Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    22/12/2024, 14:32

General

  • Target

    11a894eda03c9f0f6f988a19072ae05f2b64566e72df57ac8513eef6363ea0db.exe

  • Size

    64KB

  • MD5

    fdb20da21d876991baeff89b0980c20a

  • SHA1

    46044030dd50775e70dd18a5032a9f50b21fb1ff

  • SHA256

    11a894eda03c9f0f6f988a19072ae05f2b64566e72df57ac8513eef6363ea0db

  • SHA512

    a6d79655a88029dd1b0ceb82bf4dd3759ddc8717dec198963dee3e4647584fd438a0895edfefa2b0f2445fa5ea3b2dbf6c389849cf43c7edbcdd588502e405a1

  • SSDEEP

    768:yutwmI0IPaQ/dCBbc0qyrDPMnIKhw1wmPZ40gUXDCscG5AD/1H55XdnhgOPuM1Dg:8mIQbc+rDSIFwmB40ZzCscjFZuYDPY

Malware Config

Extracted

Family

berbew

C2

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Signatures

  • Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 22 IoCs
  • Berbew

    Berbew is a backdoor written in C++.

  • Berbew family
  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 25 IoCs
  • Drops file in System32 directory 35 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 36 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\11a894eda03c9f0f6f988a19072ae05f2b64566e72df57ac8513eef6363ea0db.exe
    "C:\Users\Admin\AppData\Local\Temp\11a894eda03c9f0f6f988a19072ae05f2b64566e72df57ac8513eef6363ea0db.exe"
    1⤵
    • Adds autorun key to be loaded by Explorer.exe on startup
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2064
    • C:\Windows\SysWOW64\Adnpkjde.exe
      C:\Windows\system32\Adnpkjde.exe
      2⤵
      • Adds autorun key to be loaded by Explorer.exe on startup
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2052
      • C:\Windows\SysWOW64\Bbbpenco.exe
        C:\Windows\system32\Bbbpenco.exe
        3⤵
        • Adds autorun key to be loaded by Explorer.exe on startup
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:1976
        • C:\Windows\SysWOW64\Bccmmf32.exe
          C:\Windows\system32\Bccmmf32.exe
          4⤵
          • Adds autorun key to be loaded by Explorer.exe on startup
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:2772
          • C:\Windows\SysWOW64\Boljgg32.exe
            C:\Windows\system32\Boljgg32.exe
            5⤵
            • Adds autorun key to be loaded by Explorer.exe on startup
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:2784
            • C:\Windows\SysWOW64\Bcjcme32.exe
              C:\Windows\system32\Bcjcme32.exe
              6⤵
              • Adds autorun key to be loaded by Explorer.exe on startup
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in System32 directory
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:2748
              • C:\Windows\SysWOW64\Ciihklpj.exe
                C:\Windows\system32\Ciihklpj.exe
                7⤵
                • Adds autorun key to be loaded by Explorer.exe on startup
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in System32 directory
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                PID:2264
                • C:\Windows\SysWOW64\Cepipm32.exe
                  C:\Windows\system32\Cepipm32.exe
                  8⤵
                  • Adds autorun key to be loaded by Explorer.exe on startup
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Drops file in System32 directory
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  • Suspicious use of WriteProcessMemory
                  PID:2644
                  • C:\Windows\SysWOW64\Cagienkb.exe
                    C:\Windows\system32\Cagienkb.exe
                    9⤵
                    • Adds autorun key to be loaded by Explorer.exe on startup
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Drops file in System32 directory
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    • Suspicious use of WriteProcessMemory
                    PID:2472
                    • C:\Windows\SysWOW64\Cjonncab.exe
                      C:\Windows\system32\Cjonncab.exe
                      10⤵
                      • Adds autorun key to be loaded by Explorer.exe on startup
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Drops file in System32 directory
                      • System Location Discovery: System Language Discovery
                      • Modifies registry class
                      • Suspicious use of WriteProcessMemory
                      PID:2956
                      • C:\Windows\SysWOW64\Cchbgi32.exe
                        C:\Windows\system32\Cchbgi32.exe
                        11⤵
                        • Adds autorun key to be loaded by Explorer.exe on startup
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Drops file in System32 directory
                        • System Location Discovery: System Language Discovery
                        • Modifies registry class
                        • Suspicious use of WriteProcessMemory
                        PID:2968
                        • C:\Windows\SysWOW64\Dpapaj32.exe
                          C:\Windows\system32\Dpapaj32.exe
                          12⤵
                          • Executes dropped EXE
                          • Drops file in System32 directory
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:1884
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 144
                            13⤵
                            • Loads dropped DLL
                            • Program crash
                            PID:1900

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\Bbbpenco.exe

    Filesize

    64KB

    MD5

    31b607e9002a4fa9dcbcb253d1b77dba

    SHA1

    ada020a669641d02220e234d4056c1c1fbdb91f6

    SHA256

    d829d9f574755d648e6f520659eb46b4758bb929fb8a04f8a61dddcb650ac018

    SHA512

    b2dd0b7ba6ce815dcc41b0301c3cf9efc7de06e2f19856b81e412393c5b8795dbc7c6d8517dd35ac540e15cb5be88f526a208336fb922ce1c9f0268a3dcff943

  • C:\Windows\SysWOW64\Bccmmf32.exe

    Filesize

    64KB

    MD5

    eaa0c53645c122c557053da7cd1244f4

    SHA1

    ce374d171b76dbf13f78f7d482a716e204af7904

    SHA256

    14eafcc8a76f5d81b81f0394a08787af655413b2142be7b99f0a291338bfd1b7

    SHA512

    90d7b24df696f809c3885d5d3c7f2a9ed697a599ecb56007e2034b4ebaeab7396babf9e37e9d34fa2b58a58f0a2522ffbea1340aa03758f08d1a22fa721a77ce

  • C:\Windows\SysWOW64\Dpapaj32.exe

    Filesize

    64KB

    MD5

    82da17a783e112b2f0f6ed4d976ac74a

    SHA1

    d20e5660b26dd9afc2d87e9c0f23fa1038102541

    SHA256

    c2e81e19cf39ac371086d301e5c9f8c9e25bb1d07407e740c9a719d2af37728b

    SHA512

    598cd40be65660e17267c446eaa07c2e30876b71c38930fa6a69c6395aabecae4ee65df7097623800f7ea3fb7202678127ea7a1e56126013f12397cac66101ea

  • \Windows\SysWOW64\Adnpkjde.exe

    Filesize

    64KB

    MD5

    13e7795f7bb4a28cb43e4709956d6fc0

    SHA1

    8fd480d9ef6c9bee9008378f492747e515629733

    SHA256

    28bdb69eb0203346eb0f405bfdfc60bd7d75a79f7fd407fd297109f17162d84c

    SHA512

    7500dde05cda2a2053528a783728f49cb344bed03c43c449cebd77e04ebc60fbfd00491aa2920045df5ac3a0446a4c084bfa4df37254048bfd8f5b5de35bf0ba

  • \Windows\SysWOW64\Bcjcme32.exe

    Filesize

    64KB

    MD5

    b81d1095cfc23fa1bba3c6c6047e1915

    SHA1

    2d110ffc0b8f6e964969d05354cb233c284bebc2

    SHA256

    61789590039335e01b3f4f0ce5f255bcb4c38d32e3f44ffc2d92ff2bb3923450

    SHA512

    add49c0fca81de0fadc6f860d7fd1d24830f3c041faa3070a4edfabb314d8968d8a8312c6370a6e81afe813fd0f8eb46037b0a013652eb56a895340729f36f88

  • \Windows\SysWOW64\Boljgg32.exe

    Filesize

    64KB

    MD5

    d965e688441d4f1b388f0a231b347229

    SHA1

    49a072892a09d3721fcf6833ea7c23a397f888c6

    SHA256

    9741ea7e9ded315920fec75467ce58138393e48e82321270c0b478d9f145aa68

    SHA512

    f795b4460963c26bc5f4d11823c6cb56695104e6e95432531f03b46a1e70c9af3a07bb25b033d25d467590bd5c4949dd7c180838668bf9b9db5f6c3c399030f8

  • \Windows\SysWOW64\Cagienkb.exe

    Filesize

    64KB

    MD5

    7fc97bf0d22bb51b73d8512f0bee79a0

    SHA1

    60562bcdaa46b3971e672a5b7c702f7009cf95a6

    SHA256

    c51586ac5029c160f4584931446a098f043cbac43cc2d040ca76300010b23fec

    SHA512

    962a808d4b2d706ab7603519b254cb74ac8da52d6af0bd8d0f16acbef2e5595c74360f586ee74d9cd37d4660660b12781441aec8ce3c83942ee09c1566b1e7b3

  • \Windows\SysWOW64\Cchbgi32.exe

    Filesize

    64KB

    MD5

    fdf9f414ce21838669f302905f511690

    SHA1

    a024e17e32fcb5c6e3aed163acab1e49b3e4e583

    SHA256

    5632d2218624670e93b36d0f2a357490af717cf147710d59e8017d2052f125c0

    SHA512

    50fe25e1317072631b0a1e92048d15793db5487f6fed626a2a964796e30cee48f245c1b5fc4bebc3347aeb204bad278c512c5fa7d9a875ffebd6c9b938dbb338

  • \Windows\SysWOW64\Cepipm32.exe

    Filesize

    64KB

    MD5

    547ad5e66c48b4aab420380300bbabba

    SHA1

    251a086c1859718defcfaba2d889c1e369ed096b

    SHA256

    fd681fe6ba81a533e7858eeff052b5bb25849505cef5f750bfc60a236ca7ce96

    SHA512

    df141610eb4eda930ed406d1650f44a1f5a4e947bb3ccd73b5219aa57506ca5977800e1d659c710e8d2030558e6f9bd53cc9fd015f9aba8c8110e99c7d033533

  • \Windows\SysWOW64\Ciihklpj.exe

    Filesize

    64KB

    MD5

    fe74728c0e0590209ad672c90df3ec2b

    SHA1

    0e040941ff00b75edafd7fbdeae02b4a60342d4c

    SHA256

    d5efedd1217a0f007d38f8f33d91db5c98873e64777a985622dca28b5bb5129b

    SHA512

    8395157c0a040a1f0c74d706233a0f781aca20757715972778434707d907215a9390befde28d5dc38048ffb9fafe17a4c9a840d9758e423550de40d7b92ca4db

  • \Windows\SysWOW64\Cjonncab.exe

    Filesize

    64KB

    MD5

    fb4f84d74164085321c55d91b810c13d

    SHA1

    2b03a6428c0c4f43c956b81b32224c04157005b8

    SHA256

    e76a822b360a6122c7a7351c07b761a2fe91fce8c2b76ca3bf97d551fd0aac8a

    SHA512

    fc9a4c0b1bdf49e38b2673542336a0132da68db69138abc62834f3163002dba43e479baa5befbe7e3c239726eb1a1562791f3933572218089127699df77ae67d

  • memory/1884-159-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/1976-34-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2052-32-0x0000000000220000-0x0000000000253000-memory.dmp

    Filesize

    204KB

  • memory/2052-33-0x0000000000220000-0x0000000000253000-memory.dmp

    Filesize

    204KB

  • memory/2052-19-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2064-12-0x0000000000220000-0x0000000000253000-memory.dmp

    Filesize

    204KB

  • memory/2064-158-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2064-0-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2064-7-0x0000000000220000-0x0000000000253000-memory.dmp

    Filesize

    204KB

  • memory/2264-162-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2472-120-0x0000000000440000-0x0000000000473000-memory.dmp

    Filesize

    204KB

  • memory/2472-108-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2472-164-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2644-95-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2644-165-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2748-77-0x0000000000220000-0x0000000000253000-memory.dmp

    Filesize

    204KB

  • memory/2748-69-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2748-163-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2772-42-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2772-161-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2772-50-0x00000000001B0000-0x00000000001E3000-memory.dmp

    Filesize

    204KB

  • memory/2784-167-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2784-56-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2956-166-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2956-128-0x00000000002C0000-0x00000000002F3000-memory.dmp

    Filesize

    204KB

  • memory/2968-141-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2968-143-0x00000000002C0000-0x00000000002F3000-memory.dmp

    Filesize

    204KB

  • memory/2968-155-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB