Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
111s -
max time network
81s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25/01/2025, 18:06
Static task
static1
Behavioral task
behavioral1
Sample
efa3e3cfe1623250e377c8b1fd0b97629aa5891650e0a599511e7072736003dbN.exe
Resource
win7-20241010-en
General
-
Target
efa3e3cfe1623250e377c8b1fd0b97629aa5891650e0a599511e7072736003dbN.exe
-
Size
650KB
-
MD5
e8e50f4980c6fdbcea86c758e1de2890
-
SHA1
fadc4953d55db131fa826a9713ddbcda81a19905
-
SHA256
efa3e3cfe1623250e377c8b1fd0b97629aa5891650e0a599511e7072736003db
-
SHA512
5c8447ce555a9393fbe799a9f9e988c69f3b4a1a836eebfd7e2f561da959214d3cdb2eff8753cf3c3677c8e740b652d50866390e2e505a9c51646cbd8f712121
-
SSDEEP
12288:RhMrzivePPYQmwPJKoXc8SM64DNRoXPirgSKzuq:jMHivMPUgSp4DNv0x
Malware Config
Extracted
bdaejec
ddos.dnsnb8.net
Signatures
-
Bdaejec family
-
Detects Bdaejec Backdoor. 1 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral1/memory/2864-47-0x00000000008A0000-0x00000000008A9000-memory.dmp family_bdaejec_backdoor -
resource yara_rule behavioral1/files/0x000c000000012264-3.dat aspack_v212_v242 behavioral1/memory/2864-17-0x0000000000020000-0x0000000000029000-memory.dmp aspack_v212_v242 -
Executes dropped EXE 1 IoCs
pid Process 2864 DhGOmd.exe -
Loads dropped DLL 5 IoCs
pid Process 2296 efa3e3cfe1623250e377c8b1fd0b97629aa5891650e0a599511e7072736003dbN.exe 2296 efa3e3cfe1623250e377c8b1fd0b97629aa5891650e0a599511e7072736003dbN.exe 2864 DhGOmd.exe 2864 DhGOmd.exe 2864 DhGOmd.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe DhGOmd.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe DhGOmd.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe DhGOmd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE DhGOmd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe DhGOmd.exe File opened for modification C:\Program Files\Java\jre7\bin\keytool.exe DhGOmd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe DhGOmd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe DhGOmd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe DhGOmd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe DhGOmd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe DhGOmd.exe File opened for modification C:\Program Files\Microsoft Games\Chess\Chess.exe DhGOmd.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe DhGOmd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe DhGOmd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CNFNOT32.EXE DhGOmd.exe File opened for modification C:\Program Files\Java\jre7\bin\jp2launcher.exe DhGOmd.exe File opened for modification C:\Program Files\Java\jre7\bin\servertool.exe DhGOmd.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{C3A4D3BC-D67A-4D2A-B0ED-B4E62D27E02C}\chrome_installer.exe DhGOmd.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe DhGOmd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe DhGOmd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe DhGOmd.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe DhGOmd.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe DhGOmd.exe File opened for modification C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe DhGOmd.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe DhGOmd.exe File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe DhGOmd.exe File opened for modification C:\Program Files\Windows Sidebar\sidebar.exe DhGOmd.exe File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe DhGOmd.exe File opened for modification C:\Program Files\Windows Mail\wab.exe DhGOmd.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe DhGOmd.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe DhGOmd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WORDICON.EXE DhGOmd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe DhGOmd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe DhGOmd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOUC.EXE DhGOmd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe DhGOmd.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE DhGOmd.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe DhGOmd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE DhGOmd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE DhGOmd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\XLICONS.EXE DhGOmd.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe DhGOmd.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe DhGOmd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe DhGOmd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe DhGOmd.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe DhGOmd.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe DhGOmd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe DhGOmd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe DhGOmd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe DhGOmd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe DhGOmd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe DhGOmd.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe DhGOmd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe DhGOmd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe DhGOmd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe DhGOmd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe DhGOmd.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe DhGOmd.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe DhGOmd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe DhGOmd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe DhGOmd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe DhGOmd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe DhGOmd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe DhGOmd.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language efa3e3cfe1623250e377c8b1fd0b97629aa5891650e0a599511e7072736003dbN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DhGOmd.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2296 wrote to memory of 2864 2296 efa3e3cfe1623250e377c8b1fd0b97629aa5891650e0a599511e7072736003dbN.exe 30 PID 2296 wrote to memory of 2864 2296 efa3e3cfe1623250e377c8b1fd0b97629aa5891650e0a599511e7072736003dbN.exe 30 PID 2296 wrote to memory of 2864 2296 efa3e3cfe1623250e377c8b1fd0b97629aa5891650e0a599511e7072736003dbN.exe 30 PID 2296 wrote to memory of 2864 2296 efa3e3cfe1623250e377c8b1fd0b97629aa5891650e0a599511e7072736003dbN.exe 30 PID 2296 wrote to memory of 2864 2296 efa3e3cfe1623250e377c8b1fd0b97629aa5891650e0a599511e7072736003dbN.exe 30 PID 2296 wrote to memory of 2864 2296 efa3e3cfe1623250e377c8b1fd0b97629aa5891650e0a599511e7072736003dbN.exe 30 PID 2296 wrote to memory of 2864 2296 efa3e3cfe1623250e377c8b1fd0b97629aa5891650e0a599511e7072736003dbN.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\efa3e3cfe1623250e377c8b1fd0b97629aa5891650e0a599511e7072736003dbN.exe"C:\Users\Admin\AppData\Local\Temp\efa3e3cfe1623250e377c8b1fd0b97629aa5891650e0a599511e7072736003dbN.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\DhGOmd.exeC:\Users\Admin\AppData\Local\Temp\DhGOmd.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2864
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NT668XG4\k2[1].rar
Filesize4B
MD5d3b07384d113edec49eaa6238ad5ff00
SHA1f1d2d2f924e986ac86fdf7b36c94bcdf32beec15
SHA256b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
SHA5120cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6
-
Filesize
4B
MD520879c987e2f9a916e578386d499f629
SHA1c7b33ddcc42361fdb847036fc07e880b81935d5d
SHA2569f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31
SHA512bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e