windows\SysWOW64\Beejng32.exe
        C:\Windows\system32\Beejng32.exe
        3⤵
        • Adds autorun key to be loaded by Explorer.exe on startup
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2828
        • C:\Windows\SysWOW64\Bbikgk32.exe
          C:\Windows\system32\Bbikgk32.exe
          4⤵
          • Adds autorun key to be loaded by Explorer.exe on startup
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:2840
          • C:\Windows\SysWOW64\Bjdplm32.exe
            C:\Windows\system32\Bjdplm32.exe
            5⤵
            • Adds autorun key to be loaded by Explorer.exe on startup
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:2740
            • C:\Windows\SysWOW64\Baohhgnf.exe
              C:\Windows\system32\Baohhgnf.exe
              6⤵
              • Adds autorun key to be loaded by Explorer.exe on startup
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in System32 directory
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:320
              • C:\Windows\SysWOW64\Bhhpeafc.exe
                C:\Windows\system32\Bhhpeafc.exe
                7⤵
                • Adds autorun key to be loaded by Explorer.exe on startup
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in System32 directory
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                PID:1504
                • C:\Windows\SysWOW64\Baadng32.exe
                  C:\Windows\system32\Baadng32.exe
                  8⤵
                  • Adds autorun key to be loaded by Explorer.exe on startup
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Drops file in System32 directory
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  • Suspicious use of WriteProcessMemory
                  PID:2908
                  • C:\Windows\SysWOW64\Cfnmfn32.exe
                    C:\Windows\system32\Cfnmfn32.exe
                    9⤵
                    • Adds autorun key to be loaded by Explorer.exe on startup
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Drops file in System32 directory
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    • Suspicious use of WriteProcessMemory
                    PID:2764
                    • C:\Windows\SysWOW64\Cacacg32.exe
                      C:\Windows\system32\Cacacg32.exe
                      10⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:2412
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 140
                        11⤵
                        • Loads dropped DLL
                        • Program crash
                        PID:2432

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\Bbgnak32.exe

    Filesize

    55KB

    MD5

    b85956872979d63ca25fa87e6fbfd874

    SHA1

    f4328483fc1272a92fc77b84296756ddf44723bd

    SHA256

    0f12f48c0c8a15f5df68225fbe80bd130257469ced032f51ce9071de01bc49d0

    SHA512

    edf8e1b2e796a4b594d810f5fb016b78f156a8e82b08d820c633131517799c348057ac9dee16dab2714ad8fc365e749875b6e1bce2dab3cf53b766aa591b6057

  • C:\Windows\SysWOW64\Bjdplm32.exe

    Filesize

    55KB

    MD5

    6e1d250ff486f821fb3f3fc6abf4dd63

    SHA1

    51d3f0407dad73701b8aa50d4e72d241436f0d24

    SHA256

    9f60e876b52e506478a40ce11333a1a74ad18c6ac55b9ce472560f88acd73cb3

    SHA512

    2306fa740eccac38bd1943c648ac6a3aba3300eb8535fe7deaf0b209c6dd7695fce5fbd2dbedb013ae495b9e68b72ed11090451dcd27d6308b9f3c3879e32ef5

  • \Windows\SysWOW64\Baadng32.exe

    Filesize

    55KB

    MD5

    55cae9a21cb96cd45118d498c5c688ba

    SHA1

    9aa43f8ad861a5bc0ddb58405cccdd5b87c93464

    SHA256

    add82e7fb4bbb080a6f5fdb7fa70fe2fa59527f54d839ad25d2fcc4647090772

    SHA512

    28bd40da80f1d7b0736cc0d7ac342c231b365cfdcc63fd14d192bbc6417e47b43339fbd0ada6cb64ae6884d1995c8f819b71bb1911d3b312f9f025bd6bfb9ca1

  • \Windows\SysWOW64\Baohhgnf.exe

    Filesize

    55KB

    MD5

    7e06e7cec97735d6c9bc0765b8a0f574

    SHA1

    bed3c53a2db6e7e17b3a168b175d65da9d64242d

    SHA256

    0524bf9d9ea37b85dbc38243619f76aa14f9072078c6901e41bff63a99f4c69a

    SHA512

    376b4800e75d79b37f3a1316c6afce14baaedefccd16a1fcfe6f11911a4c887fe6edd426f8ccfa4d8bf5ef22b0b961dfad0e734f831160bf8d7b98ec989fb70c

  • \Windows\SysWOW64\Bbikgk32.exe

    Filesize

    55KB

    MD5

    47430f59c4905bc651246050ebbc8bd8

    SHA1

    5d104280b5a04d37af80b791725a15fe5aebfefe

    SHA256

    892cbbbf917679582cdde97994ec140d04a11d8250acd9b4285b0e28513937f2

    SHA512

    97e66b48c9822ce12e1f8dedf10acb643336c7ff9e5afb24666e4c589b1e3a357890d10ea17bf0f8cf232251dbd770ef8a503eafc935b6836b68bf924e75c4b7

  • \Windows\SysWOW64\Beejng32.exe

    Filesize

    55KB

    MD5

    a28dad3fd91adc5fbd5cb984f5877010

    SHA1

    d5f481ccd6e3a36a15bb97b5dab222be42833a90

    SHA256

    439313591abc1fcfd2da5d7207a31e4de9509b3ea5621343be6515864a614499

    SHA512

    2f9eb157fd3788c0c01fda9170c26c25020a6dfefd81eb7263e2dbd143e0c23b9f0bb7ce9d03a6e8ba6daadd228d264e0b1dd44bc3cd0542c9c285a6522957ea

  • \Windows\SysWOW64\Bhhpeafc.exe

    Filesize

    55KB

    MD5

    d44ef635d233ce6a61992e5f611f5ae1

    SHA1

    cebc256bf3f64f4113f889469ce1952784ddf2dc

    SHA256

    8a9ac01654c2ed6737374b21c4fa81251da134aa153967fd75210c6bc4dff06e

    SHA512

    9b15baf3c0412d8cab34803353ce29b5e0a86cb249e0757421ed270c1d70245077e474855ef36b50dd1429957ecc176fe24c16209cdfa5cddab4d9b8ef63dfea

  • \Windows\SysWOW64\Cacacg32.exe

    Filesize

    55KB

    MD5

    2c437d1afd931cddf45975ca73e35ef8

    SHA1

    0fc0663910e54493c7de80e38e85f68709b52abb

    SHA256

    cfb1d4670885542ec07b1831782c33814a4a6bd45de34b2e5692b70ef4650b4a

    SHA512

    b91cdad6f084c9d96a3bd68d0f1b9b41861ad9d5948c5ec06f058c984867e2361681097ebda517c351a0268cce84e0d5bf82b5d19964b5065730804ed8f3a83d

  • \Windows\SysWOW64\Cfnmfn32.exe

    Filesize

    55KB

    MD5

    5f1b8e9678bdfe09b4e009a123e570dc

    SHA1

    63a8b6a9a148c127f144603b85c37e9c4999dd94

    SHA256

    e1cf4d789be04b3c36be880b2afa085f631c7263a51dde67126fadabb413449f

    SHA512

    f66fa19890353f3afe9c3de1808bff512eb2ea90b49b28de526c7a9d5fb68372f623046dc6d144a988c1c379b5e6fdef0b59737bc7f94a86614b2508df33c30e

  • memory/320-133-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/320-69-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/1504-90-0x00000000002E0000-0x000000000030F000-memory.dmp

    Filesize

    188KB

  • memory/1504-130-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/1504-82-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2412-144-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2740-55-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2740-63-0x0000000000250000-0x000000000027F000-memory.dmp

    Filesize

    188KB

  • memory/2740-134-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2764-117-0x0000000000250000-0x000000000027F000-memory.dmp

    Filesize

    188KB

  • memory/2764-145-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2764-109-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2816-18-0x0000000000260000-0x000000000028F000-memory.dmp

    Filesize

    188KB

  • memory/2816-17-0x0000000000260000-0x000000000028F000-memory.dmp

    Filesize

    188KB

  • memory/2816-141-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2816-0-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2828-27-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2828-138-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2828-39-0x00000000005C0000-0x00000000005EF000-memory.dmp

    Filesize

    188KB

  • memory/2840-53-0x0000000000250000-0x000000000027F000-memory.dmp

    Filesize

    188KB

  • memory/2840-41-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2840-140-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2908-96-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2908-131-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2972-21-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB