Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25/12/2024, 12:26
Behavioral task
behavioral1
Sample
2024-12-25_987690fecfded5445a5183029584e05d_floxif_smoke-loader.exe
Resource
win7-20241010-en
General
-
Target
2024-12-25_987690fecfded5445a5183029584e05d_floxif_smoke-loader.exe
-
Size
134KB
-
MD5
987690fecfded5445a5183029584e05d
-
SHA1
603b14e0603bed157565156067ca9fdbe98ad5a9
-
SHA256
e8d5c8ff924da84563d5294bd9d14c12794be05a63b204ce2896e9889caedd41
-
SHA512
ebc84c7fe6b61453f51320ccf648a49b41e46b96042375548a92481c7e35af67820947d761732f114c1bddd48b21e32bba9efc060f67666dd16137b6a6c1c3d7
-
SSDEEP
3072:9w/3d/GWR7lxqhxPIG7Qe2lQBV+UdE+rECWp7hKOR4EPL:gd/GUZEhL75BV+UdvrEFp7hKORHPL
Malware Config
Extracted
bdaejec
ddos.dnsnb8.net
Signatures
-
Bdaejec family
-
Detects Bdaejec Backdoor. 1 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral1/memory/2584-65-0x00000000011E0000-0x00000000011E9000-memory.dmp family_bdaejec_backdoor -
Floxif family
-
Detected Nirsoft tools 1 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule behavioral1/memory/2032-38-0x0000000000400000-0x0000000000420000-memory.dmp Nirsoft -
Detects Floxif payload 1 IoCs
resource yara_rule behavioral1/files/0x00080000000120fc-3.dat floxif -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x00080000000120fc-3.dat acprotect -
resource yara_rule behavioral1/files/0x00080000000194e6-9.dat aspack_v212_v242 -
Executes dropped EXE 1 IoCs
pid Process 2584 LobpFI.exe -
Loads dropped DLL 3 IoCs
pid Process 2032 2024-12-25_987690fecfded5445a5183029584e05d_floxif_smoke-loader.exe 2032 2024-12-25_987690fecfded5445a5183029584e05d_floxif_smoke-loader.exe 2032 2024-12-25_987690fecfded5445a5183029584e05d_floxif_smoke-loader.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\e: 2024-12-25_987690fecfded5445a5183029584e05d_floxif_smoke-loader.exe -
resource yara_rule behavioral1/memory/2032-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/2032-5-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/files/0x00080000000120fc-3.dat upx behavioral1/memory/2032-8-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/2032-38-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/2032-68-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/2032-71-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/2032-75-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/2032-79-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/2032-83-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/2032-87-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/2032-91-0x0000000010000000-0x0000000010030000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\System\symsrv.dll 2024-12-25_987690fecfded5445a5183029584e05d_floxif_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe LobpFI.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe LobpFI.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe LobpFI.exe File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe LobpFI.exe File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe LobpFI.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe LobpFI.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe LobpFI.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSQRY32.EXE LobpFI.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE LobpFI.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe LobpFI.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe LobpFI.exe File opened for modification C:\Program Files\Java\jre7\bin\rmid.exe LobpFI.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe LobpFI.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe LobpFI.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe LobpFI.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe LobpFI.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe LobpFI.exe File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe LobpFI.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSACCESS.EXE LobpFI.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe LobpFI.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe LobpFI.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe LobpFI.exe File opened for modification C:\Program Files\Java\jre7\bin\servertool.exe LobpFI.exe File opened for modification C:\Program Files\Windows Journal\PDIALOG.exe LobpFI.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OIS.EXE LobpFI.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe LobpFI.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe LobpFI.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe LobpFI.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe LobpFI.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe LobpFI.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe LobpFI.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe LobpFI.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe LobpFI.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe LobpFI.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.EXE LobpFI.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE LobpFI.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe LobpFI.exe File opened for modification C:\Program Files\Java\jre7\bin\klist.exe LobpFI.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\misc.exe LobpFI.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE LobpFI.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SCANPST.EXE LobpFI.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe LobpFI.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe LobpFI.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe LobpFI.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe LobpFI.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe LobpFI.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe LobpFI.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe LobpFI.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE LobpFI.exe File created \??\c:\program files\common files\system\symsrv.dll.000 2024-12-25_987690fecfded5445a5183029584e05d_floxif_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe LobpFI.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe LobpFI.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe LobpFI.exe File opened for modification C:\Program Files\Windows Mail\WinMail.exe LobpFI.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe LobpFI.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe LobpFI.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe LobpFI.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe LobpFI.exe File opened for modification C:\Program Files\Windows Journal\Journal.exe LobpFI.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe LobpFI.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSPUB.EXE LobpFI.exe File opened for modification C:\Program Files (x86)\Windows Mail\WinMail.exe LobpFI.exe File opened for modification C:\Program Files\7-Zip\7z.exe LobpFI.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-12-25_987690fecfded5445a5183029584e05d_floxif_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LobpFI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2032 2024-12-25_987690fecfded5445a5183029584e05d_floxif_smoke-loader.exe 2032 2024-12-25_987690fecfded5445a5183029584e05d_floxif_smoke-loader.exe 2032 2024-12-25_987690fecfded5445a5183029584e05d_floxif_smoke-loader.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2032 2024-12-25_987690fecfded5445a5183029584e05d_floxif_smoke-loader.exe -
Suspicious use of FindShellTrayWindow 13 IoCs
pid Process 2032 2024-12-25_987690fecfded5445a5183029584e05d_floxif_smoke-loader.exe 2032 2024-12-25_987690fecfded5445a5183029584e05d_floxif_smoke-loader.exe 2032 2024-12-25_987690fecfded5445a5183029584e05d_floxif_smoke-loader.exe 2032 2024-12-25_987690fecfded5445a5183029584e05d_floxif_smoke-loader.exe 2032 2024-12-25_987690fecfded5445a5183029584e05d_floxif_smoke-loader.exe 2032 2024-12-25_987690fecfded5445a5183029584e05d_floxif_smoke-loader.exe 2032 2024-12-25_987690fecfded5445a5183029584e05d_floxif_smoke-loader.exe 2032 2024-12-25_987690fecfded5445a5183029584e05d_floxif_smoke-loader.exe 2032 2024-12-25_987690fecfded5445a5183029584e05d_floxif_smoke-loader.exe 2032 2024-12-25_987690fecfded5445a5183029584e05d_floxif_smoke-loader.exe 2032 2024-12-25_987690fecfded5445a5183029584e05d_floxif_smoke-loader.exe 2032 2024-12-25_987690fecfded5445a5183029584e05d_floxif_smoke-loader.exe 2032 2024-12-25_987690fecfded5445a5183029584e05d_floxif_smoke-loader.exe -
Suspicious use of SendNotifyMessage 13 IoCs
pid Process 2032 2024-12-25_987690fecfded5445a5183029584e05d_floxif_smoke-loader.exe 2032 2024-12-25_987690fecfded5445a5183029584e05d_floxif_smoke-loader.exe 2032 2024-12-25_987690fecfded5445a5183029584e05d_floxif_smoke-loader.exe 2032 2024-12-25_987690fecfded5445a5183029584e05d_floxif_smoke-loader.exe 2032 2024-12-25_987690fecfded5445a5183029584e05d_floxif_smoke-loader.exe 2032 2024-12-25_987690fecfded5445a5183029584e05d_floxif_smoke-loader.exe 2032 2024-12-25_987690fecfded5445a5183029584e05d_floxif_smoke-loader.exe 2032 2024-12-25_987690fecfded5445a5183029584e05d_floxif_smoke-loader.exe 2032 2024-12-25_987690fecfded5445a5183029584e05d_floxif_smoke-loader.exe 2032 2024-12-25_987690fecfded5445a5183029584e05d_floxif_smoke-loader.exe 2032 2024-12-25_987690fecfded5445a5183029584e05d_floxif_smoke-loader.exe 2032 2024-12-25_987690fecfded5445a5183029584e05d_floxif_smoke-loader.exe 2032 2024-12-25_987690fecfded5445a5183029584e05d_floxif_smoke-loader.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2032 wrote to memory of 2584 2032 2024-12-25_987690fecfded5445a5183029584e05d_floxif_smoke-loader.exe 30 PID 2032 wrote to memory of 2584 2032 2024-12-25_987690fecfded5445a5183029584e05d_floxif_smoke-loader.exe 30 PID 2032 wrote to memory of 2584 2032 2024-12-25_987690fecfded5445a5183029584e05d_floxif_smoke-loader.exe 30 PID 2032 wrote to memory of 2584 2032 2024-12-25_987690fecfded5445a5183029584e05d_floxif_smoke-loader.exe 30 PID 2584 wrote to memory of 672 2584 LobpFI.exe 33 PID 2584 wrote to memory of 672 2584 LobpFI.exe 33 PID 2584 wrote to memory of 672 2584 LobpFI.exe 33 PID 2584 wrote to memory of 672 2584 LobpFI.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-25_987690fecfded5445a5183029584e05d_floxif_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-25_987690fecfded5445a5183029584e05d_floxif_smoke-loader.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\LobpFI.exeC:\Users\Admin\AppData\Local\Temp\LobpFI.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\5e623b4e.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:672
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175B
MD51130c911bf5db4b8f7cf9b6f4b457623
SHA148e734c4bc1a8b5399bff4954e54b268bde9d54c
SHA256eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1
SHA51294e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0
-
Filesize
187B
MD535a50fda4976759f6595e1bde5f05f93
SHA18d7722b20042bf25ab611b0348e13bf5954eb94d
SHA256d4f275b759cc288eceae225c54de987642ac92cfb64b6fad10dd20e0ffdadd05
SHA512488240a5db7cbdcd9911292da0a61b4c6bfce651fbd0c37022e267ee3b5c9df5082dfd12917e5139b432ab4d9163804428bb7d6b5ab02b64e9e40aa32beb680d
-
Filesize
4B
MD520879c987e2f9a916e578386d499f629
SHA1c7b33ddcc42361fdb847036fc07e880b81935d5d
SHA2569f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31
SHA512bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f
-
Filesize
67KB
MD57574cf2c64f35161ab1292e2f532aabf
SHA114ba3fa927a06224dfe587014299e834def4644f
SHA256de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA5124db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e