Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/01/2025, 05:21
Static task
static1
Behavioral task
behavioral1
Sample
faee0a2c405d4688f7c4492be0e41504583326d3dc72ca1c0c0632bb7746106a.exe
Resource
win7-20240903-en
General
-
Target
faee0a2c405d4688f7c4492be0e41504583326d3dc72ca1c0c0632bb7746106a.exe
-
Size
202KB
-
MD5
11274eb97c8085711cbcd0649c97ad18
-
SHA1
fd40e8b9936533a85300db78742ecaae2e9e76ad
-
SHA256
faee0a2c405d4688f7c4492be0e41504583326d3dc72ca1c0c0632bb7746106a
-
SHA512
70934eee43b3f0d4a0040ef8331ee8fbf906e587e4fc33e74fa4c6ceada3b28d5aedd4337cd314c6d184287040884446892469fd4427a21c6feeffdc043a4481
-
SSDEEP
3072:sRJvmrDKInaD2nc2JHUxWlj+UuwG1gImUF2bWhAns3pEUR6Nouti:s7vmrDKOaK7lj+UuwsgAdhn3pl6NoS
Malware Config
Extracted
bdaejec
ddos.dnsnb8.net
Signatures
-
Bdaejec family
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule behavioral1/memory/2072-56-0x0000000000400000-0x00000000004F2000-memory.dmp family_blackmoon -
Detects Bdaejec Backdoor. 1 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral1/memory/2984-54-0x00000000003A0000-0x00000000003A9000-memory.dmp family_bdaejec_backdoor -
resource yara_rule behavioral1/files/0x000a000000012033-2.dat aspack_v212_v242 -
Executes dropped EXE 1 IoCs
pid Process 2984 dcglfq.exe -
Loads dropped DLL 2 IoCs
pid Process 2072 faee0a2c405d4688f7c4492be0e41504583326d3dc72ca1c0c0632bb7746106a.exe 2072 faee0a2c405d4688f7c4492be0e41504583326d3dc72ca1c0c0632bb7746106a.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe dcglfq.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe dcglfq.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe dcglfq.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe dcglfq.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe dcglfq.exe File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe dcglfq.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\Hearts.exe dcglfq.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe dcglfq.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe dcglfq.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe dcglfq.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe dcglfq.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe dcglfq.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe dcglfq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe dcglfq.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\sidebar.exe dcglfq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe dcglfq.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe dcglfq.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe dcglfq.exe File opened for modification C:\Program Files\Java\jre7\bin\java.exe dcglfq.exe File opened for modification C:\Program Files\Windows Defender\MSASCui.exe dcglfq.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe dcglfq.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe dcglfq.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe dcglfq.exe File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe dcglfq.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe dcglfq.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe dcglfq.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSPUB.EXE dcglfq.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe dcglfq.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe dcglfq.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe dcglfq.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe dcglfq.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe dcglfq.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe dcglfq.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe dcglfq.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe dcglfq.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe dcglfq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe dcglfq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe dcglfq.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOUC.EXE dcglfq.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe dcglfq.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe dcglfq.exe File opened for modification C:\Program Files\Java\jre7\bin\servertool.exe dcglfq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe dcglfq.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE dcglfq.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe dcglfq.exe File opened for modification C:\Program Files\Java\jre7\bin\klist.exe dcglfq.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe dcglfq.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE dcglfq.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe dcglfq.exe File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe dcglfq.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE dcglfq.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe dcglfq.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe dcglfq.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe dcglfq.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe dcglfq.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{5059450D-F254-431C-8EC5-1212E61F2D77}\chrome_installer.exe dcglfq.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE dcglfq.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe dcglfq.exe File opened for modification C:\Program Files\Windows Journal\Journal.exe dcglfq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe dcglfq.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe dcglfq.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE dcglfq.exe File opened for modification C:\Program Files\7-Zip\7zG.exe dcglfq.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe dcglfq.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcglfq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language faee0a2c405d4688f7c4492be0e41504583326d3dc72ca1c0c0632bb7746106a.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2072 faee0a2c405d4688f7c4492be0e41504583326d3dc72ca1c0c0632bb7746106a.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2072 wrote to memory of 2984 2072 faee0a2c405d4688f7c4492be0e41504583326d3dc72ca1c0c0632bb7746106a.exe 30 PID 2072 wrote to memory of 2984 2072 faee0a2c405d4688f7c4492be0e41504583326d3dc72ca1c0c0632bb7746106a.exe 30 PID 2072 wrote to memory of 2984 2072 faee0a2c405d4688f7c4492be0e41504583326d3dc72ca1c0c0632bb7746106a.exe 30 PID 2072 wrote to memory of 2984 2072 faee0a2c405d4688f7c4492be0e41504583326d3dc72ca1c0c0632bb7746106a.exe 30 PID 2984 wrote to memory of 2692 2984 dcglfq.exe 32 PID 2984 wrote to memory of 2692 2984 dcglfq.exe 32 PID 2984 wrote to memory of 2692 2984 dcglfq.exe 32 PID 2984 wrote to memory of 2692 2984 dcglfq.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\faee0a2c405d4688f7c4492be0e41504583326d3dc72ca1c0c0632bb7746106a.exe"C:\Users\Admin\AppData\Local\Temp\faee0a2c405d4688f7c4492be0e41504583326d3dc72ca1c0c0632bb7746106a.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\dcglfq.exeC:\Users\Admin\AppData\Local\Temp\dcglfq.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\39e14735.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:2692
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4B
MD520879c987e2f9a916e578386d499f629
SHA1c7b33ddcc42361fdb847036fc07e880b81935d5d
SHA2569f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31
SHA512bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f
-
Filesize
187B
MD58173cb77fada34daa88e5d145fdc1c0a
SHA1010501b7ff6ce1e55975fb6de1e551f68c89be11
SHA2562b973fb0e9c30ba5e02bc2a0a08b57339901c59affd65a2204b753420cbf3b0c
SHA512a9b61beb9f12c81a42ea25a3249bdfb866c9e3c85e5451f54b9fd907cc20e98239f4a993be15c900186bab8c66c1b00aec86a4274efbdcb1d7911b9fb6de7774
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e