Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
106s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2024, 17:32
Static task
static1
Behavioral task
behavioral1
Sample
2024-12-30_aeb1a09445e8ba0de96796badc804d8f_smoke-loader_wapomi.exe
Resource
win7-20240903-en
General
-
Target
2024-12-30_aeb1a09445e8ba0de96796badc804d8f_smoke-loader_wapomi.exe
-
Size
36KB
-
MD5
aeb1a09445e8ba0de96796badc804d8f
-
SHA1
7bdfe635f14dd1b3f81b11902443ae08ae07eb63
-
SHA256
01d48152d2fc34ffee13135b23e23fa6cb8e442ae6d7eed32042b093d10b373f
-
SHA512
779f1e014b637de303007d85b41d9e8415ff6c7926856d3a58a52d8349bb61f88c9ec9a373d50f9163017b27114ad357cfbef344b4896c21c7188c2053753a16
-
SSDEEP
768:aA+m41HKUpOv068E4Mf4MMRt4MtV2n5Y8QGPL4vzZq2o9W7GsxBbPr:aA+m6qqOcVEP87T2n5YfGCq2iW7z
Malware Config
Extracted
bdaejec
ddos.dnsnb8.net
Signatures
-
Bdaejec family
-
Detects Bdaejec Backdoor. 1 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral2/memory/3220-8-0x00000000002E0000-0x00000000002E9000-memory.dmp family_bdaejec_backdoor -
resource yara_rule behavioral2/files/0x000c000000023b83-2.dat aspack_v212_v242 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation jaXY.exe -
Executes dropped EXE 1 IoCs
pid Process 3220 jaXY.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe jaXY.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe jaXY.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe jaXY.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe jaXY.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe jaXY.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe jaXY.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe jaXY.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe jaXY.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe jaXY.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe jaXY.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe jaXY.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe jaXY.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe jaXY.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe jaXY.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe jaXY.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe jaXY.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe jaXY.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe jaXY.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe jaXY.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateComRegisterShell64.exe jaXY.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe jaXY.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE jaXY.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe jaXY.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe jaXY.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe jaXY.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe jaXY.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe jaXY.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe jaXY.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe jaXY.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe jaXY.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe jaXY.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe jaXY.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe jaXY.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe jaXY.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe jaXY.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE jaXY.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe jaXY.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe jaXY.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe jaXY.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe jaXY.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe jaXY.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe jaXY.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe jaXY.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe jaXY.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE jaXY.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe jaXY.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe jaXY.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe jaXY.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe jaXY.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe jaXY.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe jaXY.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe jaXY.exe File opened for modification C:\Program Files\Windows Mail\wab.exe jaXY.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe jaXY.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe jaXY.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler.exe jaXY.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe jaXY.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe jaXY.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe jaXY.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe jaXY.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe jaXY.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe jaXY.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe jaXY.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe jaXY.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-12-30_aeb1a09445e8ba0de96796badc804d8f_smoke-loader_wapomi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaXY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3788 2024-12-30_aeb1a09445e8ba0de96796badc804d8f_smoke-loader_wapomi.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3788 wrote to memory of 3220 3788 2024-12-30_aeb1a09445e8ba0de96796badc804d8f_smoke-loader_wapomi.exe 82 PID 3788 wrote to memory of 3220 3788 2024-12-30_aeb1a09445e8ba0de96796badc804d8f_smoke-loader_wapomi.exe 82 PID 3788 wrote to memory of 3220 3788 2024-12-30_aeb1a09445e8ba0de96796badc804d8f_smoke-loader_wapomi.exe 82 PID 3220 wrote to memory of 3916 3220 jaXY.exe 92 PID 3220 wrote to memory of 3916 3220 jaXY.exe 92 PID 3220 wrote to memory of 3916 3220 jaXY.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-30_aeb1a09445e8ba0de96796badc804d8f_smoke-loader_wapomi.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-30_aeb1a09445e8ba0de96796badc804d8f_smoke-loader_wapomi.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\jaXY.exeC:\Users\Admin\AppData\Local\Temp\jaXY.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\14603999.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:3916
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
183B
MD5e40954bd860d1b4d9624743da3da3173
SHA1d772379c1a573b612592c0b146e4f05c480f980d
SHA2561f19cee7123dcad79eac0dddd8f8541b637b8f39a55f3e21e865cc8d74891e43
SHA512771b5485342822e8af6521568455c6dedc957298b51f1c51ebe7a6bc1db8c1c1ebcda725953d15de01d94a83020255e2536fa5b56ab08201dd4f9d21f64e0b43
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e