Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
19/03/2025, 05:18
Behavioral task
behavioral1
Sample
pidujaglbstbz.exe
Resource
win7-20241010-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
pidujaglbstbz.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
pidujaglbstbz.exe
-
Size
65KB
-
MD5
22b8951d084b1c03c65296963c279e93
-
SHA1
9a98bfe0bbcc1c6bd7cfb3bbb0d700f8f331f13f
-
SHA256
c223e1c1c0e0353806b01be751ce807243fee1d69cd2c2eb15cfbe4733b46cf9
-
SHA512
9b2badc3a7686374ea6c515c00e3b9a6f13b3404cc4ef04bd87ded8507da5350ba11ed036d2d97bb085c1bc3bb2f26630a3765451f14b2591c799db3e336bc68
-
SSDEEP
1536:ae8SMuDd+fK3F6Xs6Xj/rPl+oIvYTjipvFK:aeRrATPUPvYvQdK
Score
10/10
Malware Config
Signatures
-
Detects MyDoom family 16 IoCs
resource yara_rule behavioral2/memory/5144-83-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral2/memory/5144-92-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral2/memory/5144-145-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral2/memory/5144-163-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral2/memory/5144-170-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral2/memory/5144-177-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral2/memory/5144-191-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral2/memory/5144-196-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral2/memory/5144-203-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral2/memory/5144-205-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral2/memory/5144-207-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral2/memory/5144-209-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral2/memory/5144-211-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral2/memory/5144-213-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral2/memory/5144-227-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral2/memory/5144-229-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom -
Mydoom family
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000e000000023f5c-3.dat acprotect -
Loads dropped DLL 2 IoCs
pid Process 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\xujs = "C:\\Windows\\system32\\tawmuj.exe" pidujaglbstbz.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\gvimmqsa.dll pidujaglbstbz.exe File opened for modification C:\Windows\SysWOW64\tawmuj.exe pidujaglbstbz.exe File created C:\Windows\SysWOW64\tawmuj.exe pidujaglbstbz.exe -
resource yara_rule behavioral2/memory/5144-0-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral2/files/0x000e000000023f5c-3.dat upx behavioral2/memory/5144-7-0x0000000000510000-0x0000000000517000-memory.dmp upx behavioral2/files/0x000300000001e5bc-25.dat upx behavioral2/memory/5144-83-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral2/memory/5144-91-0x0000000000510000-0x0000000000517000-memory.dmp upx behavioral2/memory/5144-92-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral2/memory/5144-145-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral2/memory/5144-163-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral2/memory/5144-170-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral2/memory/5144-177-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral2/memory/5144-191-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral2/memory/5144-196-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral2/memory/5144-203-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral2/memory/5144-205-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral2/memory/5144-207-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral2/memory/5144-209-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral2/memory/5144-211-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral2/memory/5144-213-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral2/memory/5144-227-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral2/memory/5144-229-0x0000000000500000-0x000000000050F000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\cirtmsd.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\bjpn.exe pidujaglbstbz.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\yxhmdxobq.zip pidujaglbstbz.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\aztiab.zip pidujaglbstbz.exe File created C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\_Resources\vukhpyupgkd.exe pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\mexuun.exe pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\djtvejk.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-TW\iydsuyi.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\hszalm.zip pidujaglbstbz.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\wtezeelukraka.exe pidujaglbstbz.exe File created C:\Program Files\Windows Defender\de-DE\qspfa.zip pidujaglbstbz.exe File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_~_8wekyb3d8bbwe\lmilrbi.exe pidujaglbstbz.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\AppxMetadata\ddee.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\osrhiqllr.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\pusx.zip pidujaglbstbz.exe File created C:\Program Files\Java\jre-1.8\legal\mmzdku.exe pidujaglbstbz.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-100_8wekyb3d8bbwe\rbqfeuri.zip pidujaglbstbz.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_~_8wekyb3d8bbwe\jgigpfsdypvro.zip pidujaglbstbz.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_2019.904.1644.0_neutral_~_8wekyb3d8bbwe\myvbtl.zip pidujaglbstbz.exe File created C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x86__8wekyb3d8bbwe\AppxMetadata\fmzyzehhkrbos.exe pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\uqka.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\rdkzgc.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\ink\nb-NO\suhvtawqkvt.exe pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\ink\ro-RO\qzlvaemqqx.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\ltmp.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\vdhre.zip pidujaglbstbz.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\djtxcejgibza.zip pidujaglbstbz.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\uhrqguwyl.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\ink\lv-LV\nnadoaqzk.exe pidujaglbstbz.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\chwkmkbakqbb.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\ink\he-IL\rzojsixxelauj.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\ink\sl-SI\iqli.zip pidujaglbstbz.exe File created C:\Program Files\dotnet\shared\lvywhzw.zip pidujaglbstbz.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\wfohorkc.zip pidujaglbstbz.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\ezurowedmlq.zip pidujaglbstbz.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ms-MY\fhwrnrnzhqpqr.zip pidujaglbstbz.exe File created C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.1813.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\utvsjufdedj.zip pidujaglbstbz.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\lsefeggrpkhor.exe pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\ink\sk-SK\gwcsywmypykm.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\ink\tr-TR\yilmmdquz.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\maxkhrvozhem.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\Stationery\guvwjvs.exe pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\Triedit\en-US\rlzhzuawe.zip pidujaglbstbz.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\nudbpub.zip pidujaglbstbz.exe File created C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\igkdyeyh.exe pidujaglbstbz.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\AppxMetadata\fjfyfestpxdd.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\ognzveficdvay.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\ink\hr-HR\nfyuy.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\ink\ko-KR\daxuyobgxpybo.zip pidujaglbstbz.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\joqfa.exe pidujaglbstbz.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\wpdpsjmx.zip pidujaglbstbz.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\nqlj.zip pidujaglbstbz.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\reekydgqwbdd.zip pidujaglbstbz.exe File created C:\Program Files\VideoLAN\VLC\locale\zh_CN\bldx.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\wgnoapmbb.zip pidujaglbstbz.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\xsqtzrgnq.zip pidujaglbstbz.exe File created C:\Program Files\VideoLAN\VLC\lua\intf\roco.zip pidujaglbstbz.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\xkwhchhgiplc.exe pidujaglbstbz.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\kdstqntbkmnic.exe pidujaglbstbz.exe File created C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.1.7_1.7.25531.0_x64__8wekyb3d8bbwe\AppxMetadata\ywxsgijwnba.exe pidujaglbstbz.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\osf\udsnxpdh.zip pidujaglbstbz.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\AppxMetadata\hocpcutwjxmh.zip pidujaglbstbz.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-CN\dwvmf.zip pidujaglbstbz.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\gpmdyfxcau.zip pidujaglbstbz.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pidujaglbstbz.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe 5144 pidujaglbstbz.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5144 wrote to memory of 5192 5144 pidujaglbstbz.exe 85 PID 5144 wrote to memory of 5192 5144 pidujaglbstbz.exe 85 PID 5144 wrote to memory of 5192 5144 pidujaglbstbz.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\pidujaglbstbz.exe"C:\Users\Admin\AppData\Local\Temp\pidujaglbstbz.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\Windows\SysWOW64\notepad.exenotepad "C:\Users\Admin\AppData\Local\Temp\Mail"2⤵
- System Location Discovery: System Language Discovery
PID:5192
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD522b8951d084b1c03c65296963c279e93
SHA19a98bfe0bbcc1c6bd7cfb3bbb0d700f8f331f13f
SHA256c223e1c1c0e0353806b01be751ce807243fee1d69cd2c2eb15cfbe4733b46cf9
SHA5129b2badc3a7686374ea6c515c00e3b9a6f13b3404cc4ef04bd87ded8507da5350ba11ed036d2d97bb085c1bc3bb2f26630a3765451f14b2591c799db3e336bc68
-
Filesize
2KB
MD52e6441ee9dc156b538264f20cc365da9
SHA11f6b966f59bb5557b975d474203989e9108213e7
SHA2568a95c25c949c3dfd1541e8c16cdee401fa57cea665585e7eae191b14ca4d3174
SHA5121be3cc1f89c1adf1b2f7573b4b03d294c82c97aa6175f7a97f5a7a29c5cec9d7c7f74bd8c588be46890a942223c30a9d3226c8393d173eb2a606006986417bc5
-
Filesize
7KB
MD5b6f4a8803812f794a71c0058641d345b
SHA1578303a63fdfcad7b8a325b9b725f0759881dcf4
SHA256efbaf53798000e3a31b24badbdf827727b698bdb41f0607400acae05d30f13ba
SHA5123b915de249be0e85d1ffecc1364008f70eb057d3be768e38ff8b21e5a2027dd365abe543f946cf2c43bb3a5f9f99254160f01d5c0e82ce6c45bb7eae12515ac2