Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
18s -
max time network
19s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
19/03/2025, 05:10
Behavioral task
behavioral1
Sample
pidujaglbstbz.exe
Resource
win7-20250207-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
pidujaglbstbz.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
pidujaglbstbz.exe
-
Size
65KB
-
MD5
22b8951d084b1c03c65296963c279e93
-
SHA1
9a98bfe0bbcc1c6bd7cfb3bbb0d700f8f331f13f
-
SHA256
c223e1c1c0e0353806b01be751ce807243fee1d69cd2c2eb15cfbe4733b46cf9
-
SHA512
9b2badc3a7686374ea6c515c00e3b9a6f13b3404cc4ef04bd87ded8507da5350ba11ed036d2d97bb085c1bc3bb2f26630a3765451f14b2591c799db3e336bc68
-
SSDEEP
1536:ae8SMuDd+fK3F6Xs6Xj/rPl+oIvYTjipvFK:aeRrATPUPvYvQdK
Score
10/10
Malware Config
Signatures
-
Detects MyDoom family 2 IoCs
resource yara_rule behavioral2/memory/5872-86-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral2/memory/5872-87-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom -
Mydoom family
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x00090000000227af-2.dat acprotect -
Loads dropped DLL 1 IoCs
pid Process 5872 pidujaglbstbz.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pnexjkq = "C:\\Windows\\system32\\chhpapukc.exe" pidujaglbstbz.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\nrcpkbv.dll pidujaglbstbz.exe File opened for modification C:\Windows\SysWOW64\chhpapukc.exe pidujaglbstbz.exe File created C:\Windows\SysWOW64\chhpapukc.exe pidujaglbstbz.exe -
resource yara_rule behavioral2/memory/5872-0-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral2/memory/5872-5-0x0000000075000000-0x0000000075007000-memory.dmp upx behavioral2/files/0x00090000000227af-2.dat upx behavioral2/files/0x0007000000024303-15.dat upx behavioral2/memory/5872-86-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral2/memory/5872-87-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral2/memory/5872-88-0x0000000075000000-0x0000000075007000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\nl-NL\jalon.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\ink\th-TH\jmmsm.exe pidujaglbstbz.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\gcecvsl.zip pidujaglbstbz.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\dbgm.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\gtvggjk.exe pidujaglbstbz.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\xteezzulhu.zip pidujaglbstbz.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\qwiknfs.zip pidujaglbstbz.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\qvjkmp.zip pidujaglbstbz.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\gsifilykkf.exe pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\ink\ar-SA\jxwnmmwfeir.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\kaoctvsrkzs.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\qzmrq.exe pidujaglbstbz.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\hsbipkhbm.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\kbqdm.exe pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\ftaflzrgxxqs.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\ink\lv-LV\kgmeay.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-CN\gafjvzhymhlv.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\tvcmztfbl.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\ink\et-EE\hknsxziwoqduc.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\furm.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\mpqbf.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\ink\ru-RU\xdewqcmjpvc.exe pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\bsett.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\aeqckfiuatr.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\sqpgdno.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\eeze.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\utihdfpijusj.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\nlsbxpjee.exe pidujaglbstbz.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\cfdd.exe pidujaglbstbz.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\kdxx.zip pidujaglbstbz.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\ourycdcgjge.exe pidujaglbstbz.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\vjbakvrro.exe pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\ink\he-IL\hdktlpswez.zip pidujaglbstbz.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\tptcfmg.exe pidujaglbstbz.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\ziwvdmhoyxmb.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\fbnn.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\ink\hr-HR\pvlo.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\ezixftydjsaiu.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\ink\sv-SE\wwkxn.zip pidujaglbstbz.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\gverejjzoqvgq.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\swbjpzgg.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\ink\ko-KR\eqovhcxjhft.exe pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\ink\pt-BR\bupfdvrchqq.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\obhixnjlrj.exe pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\ink\fi-FI\thctauzl.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\avcyfzutccvo.exe pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\Triedit\en-US\fkgwqfb.zip pidujaglbstbz.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\cieft.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\ink\mckftf.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\VGX\ekne.exe pidujaglbstbz.exe File created C:\Program Files\dotnet\shared\kusbpepylnbl.zip pidujaglbstbz.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\iaow.exe pidujaglbstbz.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\yhdwptc.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\ink\el-GR\pcouul.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\ysmcaphb.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\ink\sl-SI\ecbgzz.zip pidujaglbstbz.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\uvzoygzyrbdw.zip pidujaglbstbz.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\vmhppakewxvuu.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\lpaspyfomsq.exe pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-TW\vndhr.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\Stationery\izvuhswejpe.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\Triedit\bqjsximfv.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\kxjkrl.zip pidujaglbstbz.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\qvhtnwqmjx.exe pidujaglbstbz.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pidujaglbstbz.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 5872 pidujaglbstbz.exe 5872 pidujaglbstbz.exe 5872 pidujaglbstbz.exe 5872 pidujaglbstbz.exe 5872 pidujaglbstbz.exe 5872 pidujaglbstbz.exe 5872 pidujaglbstbz.exe 5872 pidujaglbstbz.exe 5872 pidujaglbstbz.exe 5872 pidujaglbstbz.exe 5872 pidujaglbstbz.exe 5872 pidujaglbstbz.exe 5872 pidujaglbstbz.exe 5872 pidujaglbstbz.exe 5872 pidujaglbstbz.exe 5872 pidujaglbstbz.exe 5872 pidujaglbstbz.exe 5872 pidujaglbstbz.exe 5872 pidujaglbstbz.exe 5872 pidujaglbstbz.exe 5872 pidujaglbstbz.exe 5872 pidujaglbstbz.exe 5872 pidujaglbstbz.exe 5872 pidujaglbstbz.exe 5872 pidujaglbstbz.exe 5872 pidujaglbstbz.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\pidujaglbstbz.exe"C:\Users\Admin\AppData\Local\Temp\pidujaglbstbz.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5872
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD522b8951d084b1c03c65296963c279e93
SHA19a98bfe0bbcc1c6bd7cfb3bbb0d700f8f331f13f
SHA256c223e1c1c0e0353806b01be751ce807243fee1d69cd2c2eb15cfbe4733b46cf9
SHA5129b2badc3a7686374ea6c515c00e3b9a6f13b3404cc4ef04bd87ded8507da5350ba11ed036d2d97bb085c1bc3bb2f26630a3765451f14b2591c799db3e336bc68
-
Filesize
8KB
MD5797e2e4edd2bdfbd374c5bc1d338cf6d
SHA180e713b805b85774cb2ee93e1c5cba0cd0c53db1
SHA2560bf047b6d1e9d045cb314da9367f0741719bd711bc604b9df1e19f4ee61afab5
SHA512277c570e269c57c3bc3576e047c5aa8641ec6fa6425a69c637598476482cb9ca75cc31ee39a3e13623fa5fd52e0cb682aaad36ec2ecd866ee545b266edb24d84