Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20250207-en -
resource tags
arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system -
submitted
08/02/2025, 05:15
Static task
static1
Behavioral task
behavioral1
Sample
4334fbc0ac72a47628bb24c5b68aeeff36db0017bee1ba00b795fd8381c05d06N.exe
Resource
win7-20241010-en
General
-
Target
4334fbc0ac72a47628bb24c5b68aeeff36db0017bee1ba00b795fd8381c05d06N.exe
-
Size
146KB
-
MD5
b857da006456d70eeed1d8077f0efc60
-
SHA1
dd4bd601fadb9837466dfcce8b4711bba2986315
-
SHA256
4334fbc0ac72a47628bb24c5b68aeeff36db0017bee1ba00b795fd8381c05d06
-
SHA512
03fa5286f87871752a11978478da2020e5b8259eccd03fb61c9d81031df374301a1d87ba16359d10fe0aa8296231eb0d30ad1e0e224eefecc7acea9597353da6
-
SSDEEP
3072:EEO9aq9pOM5nMCGJri8OioDw7LC89IAFF5J7P03xGCH:EEO9aq97nkll5Vc3k
Malware Config
Extracted
bdaejec
ddos.dnsnb8.net
Signatures
-
Bdaejec family
-
Detects Bdaejec Backdoor. 1 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral2/memory/4404-46-0x00000000004E0000-0x00000000004E9000-memory.dmp family_bdaejec_backdoor -
Downloads MZ/PE file 1 IoCs
flow pid Process 49 1400 Process not Found -
resource yara_rule behavioral2/files/0x000d000000023cbb-3.dat aspack_v212_v242 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-705198581-2062733989-3666524522-1000\Control Panel\International\Geo\Nation piIRVc.exe -
Executes dropped EXE 1 IoCs
pid Process 4404 piIRVc.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe piIRVc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe piIRVc.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe piIRVc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe piIRVc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE piIRVc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe piIRVc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe piIRVc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe piIRVc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE piIRVc.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe piIRVc.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateComRegisterShell64.exe piIRVc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe piIRVc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe piIRVc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE piIRVc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe piIRVc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteshare.exe piIRVc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe piIRVc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe piIRVc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe piIRVc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe piIRVc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.exe piIRVc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe piIRVc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe piIRVc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe piIRVc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe piIRVc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe piIRVc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe piIRVc.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe piIRVc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe piIRVc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe piIRVc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Maps.exe piIRVc.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler64.exe piIRVc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe piIRVc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe piIRVc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE piIRVc.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe piIRVc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe piIRVc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe piIRVc.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe piIRVc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe piIRVc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE piIRVc.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe piIRVc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe piIRVc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe piIRVc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe piIRVc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE piIRVc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe piIRVc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe piIRVc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe piIRVc.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe piIRVc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe piIRVc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe piIRVc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe piIRVc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe piIRVc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe piIRVc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe piIRVc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe piIRVc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe piIRVc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe piIRVc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe piIRVc.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe piIRVc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe piIRVc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Time.exe piIRVc.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe piIRVc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4334fbc0ac72a47628bb24c5b68aeeff36db0017bee1ba00b795fd8381c05d06N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language piIRVc.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1260 MicrosoftEdgeUpdate.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2168 wrote to memory of 4404 2168 4334fbc0ac72a47628bb24c5b68aeeff36db0017bee1ba00b795fd8381c05d06N.exe 86 PID 2168 wrote to memory of 4404 2168 4334fbc0ac72a47628bb24c5b68aeeff36db0017bee1ba00b795fd8381c05d06N.exe 86 PID 2168 wrote to memory of 4404 2168 4334fbc0ac72a47628bb24c5b68aeeff36db0017bee1ba00b795fd8381c05d06N.exe 86 PID 4404 wrote to memory of 664 4404 piIRVc.exe 90 PID 4404 wrote to memory of 664 4404 piIRVc.exe 90 PID 4404 wrote to memory of 664 4404 piIRVc.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\4334fbc0ac72a47628bb24c5b68aeeff36db0017bee1ba00b795fd8381c05d06N.exe"C:\Users\Admin\AppData\Local\Temp\4334fbc0ac72a47628bb24c5b68aeeff36db0017bee1ba00b795fd8381c05d06N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\piIRVc.exeC:\Users\Admin\AppData\Local\Temp\piIRVc.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3ebd60b6.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:664
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MERDQkFDMUMtQjhBNy00RkRFLUIwQ0EtQ0NDOTgxQzk0RjM2fSIgdXNlcmlkPSJ7QUE1RTczRDMtRDhDNy00NDJDLTlGRDYtNDU5RDVFNzE2QzQ3fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7Q0I0RkM3NTYtNkZBMy00NUUzLUE4NzYtRjQwODcwQzExM0RDfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDU4NjAiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODIxNjMwOTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MzQyMzI5NjU0Ii8-PC9hcHA-PC9yZXF1ZXN0Pg1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:1260
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4B
MD5d3b07384d113edec49eaa6238ad5ff00
SHA1f1d2d2f924e986ac86fdf7b36c94bcdf32beec15
SHA256b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
SHA5120cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6
-
Filesize
4B
MD520879c987e2f9a916e578386d499f629
SHA1c7b33ddcc42361fdb847036fc07e880b81935d5d
SHA2569f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31
SHA512bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f
-
Filesize
187B
MD5717e9a1bb074715899d3d0af96bd72bf
SHA14e3586d1d7b6fb94c44407c859e0d6c62ffedd4f
SHA2560e922b7b9aa96c3eeed77c83bccaaf377b266d7d10f8d8a41187d87aa701c72d
SHA512bae457b6c76b52a317287498d31f95105d0e9fc565fea06ba6be0ecd8846ffaca3a25da8fe5e19ce2fec18026ec5b4ee67e2139677e39cf9cb37f7c7fa7ea88f
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e