Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/02/2025, 03:03
Static task
static1
Behavioral task
behavioral1
Sample
a58fe81aa10628b6f776015ce323d697ff7df887e04a54d42d61fe496f07a283.exe
Resource
win7-20240903-en
General
-
Target
a58fe81aa10628b6f776015ce323d697ff7df887e04a54d42d61fe496f07a283.exe
-
Size
28KB
-
MD5
e4ac95edac2f200de68ff07156a9aa96
-
SHA1
17e18a2f208464e303f4af2f1b6b0f3f0311abd9
-
SHA256
a58fe81aa10628b6f776015ce323d697ff7df887e04a54d42d61fe496f07a283
-
SHA512
c604109e5d1cf48946773915bf0ded2b0dc519e71150cc777d90e061aa2c6348fd25b86360358378ff85b51fcb893af57e4efb51027ecc8fe20e9334b77cbfc8
-
SSDEEP
384:51G/0strh1ieR5SSlXZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:C/0cLi8xbQGPL4vzZq2o9W7GsxBbPr
Malware Config
Extracted
bdaejec
ddos.dnsnb8.net
Signatures
-
Bdaejec family
-
Detects Bdaejec Backdoor. 1 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral1/memory/2196-13-0x00000000002D0000-0x00000000002D9000-memory.dmp family_bdaejec_backdoor -
resource yara_rule behavioral1/files/0x000b000000012029-2.dat aspack_v212_v242 -
Executes dropped EXE 1 IoCs
pid Process 2196 Modrng.exe -
Loads dropped DLL 2 IoCs
pid Process 2512 a58fe81aa10628b6f776015ce323d697ff7df887e04a54d42d61fe496f07a283.exe 2512 a58fe81aa10628b6f776015ce323d697ff7df887e04a54d42d61fe496f07a283.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe Modrng.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe Modrng.exe File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe Modrng.exe File opened for modification C:\Program Files\Java\jre7\bin\servertool.exe Modrng.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe Modrng.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WORDICON.EXE Modrng.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe Modrng.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe Modrng.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe Modrng.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe Modrng.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe Modrng.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE Modrng.exe File opened for modification C:\Program Files\7-Zip\7z.exe Modrng.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe Modrng.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe Modrng.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe Modrng.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe Modrng.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe Modrng.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe Modrng.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE Modrng.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe Modrng.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe Modrng.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe Modrng.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.EXE Modrng.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\XLICONS.EXE Modrng.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe Modrng.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe Modrng.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe Modrng.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe Modrng.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{C10A79F8-2372-49E3-801D-73DDEB38AD5B}\chrome_installer.exe Modrng.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe Modrng.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe Modrng.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\misc.exe Modrng.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe Modrng.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe Modrng.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe Modrng.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE Modrng.exe File opened for modification C:\Program Files\Windows Journal\PDIALOG.exe Modrng.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe Modrng.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe Modrng.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe Modrng.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe Modrng.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.EXE Modrng.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE Modrng.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE Modrng.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe Modrng.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe Modrng.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe Modrng.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CNFNOT32.EXE Modrng.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe Modrng.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.EXE Modrng.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\sidebar.exe Modrng.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe Modrng.exe File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe Modrng.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe Modrng.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE Modrng.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe Modrng.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe Modrng.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe Modrng.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe Modrng.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE Modrng.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe Modrng.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe Modrng.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE Modrng.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a58fe81aa10628b6f776015ce323d697ff7df887e04a54d42d61fe496f07a283.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Modrng.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2512 wrote to memory of 2196 2512 a58fe81aa10628b6f776015ce323d697ff7df887e04a54d42d61fe496f07a283.exe 30 PID 2512 wrote to memory of 2196 2512 a58fe81aa10628b6f776015ce323d697ff7df887e04a54d42d61fe496f07a283.exe 30 PID 2512 wrote to memory of 2196 2512 a58fe81aa10628b6f776015ce323d697ff7df887e04a54d42d61fe496f07a283.exe 30 PID 2512 wrote to memory of 2196 2512 a58fe81aa10628b6f776015ce323d697ff7df887e04a54d42d61fe496f07a283.exe 30 PID 2196 wrote to memory of 1340 2196 Modrng.exe 34 PID 2196 wrote to memory of 1340 2196 Modrng.exe 34 PID 2196 wrote to memory of 1340 2196 Modrng.exe 34 PID 2196 wrote to memory of 1340 2196 Modrng.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\a58fe81aa10628b6f776015ce323d697ff7df887e04a54d42d61fe496f07a283.exe"C:\Users\Admin\AppData\Local\Temp\a58fe81aa10628b6f776015ce323d697ff7df887e04a54d42d61fe496f07a283.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\Modrng.exeC:\Users\Admin\AppData\Local\Temp\Modrng.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\3e9345f3.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:1340
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
187B
MD54ae6611e3eb240193a8a67c4506e188f
SHA1bcd651323be50242ebc802a4eccbcbdc29bd0ba7
SHA256843a31f39efb9137dce5487466c5d9e3bfd19fe146c9ab7e84d5b9d5678446e0
SHA512b644204cebd194d70cba6e61dd1bae4c6603b516d7b5ccaa09d65bc085e46590dc9049acf5fb646d7521532c18c406cc51b5c9a5bc8a9e61c35044efe8cb7aa7
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e