Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07/01/2025, 05:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8f5469d96f148afd08a0f693684f9bb0195a5291eb2437214c01465b463acbf8.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
General
-
Target
8f5469d96f148afd08a0f693684f9bb0195a5291eb2437214c01465b463acbf8.exe
-
Size
1.6MB
-
MD5
fa07873f37b171a5567a9b4b3f2c65eb
-
SHA1
47d5210522d8c54d3076c1467f2f495025037bb6
-
SHA256
8f5469d96f148afd08a0f693684f9bb0195a5291eb2437214c01465b463acbf8
-
SHA512
68a8f289ea6acdd7b79595cd8f7cde9ff468f2e26b56e1b7cef024b8a999f834a94e43c165a5a9b0c4b42008afb7b9446b29aa2019c68133d65409d631c19f29
-
SSDEEP
49152:XE4XbjEKOh3SbiwJjn7gu5LUvdW9apuLvht/cionurM0EIMa1:Xrj834iwJjn7gu5LmMapuNiiMurM0
Malware Config
Extracted
Family
bdaejec
C2
ddos.dnsnb8.net
Signatures
-
Bdaejec family
-
Detects Bdaejec Backdoor. 1 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral1/memory/2884-25-0x0000000000920000-0x0000000000929000-memory.dmp family_bdaejec_backdoor -
resource yara_rule behavioral1/files/0x0063000000011c27-10.dat aspack_v212_v242 -
Executes dropped EXE 1 IoCs
pid Process 2884 JdEV.exe -
Loads dropped DLL 2 IoCs
pid Process 2968 8f5469d96f148afd08a0f693684f9bb0195a5291eb2437214c01465b463acbf8.exe 2968 8f5469d96f148afd08a0f693684f9bb0195a5291eb2437214c01465b463acbf8.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe JdEV.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe JdEV.exe File opened for modification C:\Program Files\7-Zip\7zG.exe JdEV.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe JdEV.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe JdEV.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe JdEV.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe JdEV.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe JdEV.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe JdEV.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe JdEV.exe File opened for modification C:\Program Files\Java\jre7\bin\rmiregistry.exe JdEV.exe File opened for modification C:\Program Files\Windows Journal\Journal.exe JdEV.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe JdEV.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSPUB.EXE JdEV.exe File opened for modification C:\Program Files\7-Zip\7z.exe JdEV.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe JdEV.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe JdEV.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe JdEV.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe JdEV.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE JdEV.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.EXE JdEV.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE JdEV.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe JdEV.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe JdEV.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe JdEV.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe JdEV.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOUC.EXE JdEV.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe JdEV.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe JdEV.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe JdEV.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe JdEV.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe JdEV.exe File opened for modification C:\Program Files\Java\jre7\bin\klist.exe JdEV.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\Hearts.exe JdEV.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe JdEV.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe JdEV.exe File opened for modification C:\Program Files\Windows Mail\WinMail.exe JdEV.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe JdEV.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe JdEV.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{5059450D-F254-431C-8EC5-1212E61F2D77}\chrome_installer.exe JdEV.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe JdEV.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe JdEV.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe JdEV.exe File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe JdEV.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe JdEV.exe File opened for modification C:\Program Files\Windows Journal\PDIALOG.exe JdEV.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe JdEV.exe File opened for modification C:\Program Files\Java\jre7\bin\javacpl.exe JdEV.exe File opened for modification C:\Program Files\Microsoft Games\Chess\Chess.exe JdEV.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe JdEV.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WORDICON.EXE JdEV.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\XLICONS.EXE JdEV.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe JdEV.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe JdEV.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe JdEV.exe File opened for modification C:\Program Files\Windows Mail\wab.exe JdEV.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe JdEV.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\misc.exe JdEV.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OIS.EXE JdEV.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SETLANG.EXE JdEV.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe JdEV.exe File opened for modification C:\Program Files (x86)\Windows Mail\WinMail.exe JdEV.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe JdEV.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe JdEV.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\inf\oem0.PNF 8f5469d96f148afd08a0f693684f9bb0195a5291eb2437214c01465b463acbf8.exe File created C:\Windows\inf\oem1.PNF 8f5469d96f148afd08a0f693684f9bb0195a5291eb2437214c01465b463acbf8.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JdEV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8f5469d96f148afd08a0f693684f9bb0195a5291eb2437214c01465b463acbf8.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 2968 8f5469d96f148afd08a0f693684f9bb0195a5291eb2437214c01465b463acbf8.exe Token: SeRestorePrivilege 2968 8f5469d96f148afd08a0f693684f9bb0195a5291eb2437214c01465b463acbf8.exe Token: SeRestorePrivilege 2968 8f5469d96f148afd08a0f693684f9bb0195a5291eb2437214c01465b463acbf8.exe Token: SeRestorePrivilege 2968 8f5469d96f148afd08a0f693684f9bb0195a5291eb2437214c01465b463acbf8.exe Token: SeRestorePrivilege 2968 8f5469d96f148afd08a0f693684f9bb0195a5291eb2437214c01465b463acbf8.exe Token: SeRestorePrivilege 2968 8f5469d96f148afd08a0f693684f9bb0195a5291eb2437214c01465b463acbf8.exe Token: SeRestorePrivilege 2968 8f5469d96f148afd08a0f693684f9bb0195a5291eb2437214c01465b463acbf8.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2968 wrote to memory of 2884 2968 8f5469d96f148afd08a0f693684f9bb0195a5291eb2437214c01465b463acbf8.exe 31 PID 2968 wrote to memory of 2884 2968 8f5469d96f148afd08a0f693684f9bb0195a5291eb2437214c01465b463acbf8.exe 31 PID 2968 wrote to memory of 2884 2968 8f5469d96f148afd08a0f693684f9bb0195a5291eb2437214c01465b463acbf8.exe 31 PID 2968 wrote to memory of 2884 2968 8f5469d96f148afd08a0f693684f9bb0195a5291eb2437214c01465b463acbf8.exe 31 PID 2884 wrote to memory of 2668 2884 JdEV.exe 34 PID 2884 wrote to memory of 2668 2884 JdEV.exe 34 PID 2884 wrote to memory of 2668 2884 JdEV.exe 34 PID 2884 wrote to memory of 2668 2884 JdEV.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f5469d96f148afd08a0f693684f9bb0195a5291eb2437214c01465b463acbf8.exe"C:\Users\Admin\AppData\Local\Temp\8f5469d96f148afd08a0f693684f9bb0195a5291eb2437214c01465b463acbf8.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\JdEV.exeC:\Users\Admin\AppData\Local\Temp\JdEV.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\00ef4424.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:2668
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
183B
MD567e75b0b88383434a512bcaba4fc2c49
SHA12c6217f51386d8c0d6e5d35068b1aedc8b481c40
SHA256598862dbcf3dddad4fb0ca61b1462789f70aaf664bd367fa505d25af9f387db8
SHA512897dc948b998c67af679bb429a3a6861cb9e416f5fa564b449a65526eefbfdf557f0679cf87c85ee882626814f3c37fb29c1f06fa003e0369aad851ee7bf4cab
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e