Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19/03/2025, 05:18
Behavioral task
behavioral1
Sample
pidujaglbstbz.exe
Resource
win7-20241010-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
pidujaglbstbz.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
pidujaglbstbz.exe
-
Size
65KB
-
MD5
22b8951d084b1c03c65296963c279e93
-
SHA1
9a98bfe0bbcc1c6bd7cfb3bbb0d700f8f331f13f
-
SHA256
c223e1c1c0e0353806b01be751ce807243fee1d69cd2c2eb15cfbe4733b46cf9
-
SHA512
9b2badc3a7686374ea6c515c00e3b9a6f13b3404cc4ef04bd87ded8507da5350ba11ed036d2d97bb085c1bc3bb2f26630a3765451f14b2591c799db3e336bc68
-
SSDEEP
1536:ae8SMuDd+fK3F6Xs6Xj/rPl+oIvYTjipvFK:aeRrATPUPvYvQdK
Score
10/10
Malware Config
Signatures
-
Detects MyDoom family 15 IoCs
resource yara_rule behavioral1/memory/2488-12-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral1/memory/2488-13-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral1/memory/2488-22-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral1/memory/2488-29-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral1/memory/2488-34-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral1/memory/2488-40-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral1/memory/2488-47-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral1/memory/2488-51-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral1/memory/2488-57-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral1/memory/2488-101-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral1/memory/2488-228-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral1/memory/2488-251-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral1/memory/2488-257-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral1/memory/2488-264-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral1/memory/2488-269-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom -
Mydoom family
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x0009000000012266-2.dat acprotect -
Loads dropped DLL 1 IoCs
pid Process 2488 pidujaglbstbz.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\zbuvt = "C:\\Windows\\system32\\xasrek.exe" pidujaglbstbz.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\otay.dll pidujaglbstbz.exe File opened for modification C:\Windows\SysWOW64\xasrek.exe pidujaglbstbz.exe File created C:\Windows\SysWOW64\xasrek.exe pidujaglbstbz.exe -
resource yara_rule behavioral1/memory/2488-0-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/memory/2488-4-0x0000000075000000-0x0000000075007000-memory.dmp upx behavioral1/files/0x0009000000012266-2.dat upx behavioral1/memory/2488-12-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/memory/2488-13-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/memory/2488-14-0x0000000075000000-0x0000000075007000-memory.dmp upx behavioral1/files/0x0008000000018baf-15.dat upx behavioral1/memory/2488-22-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/memory/2488-29-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/memory/2488-34-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/memory/2488-40-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/memory/2488-47-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/memory/2488-51-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/memory/2488-57-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/memory/2488-101-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/memory/2488-228-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/memory/2488-251-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/memory/2488-257-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/memory/2488-264-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/memory/2488-269-0x0000000000500000-0x000000000050F000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PROPLUS\aaazmbplb.zip pidujaglbstbz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\yruedv.zip pidujaglbstbz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\InfoPath.en-us\sgyff.zip pidujaglbstbz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\qbrc.exe pidujaglbstbz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SUMIPNTG\iojqtbfeb.zip pidujaglbstbz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\ikdzdaghox.zip pidujaglbstbz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\alhphdij.zip pidujaglbstbz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\TextConv\es-ES\zcshm.zip pidujaglbstbz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\jygabusalmada.zip pidujaglbstbz.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\ifdr.zip pidujaglbstbz.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\fyljxljvrfmqu.zip pidujaglbstbz.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\tcdhmfps.zip pidujaglbstbz.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\iaudyr.zip pidujaglbstbz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\anexcbygzz.zip pidujaglbstbz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\ealalylqyy.zip pidujaglbstbz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STRTEDGE\qhsmvq.zip pidujaglbstbz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENES\qoogaqbjgy.zip pidujaglbstbz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Triedit\es-ES\agvn.zip pidujaglbstbz.exe File created C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\jleptq.zip pidujaglbstbz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\xtfgz.zip pidujaglbstbz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\vvkmvssy.zip pidujaglbstbz.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\eftpxlbswcn.exe pidujaglbstbz.exe File created C:\Program Files (x86)\Windows NT\Accessories\fr-FR\ykru.zip pidujaglbstbz.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\wusrsuzur.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\srcaaokj.exe pidujaglbstbz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\lkvay.zip pidujaglbstbz.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Lime\wielabnmjamkr.exe pidujaglbstbz.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\qgfpvrajr.zip pidujaglbstbz.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\js\jdaxsgyvnddn.zip pidujaglbstbz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\qggzln.zip pidujaglbstbz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\elgykgauis.exe pidujaglbstbz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\fmtx.zip pidujaglbstbz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr\bfnsy.zip pidujaglbstbz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\whnz.zip pidujaglbstbz.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\FAX\rzhpbscxa.zip pidujaglbstbz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\czna.zip pidujaglbstbz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\cowjpqrorhvvp.zip pidujaglbstbz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\ntii.zip pidujaglbstbz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\dymzcogyzf.zip pidujaglbstbz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\jpdtiylvzpyzw.zip pidujaglbstbz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\cwuwrnjwnbur.exe pidujaglbstbz.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\orgo.zip pidujaglbstbz.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\mzvqvaf.zip pidujaglbstbz.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\vqvsbac.zip pidujaglbstbz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\gqrvdncwliv.zip pidujaglbstbz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\oxbn.zip pidujaglbstbz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\HostSideAdapters\jayfxxzcmlc.exe pidujaglbstbz.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\whduxfq.exe pidujaglbstbz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\ocapgi.zip pidujaglbstbz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\gastopp.zip pidujaglbstbz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\vzcyfcl.exe pidujaglbstbz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\mgmsyf.zip pidujaglbstbz.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\zmrkvzadbs.zip pidujaglbstbz.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\zvjpihbv.zip pidujaglbstbz.exe File created C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\ssfjnq.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\njgvzptsfbvm.zip pidujaglbstbz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\bvpqd.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\System\ado\it-IT\dlzhsctbnlwod.exe pidujaglbstbz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\jmmmxwvrlkb.exe pidujaglbstbz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\ircen.zip pidujaglbstbz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Triedit\ja-JP\exfgyiljt.zip pidujaglbstbz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VGX\wtbbsnfuzuwub.zip pidujaglbstbz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\EURO\acbnj.zip pidujaglbstbz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\golzmuqqwuqzl.zip pidujaglbstbz.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pidujaglbstbz.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe 2488 pidujaglbstbz.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\pidujaglbstbz.exe"C:\Users\Admin\AppData\Local\Temp\pidujaglbstbz.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2488
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD522b8951d084b1c03c65296963c279e93
SHA19a98bfe0bbcc1c6bd7cfb3bbb0d700f8f331f13f
SHA256c223e1c1c0e0353806b01be751ce807243fee1d69cd2c2eb15cfbe4733b46cf9
SHA5129b2badc3a7686374ea6c515c00e3b9a6f13b3404cc4ef04bd87ded8507da5350ba11ed036d2d97bb085c1bc3bb2f26630a3765451f14b2591c799db3e336bc68
-
Filesize
8KB
MD54f5b6cc259f88424565c5b2719a6e5ab
SHA12240b7d1b1266f0a4f035838429f5dcac5d39a65
SHA256463ca7f1f270a87525ce61b0d5a1e78e4dc3d3562d22a9fc06aa4a05a399db16
SHA512d7c13b65a947d13f4bcfc4269b3a152bc1960b5d47ee0687bbb6a84eb00bffeb8af38bf1d85c2a15bb0f4b670645819c6ec01ca62584404a16a71eb35bd6cdcb