Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
31/01/2025, 20:27
Static task
static1
Behavioral task
behavioral1
Sample
2025-01-31_4d37381b13904f93f2f932cf1d2422fb_smoke-loader_wapomi.exe
Resource
win7-20240903-en
General
-
Target
2025-01-31_4d37381b13904f93f2f932cf1d2422fb_smoke-loader_wapomi.exe
-
Size
208KB
-
MD5
4d37381b13904f93f2f932cf1d2422fb
-
SHA1
4b8e90748351e2b7453e607d9511559172cd5576
-
SHA256
5345e0a311537cbc92670e86d5df3b92ca60662ee1da2cd2561fff8fdf66de1e
-
SHA512
06b97f5fff2bbea1cc5b260defd020d9a2f466bdac2a458653d6a83408a078a5173d9302deb59bd99954b9539188b2eff39602a2f23682e338d38fb3bf958cdd
-
SSDEEP
3072:7Jw8KYg5zA5GsMYSxSJiN/vGss9kTBf9pAXAtPOYQwOGCH:7035iMhL/vGsbTBl2wOsn
Malware Config
Extracted
bdaejec
ddos.dnsnb8.net
Signatures
-
Bdaejec family
-
Detects Bdaejec Backdoor. 2 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral1/memory/2184-12-0x0000000001070000-0x0000000001079000-memory.dmp family_bdaejec_backdoor behavioral1/memory/2184-16-0x0000000001070000-0x0000000001079000-memory.dmp family_bdaejec_backdoor -
resource yara_rule behavioral1/files/0x00090000000122ee-4.dat aspack_v212_v242 -
Executes dropped EXE 1 IoCs
pid Process 2184 LxXcJG.exe -
Loads dropped DLL 2 IoCs
pid Process 2128 2025-01-31_4d37381b13904f93f2f932cf1d2422fb_smoke-loader_wapomi.exe 2128 2025-01-31_4d37381b13904f93f2f932cf1d2422fb_smoke-loader_wapomi.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe LxXcJG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe LxXcJG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe LxXcJG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe LxXcJG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe LxXcJG.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe LxXcJG.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe LxXcJG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe LxXcJG.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe LxXcJG.exe File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe LxXcJG.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe LxXcJG.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.EXE LxXcJG.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSACCESS.EXE LxXcJG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe LxXcJG.exe File opened for modification C:\Program Files\Java\jre7\bin\jp2launcher.exe LxXcJG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe LxXcJG.exe File opened for modification C:\Program Files\Windows Defender\MSASCui.exe LxXcJG.exe File opened for modification C:\Program Files\Windows Journal\Journal.exe LxXcJG.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe LxXcJG.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe LxXcJG.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCICONS.EXE LxXcJG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe LxXcJG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe LxXcJG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe LxXcJG.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSPUB.EXE LxXcJG.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE LxXcJG.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe LxXcJG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe LxXcJG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe LxXcJG.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe LxXcJG.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.EXE LxXcJG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe LxXcJG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe LxXcJG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe LxXcJG.exe File opened for modification C:\Program Files\Java\jre7\bin\servertool.exe LxXcJG.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe LxXcJG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe LxXcJG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe LxXcJG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe LxXcJG.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe LxXcJG.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE LxXcJG.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe LxXcJG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe LxXcJG.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SETLANG.EXE LxXcJG.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe LxXcJG.exe File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe LxXcJG.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CNFNOT32.EXE LxXcJG.exe File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe LxXcJG.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe LxXcJG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe LxXcJG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe LxXcJG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe LxXcJG.exe File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe LxXcJG.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe LxXcJG.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe LxXcJG.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe LxXcJG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe LxXcJG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe LxXcJG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe LxXcJG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe LxXcJG.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe LxXcJG.exe File opened for modification C:\Program Files\Windows Journal\PDIALOG.exe LxXcJG.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe LxXcJG.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.EXE LxXcJG.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-01-31_4d37381b13904f93f2f932cf1d2422fb_smoke-loader_wapomi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LxXcJG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2128 wrote to memory of 2184 2128 2025-01-31_4d37381b13904f93f2f932cf1d2422fb_smoke-loader_wapomi.exe 31 PID 2128 wrote to memory of 2184 2128 2025-01-31_4d37381b13904f93f2f932cf1d2422fb_smoke-loader_wapomi.exe 31 PID 2128 wrote to memory of 2184 2128 2025-01-31_4d37381b13904f93f2f932cf1d2422fb_smoke-loader_wapomi.exe 31 PID 2128 wrote to memory of 2184 2128 2025-01-31_4d37381b13904f93f2f932cf1d2422fb_smoke-loader_wapomi.exe 31 PID 2184 wrote to memory of 1520 2184 LxXcJG.exe 33 PID 2184 wrote to memory of 1520 2184 LxXcJG.exe 33 PID 2184 wrote to memory of 1520 2184 LxXcJG.exe 33 PID 2184 wrote to memory of 1520 2184 LxXcJG.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-31_4d37381b13904f93f2f932cf1d2422fb_smoke-loader_wapomi.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-31_4d37381b13904f93f2f932cf1d2422fb_smoke-loader_wapomi.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\LxXcJG.exeC:\Users\Admin\AppData\Local\Temp\LxXcJG.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\5b7f7170.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:1520
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
187B
MD56241eb0a666277fb26c040608f7651c9
SHA143c197fc3b39d2f8fc0fca20c75a07a4c80d615a
SHA2563dfacf1ad80d174256d7b45780089918f2e9308fe1e614c2f33a8cbc36124938
SHA5126f223577ff0a170f536664144e0e664789c7b0597500730eeb12f0696e52ca2e4e9dd0833b40ceaa2fa6e1e12d961ede9e84f8020e784860d472c169a00e8d26
-
Filesize
15KB
MD5f7d21de5c4e81341eccd280c11ddcc9a
SHA1d4e9ef10d7685d491583c6fa93ae5d9105d815bd
SHA2564485df22c627fa0bb899d79aa6ff29bc5be1dbc3caa2b7a490809338d54b7794
SHA512e4553b86b083996038bacfb979ad0b86f578f95185d8efac34a77f6cc73e491d4f70e1449bbc9eb1d62f430800c1574101b270e1cb0eeed43a83049a79b636a3