Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
31/01/2025, 20:24
Static task
static1
Behavioral task
behavioral1
Sample
2025-01-31_4d37381b13904f93f2f932cf1d2422fb_smoke-loader_wapomi.exe
Resource
win7-20240903-en
General
-
Target
2025-01-31_4d37381b13904f93f2f932cf1d2422fb_smoke-loader_wapomi.exe
-
Size
208KB
-
MD5
4d37381b13904f93f2f932cf1d2422fb
-
SHA1
4b8e90748351e2b7453e607d9511559172cd5576
-
SHA256
5345e0a311537cbc92670e86d5df3b92ca60662ee1da2cd2561fff8fdf66de1e
-
SHA512
06b97f5fff2bbea1cc5b260defd020d9a2f466bdac2a458653d6a83408a078a5173d9302deb59bd99954b9539188b2eff39602a2f23682e338d38fb3bf958cdd
-
SSDEEP
3072:7Jw8KYg5zA5GsMYSxSJiN/vGss9kTBf9pAXAtPOYQwOGCH:7035iMhL/vGsbTBl2wOsn
Malware Config
Extracted
bdaejec
ddos.dnsnb8.net
Signatures
-
Bdaejec family
-
Detects Bdaejec Backdoor. 2 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral1/memory/2732-12-0x0000000001120000-0x0000000001129000-memory.dmp family_bdaejec_backdoor behavioral1/memory/2732-23-0x0000000001120000-0x0000000001129000-memory.dmp family_bdaejec_backdoor -
resource yara_rule behavioral1/files/0x0003000000011c28-2.dat aspack_v212_v242 -
Executes dropped EXE 1 IoCs
pid Process 2732 LxXcJG.exe -
Loads dropped DLL 2 IoCs
pid Process 2208 2025-01-31_4d37381b13904f93f2f932cf1d2422fb_smoke-loader_wapomi.exe 2208 2025-01-31_4d37381b13904f93f2f932cf1d2422fb_smoke-loader_wapomi.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe LxXcJG.exe File opened for modification C:\Program Files\Windows Journal\PDIALOG.exe LxXcJG.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe LxXcJG.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\misc.exe LxXcJG.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE LxXcJG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe LxXcJG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe LxXcJG.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe LxXcJG.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe LxXcJG.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe LxXcJG.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe LxXcJG.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe LxXcJG.exe File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe LxXcJG.exe File opened for modification C:\Program Files\Java\jre7\bin\ssvagent.exe LxXcJG.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe LxXcJG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe LxXcJG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe LxXcJG.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe LxXcJG.exe File opened for modification C:\Program Files\Windows Mail\WinMail.exe LxXcJG.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE LxXcJG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe LxXcJG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe LxXcJG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe LxXcJG.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE LxXcJG.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\sidebar.exe LxXcJG.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE LxXcJG.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe LxXcJG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe LxXcJG.exe File opened for modification C:\Program Files\Microsoft Games\Chess\Chess.exe LxXcJG.exe File opened for modification C:\Program Files\Java\jre7\bin\servertool.exe LxXcJG.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe LxXcJG.exe File opened for modification C:\Program Files\Windows Mail\wab.exe LxXcJG.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE LxXcJG.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE LxXcJG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe LxXcJG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe LxXcJG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe LxXcJG.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE LxXcJG.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\XLICONS.EXE LxXcJG.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe LxXcJG.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe LxXcJG.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WORDICON.EXE LxXcJG.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CNFNOT32.EXE LxXcJG.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe LxXcJG.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SCANPST.EXE LxXcJG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe LxXcJG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe LxXcJG.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe LxXcJG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe LxXcJG.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE LxXcJG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe LxXcJG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe LxXcJG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe LxXcJG.exe File opened for modification C:\Program Files\Windows Sidebar\sidebar.exe LxXcJG.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe LxXcJG.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe LxXcJG.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{C650E966-B14F-4E38-8E3C-8BE886B090A9}\chrome_installer.exe LxXcJG.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSACCESS.EXE LxXcJG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe LxXcJG.exe File opened for modification C:\Program Files\Java\jre7\bin\jp2launcher.exe LxXcJG.exe File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe LxXcJG.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE LxXcJG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe LxXcJG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe LxXcJG.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LxXcJG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-01-31_4d37381b13904f93f2f932cf1d2422fb_smoke-loader_wapomi.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2208 wrote to memory of 2732 2208 2025-01-31_4d37381b13904f93f2f932cf1d2422fb_smoke-loader_wapomi.exe 30 PID 2208 wrote to memory of 2732 2208 2025-01-31_4d37381b13904f93f2f932cf1d2422fb_smoke-loader_wapomi.exe 30 PID 2208 wrote to memory of 2732 2208 2025-01-31_4d37381b13904f93f2f932cf1d2422fb_smoke-loader_wapomi.exe 30 PID 2208 wrote to memory of 2732 2208 2025-01-31_4d37381b13904f93f2f932cf1d2422fb_smoke-loader_wapomi.exe 30 PID 2732 wrote to memory of 2632 2732 LxXcJG.exe 31 PID 2732 wrote to memory of 2632 2732 LxXcJG.exe 31 PID 2732 wrote to memory of 2632 2732 LxXcJG.exe 31 PID 2732 wrote to memory of 2632 2732 LxXcJG.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-31_4d37381b13904f93f2f932cf1d2422fb_smoke-loader_wapomi.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-31_4d37381b13904f93f2f932cf1d2422fb_smoke-loader_wapomi.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\LxXcJG.exeC:\Users\Admin\AppData\Local\Temp\LxXcJG.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\4ca80e40.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:2632
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
187B
MD57248e757ed06514695e617676a1dae5d
SHA1041da8a38ad3eb8d07881500f194ead0a905c3ff
SHA2564dedb1a2c495a503c91c4d96b7a9004c155261526c81198c3c12c32b7d35c2fe
SHA512e142160fa77990cd6586842b19c8bb3a0de05403f11ae236d8c526a9b93ea3fdbb46fd8a4fd999d97f6d695f2b91dde64232b845b4d902b495bd19f2349ffde3
-
Filesize
15KB
MD5f7d21de5c4e81341eccd280c11ddcc9a
SHA1d4e9ef10d7685d491583c6fa93ae5d9105d815bd
SHA2564485df22c627fa0bb899d79aa6ff29bc5be1dbc3caa2b7a490809338d54b7794
SHA512e4553b86b083996038bacfb979ad0b86f578f95185d8efac34a77f6cc73e491d4f70e1449bbc9eb1d62f430800c1574101b270e1cb0eeed43a83049a79b636a3