Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/01/2025, 08:37
Behavioral task
behavioral1
Sample
c5d6c0a69e5fd1c372c39dee82ab4f5ccc3c7b298a18db76f5807fb94154685a.exe
Resource
win7-20241023-en
General
-
Target
c5d6c0a69e5fd1c372c39dee82ab4f5ccc3c7b298a18db76f5807fb94154685a.exe
-
Size
313KB
-
MD5
9c3ec6b0ddfc4213212948ec3d1aeaac
-
SHA1
65512cd09b6bdee42ebbbe24ec7844e8a0e6c824
-
SHA256
c5d6c0a69e5fd1c372c39dee82ab4f5ccc3c7b298a18db76f5807fb94154685a
-
SHA512
e1201809a89b8826cc19f08e872be5be5fdf10cc41aac448240e839841542ed4c18b297a76e41c999fa05a99cf346a79fcb3add22e78fcff0fb1d1db988e025d
-
SSDEEP
6144:7qV54oUeSsMY3j0cI8rdYEylF2EHJ8Sj6vzHrh8wDVU3wMs9ZFWW:7qV5dU7oTWKYEEF5J87vzLh8aVJS
Malware Config
Extracted
bdaejec
ddos.dnsnb8.net
Signatures
-
Bdaejec family
-
Detects Bdaejec Backdoor. 1 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral2/memory/4660-48-0x0000000000C80000-0x0000000000C89000-memory.dmp family_bdaejec_backdoor -
resource yara_rule behavioral2/files/0x000c000000023b11-3.dat aspack_v212_v242 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation YrhAsn.exe -
Executes dropped EXE 1 IoCs
pid Process 4660 YrhAsn.exe -
resource yara_rule behavioral2/memory/1952-0-0x0000000000400000-0x00000000004D8000-memory.dmp upx behavioral2/memory/1952-50-0x0000000000400000-0x00000000004D8000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe YrhAsn.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe YrhAsn.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe YrhAsn.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe YrhAsn.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE YrhAsn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteshare.exe YrhAsn.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe YrhAsn.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe YrhAsn.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe YrhAsn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Maps.exe YrhAsn.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe YrhAsn.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe YrhAsn.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe YrhAsn.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe YrhAsn.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe YrhAsn.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe YrhAsn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe YrhAsn.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe YrhAsn.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe YrhAsn.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe YrhAsn.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe YrhAsn.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateComRegisterShell64.exe YrhAsn.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{CA9E0780-5A2C-43F8-9E63-52BCB11A02D4}\chrome_installer.exe YrhAsn.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE YrhAsn.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe YrhAsn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe YrhAsn.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe YrhAsn.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe YrhAsn.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe YrhAsn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe YrhAsn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe YrhAsn.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe YrhAsn.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe YrhAsn.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe YrhAsn.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe YrhAsn.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE YrhAsn.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe YrhAsn.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe YrhAsn.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe YrhAsn.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe YrhAsn.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe YrhAsn.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe YrhAsn.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe YrhAsn.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe YrhAsn.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe YrhAsn.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe YrhAsn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe YrhAsn.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateOnDemand.exe YrhAsn.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe YrhAsn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe YrhAsn.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe YrhAsn.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe YrhAsn.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe YrhAsn.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE YrhAsn.exe File opened for modification C:\Program Files\Windows Mail\wab.exe YrhAsn.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe YrhAsn.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe YrhAsn.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe YrhAsn.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe YrhAsn.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe YrhAsn.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe YrhAsn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe YrhAsn.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe YrhAsn.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe YrhAsn.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YrhAsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c5d6c0a69e5fd1c372c39dee82ab4f5ccc3c7b298a18db76f5807fb94154685a.exe -
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PAWN.Script\DefaultIcon c5d6c0a69e5fd1c372c39dee82ab4f5ccc3c7b298a18db76f5807fb94154685a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PAWN.Script c5d6c0a69e5fd1c372c39dee82ab4f5ccc3c7b298a18db76f5807fb94154685a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pwn\ = "PAWN.Script" c5d6c0a69e5fd1c372c39dee82ab4f5ccc3c7b298a18db76f5807fb94154685a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PAWN.Script\shell\Open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c5d6c0a69e5fd1c372c39dee82ab4f5ccc3c7b298a18db76f5807fb94154685a.exe \"%1\"" c5d6c0a69e5fd1c372c39dee82ab4f5ccc3c7b298a18db76f5807fb94154685a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.pwn c5d6c0a69e5fd1c372c39dee82ab4f5ccc3c7b298a18db76f5807fb94154685a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PAWN.Script\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c5d6c0a69e5fd1c372c39dee82ab4f5ccc3c7b298a18db76f5807fb94154685a.exe,1" c5d6c0a69e5fd1c372c39dee82ab4f5ccc3c7b298a18db76f5807fb94154685a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PAWN.Script\shell c5d6c0a69e5fd1c372c39dee82ab4f5ccc3c7b298a18db76f5807fb94154685a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PAWN.Script\shell\ = "Open" c5d6c0a69e5fd1c372c39dee82ab4f5ccc3c7b298a18db76f5807fb94154685a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PAWN.Script\shell\Open\command c5d6c0a69e5fd1c372c39dee82ab4f5ccc3c7b298a18db76f5807fb94154685a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PAWN.Script\shell\Open c5d6c0a69e5fd1c372c39dee82ab4f5ccc3c7b298a18db76f5807fb94154685a.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1952 wrote to memory of 4660 1952 c5d6c0a69e5fd1c372c39dee82ab4f5ccc3c7b298a18db76f5807fb94154685a.exe 82 PID 1952 wrote to memory of 4660 1952 c5d6c0a69e5fd1c372c39dee82ab4f5ccc3c7b298a18db76f5807fb94154685a.exe 82 PID 1952 wrote to memory of 4660 1952 c5d6c0a69e5fd1c372c39dee82ab4f5ccc3c7b298a18db76f5807fb94154685a.exe 82 PID 4660 wrote to memory of 1604 4660 YrhAsn.exe 83 PID 4660 wrote to memory of 1604 4660 YrhAsn.exe 83 PID 4660 wrote to memory of 1604 4660 YrhAsn.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\c5d6c0a69e5fd1c372c39dee82ab4f5ccc3c7b298a18db76f5807fb94154685a.exe"C:\Users\Admin\AppData\Local\Temp\c5d6c0a69e5fd1c372c39dee82ab4f5ccc3c7b298a18db76f5807fb94154685a.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\YrhAsn.exeC:\Users\Admin\AppData\Local\Temp\YrhAsn.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4a415a33.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:1604
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4B
MD5d3b07384d113edec49eaa6238ad5ff00
SHA1f1d2d2f924e986ac86fdf7b36c94bcdf32beec15
SHA256b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
SHA5120cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6
-
Filesize
4B
MD520879c987e2f9a916e578386d499f629
SHA1c7b33ddcc42361fdb847036fc07e880b81935d5d
SHA2569f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31
SHA512bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f
-
Filesize
187B
MD5fb29c67206059457a1f4e33ffa624ab1
SHA1c01aeff36d2e27a469d47d6f67e20f03dd5433d0
SHA256baf59c09b01c2ba5ed2b344ea0acd79bdb5f95e1d533ea8e2c463266002ab757
SHA5126308625b29658e0ae618cc63843e0b95fa88f3ce3ccac3a7883a6dfc5aae8d1c53749f453e76f88fee28bf62e1c1dca77a20fdf52beb5b847def9daf2c8a5109
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e