Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12/01/2025, 08:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d94dd6d211cb4d1256c8aac93812ac54e0447eeae5ffc3400d6e566f703e9bd6N.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
120 seconds
General
-
Target
d94dd6d211cb4d1256c8aac93812ac54e0447eeae5ffc3400d6e566f703e9bd6N.exe
-
Size
296KB
-
MD5
9dc7cd1629a4b4db9b98a6252169a3f0
-
SHA1
51d93267a098c1b3193082737fa007d3ea068795
-
SHA256
d94dd6d211cb4d1256c8aac93812ac54e0447eeae5ffc3400d6e566f703e9bd6
-
SHA512
5e3b06b6adec0549e5f62678e84ccb9390574b022a671936a6ab51caa5d47e2b8fef97abfc5f806c54092b810e3e19c0549e90ed8e6c15888dd272054762f38f
-
SSDEEP
6144:7MDcW16ZwIJssQ8Uy4UcYZVTc2rPzjJOHAOgxqqDLu23:7MDV1EEd+4UcUVTjPEHRqnu
Malware Config
Extracted
Family
bdaejec
C2
ddos.dnsnb8.net
Signatures
-
Bdaejec family
-
Detects Bdaejec Backdoor. 1 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral2/memory/3688-12-0x00000000009A0000-0x00000000009A9000-memory.dmp family_bdaejec_backdoor -
resource yara_rule behavioral2/files/0x000c000000023bae-3.dat aspack_v212_v242 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation OiXu.exe -
Executes dropped EXE 1 IoCs
pid Process 3688 OiXu.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe OiXu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe OiXu.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE OiXu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE OiXu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe OiXu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe OiXu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE OiXu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE OiXu.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe OiXu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe OiXu.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe OiXu.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe OiXu.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe OiXu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE OiXu.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe OiXu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe OiXu.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe OiXu.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe OiXu.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe OiXu.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe OiXu.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe OiXu.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe OiXu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE OiXu.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe OiXu.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe OiXu.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe OiXu.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe OiXu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe OiXu.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe OiXu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe OiXu.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe OiXu.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe OiXu.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe OiXu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe OiXu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe OiXu.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe OiXu.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe OiXu.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe OiXu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe OiXu.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe OiXu.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe OiXu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe OiXu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe OiXu.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe OiXu.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler.exe OiXu.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe OiXu.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe OiXu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE OiXu.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe OiXu.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe OiXu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe OiXu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe OiXu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE OiXu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE OiXu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE OiXu.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe OiXu.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe OiXu.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe OiXu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe OiXu.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe OiXu.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe OiXu.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe OiXu.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe OiXu.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe OiXu.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d94dd6d211cb4d1256c8aac93812ac54e0447eeae5ffc3400d6e566f703e9bd6N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OiXu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2452 wrote to memory of 3688 2452 d94dd6d211cb4d1256c8aac93812ac54e0447eeae5ffc3400d6e566f703e9bd6N.exe 84 PID 2452 wrote to memory of 3688 2452 d94dd6d211cb4d1256c8aac93812ac54e0447eeae5ffc3400d6e566f703e9bd6N.exe 84 PID 2452 wrote to memory of 3688 2452 d94dd6d211cb4d1256c8aac93812ac54e0447eeae5ffc3400d6e566f703e9bd6N.exe 84 PID 3688 wrote to memory of 1452 3688 OiXu.exe 86 PID 3688 wrote to memory of 1452 3688 OiXu.exe 86 PID 3688 wrote to memory of 1452 3688 OiXu.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\d94dd6d211cb4d1256c8aac93812ac54e0447eeae5ffc3400d6e566f703e9bd6N.exe"C:\Users\Admin\AppData\Local\Temp\d94dd6d211cb4d1256c8aac93812ac54e0447eeae5ffc3400d6e566f703e9bd6N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\OiXu.exeC:\Users\Admin\AppData\Local\Temp\OiXu.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3710113e.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:1452
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
183B
MD51daafc1a214d27cc8d6087ebf856a1a1
SHA17afc892cad557b53fd96022a60b8d0b625d91732
SHA256616210cb6b414a078dc700867b5c8ef61bb7d0acde7fca474502823fb8687ec0
SHA512fc1485aa87dceb6e44d6219011bbed8f2c31638e8b27aa9112f2d7670f451ae06fd457576236a1523fbe1944fdf1e7e653fb16020052673c90631a12c8627cc9
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e