Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
125s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2024, 17:37
Static task
static1
Behavioral task
behavioral1
Sample
BaDBoY v5/BaDBoYv5.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
BaDBoY v5/BaDBoYv5.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
BaDBoY v5/BaDBoYv5.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
BaDBoY v5/BaDBoYv5.exe
Resource
win10v2004-20240802-en
General
-
Target
BaDBoY v5/BaDBoYv5.dll
-
Size
1.2MB
-
MD5
2c2d1d7ad662aaca332d0099fb07e7dc
-
SHA1
46a6d01a27f35cce7dd1e2834aa2b014f54d4d3b
-
SHA256
cdd7ea1cd6e463a2cfad102701d6bb2ced5271578d3b32809bb32c952bb68ec0
-
SHA512
16f0f8e1c194de4c852e54f593d7d960d86837dc2585deea94f35162493e9b740ee5cc129ceefc338835410ab4efa3fbc15bde2a2c7f2382b4afe50bb7a4b027
-
SSDEEP
12288:X2SH+ReYqxvO+uKqhBcywcRr64cxcqRK4EFHeSjwnA:X2m+RavIBFRzQKtFHeow
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4908 2028 WerFault.exe 87 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1824 wrote to memory of 2028 1824 rundll32.exe 87 PID 1824 wrote to memory of 2028 1824 rundll32.exe 87 PID 1824 wrote to memory of 2028 1824 rundll32.exe 87
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\BaDBoY v5\BaDBoYv5.dll",#11⤵
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\BaDBoY v5\BaDBoYv5.dll",#12⤵
- System Location Discovery: System Language Discovery
PID:2028 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 6323⤵
- Program crash
PID:4908
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 2028 -ip 20281⤵PID:1972
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3980,i,3239535018877284530,3457823197501312703,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:81⤵PID:3512