Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
106s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
20/03/2025, 20:00
Static task
static1
Behavioral task
behavioral1
Sample
2025-03-20_f154c8e7b92c66929392b1bfa78e8199_mafia_wapomi.exe
Resource
win7-20240729-en
General
-
Target
2025-03-20_f154c8e7b92c66929392b1bfa78e8199_mafia_wapomi.exe
-
Size
1.6MB
-
MD5
f154c8e7b92c66929392b1bfa78e8199
-
SHA1
e08e9c1c2a1382239078c771984911fff1335537
-
SHA256
64076a9a8210e45d3c7c72d0e2972e736b8bc7eec3ac4ba8694d36cbe9a6506a
-
SHA512
d6d48e358e1637ead564ada07414318dd763d7aef7d6d329a3e95c9588abea768b40e9cd88ef87d1fec35706ed87cd25a53e70a771b0c10db05a2f50369367f4
-
SSDEEP
49152:XE4XbjEKOh3SbiwJjn7gu5LUvdW9apuLvht/cionurM0EIMa1:Xrj834iwJjn7gu5LmMapuNiiMurM0
Malware Config
Extracted
bdaejec
ddos.dnsnb8.net
Signatures
-
Bdaejec family
-
Detects Bdaejec Backdoor. 1 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral2/memory/3144-11-0x0000000000250000-0x0000000000259000-memory.dmp family_bdaejec_backdoor -
resource yara_rule behavioral2/files/0x00050000000227be-3.dat aspack_v212_v242 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation EbSMYU.exe -
Executes dropped EXE 1 IoCs
pid Process 3144 EbSMYU.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe EbSMYU.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe EbSMYU.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe EbSMYU.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe EbSMYU.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe EbSMYU.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe EbSMYU.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe EbSMYU.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE EbSMYU.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe EbSMYU.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe EbSMYU.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe EbSMYU.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe EbSMYU.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe EbSMYU.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe EbSMYU.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe EbSMYU.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe EbSMYU.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe EbSMYU.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe EbSMYU.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe EbSMYU.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe EbSMYU.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE EbSMYU.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe EbSMYU.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe EbSMYU.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe EbSMYU.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe EbSMYU.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe EbSMYU.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe EbSMYU.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE EbSMYU.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe EbSMYU.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe EbSMYU.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE EbSMYU.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe EbSMYU.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe EbSMYU.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe EbSMYU.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe EbSMYU.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe EbSMYU.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe EbSMYU.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe EbSMYU.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe EbSMYU.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe EbSMYU.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe EbSMYU.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe EbSMYU.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe EbSMYU.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe EbSMYU.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe EbSMYU.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe EbSMYU.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe EbSMYU.exe File opened for modification C:\Program Files\dotnet\dotnet.exe EbSMYU.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe EbSMYU.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe EbSMYU.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE EbSMYU.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE EbSMYU.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe EbSMYU.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe EbSMYU.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe EbSMYU.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE EbSMYU.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe EbSMYU.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe EbSMYU.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe EbSMYU.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe EbSMYU.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe EbSMYU.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe EbSMYU.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe EbSMYU.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe EbSMYU.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\inf\oem0.PNF 2025-03-20_f154c8e7b92c66929392b1bfa78e8199_mafia_wapomi.exe File created C:\Windows\inf\oem1.PNF 2025-03-20_f154c8e7b92c66929392b1bfa78e8199_mafia_wapomi.exe File created C:\Windows\inf\oem2.PNF 2025-03-20_f154c8e7b92c66929392b1bfa78e8199_mafia_wapomi.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-03-20_f154c8e7b92c66929392b1bfa78e8199_mafia_wapomi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EbSMYU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom 2025-03-20_f154c8e7b92c66929392b1bfa78e8199_mafia_wapomi.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags 2025-03-20_f154c8e7b92c66929392b1bfa78e8199_mafia_wapomi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 2025-03-20_f154c8e7b92c66929392b1bfa78e8199_mafia_wapomi.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID 2025-03-20_f154c8e7b92c66929392b1bfa78e8199_mafia_wapomi.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID 2025-03-20_f154c8e7b92c66929392b1bfa78e8199_mafia_wapomi.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID 2025-03-20_f154c8e7b92c66929392b1bfa78e8199_mafia_wapomi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 2025-03-20_f154c8e7b92c66929392b1bfa78e8199_mafia_wapomi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 2025-03-20_f154c8e7b92c66929392b1bfa78e8199_mafia_wapomi.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags 2025-03-20_f154c8e7b92c66929392b1bfa78e8199_mafia_wapomi.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID 2025-03-20_f154c8e7b92c66929392b1bfa78e8199_mafia_wapomi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 2025-03-20_f154c8e7b92c66929392b1bfa78e8199_mafia_wapomi.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom 2025-03-20_f154c8e7b92c66929392b1bfa78e8199_mafia_wapomi.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5484 wrote to memory of 3144 5484 2025-03-20_f154c8e7b92c66929392b1bfa78e8199_mafia_wapomi.exe 86 PID 5484 wrote to memory of 3144 5484 2025-03-20_f154c8e7b92c66929392b1bfa78e8199_mafia_wapomi.exe 86 PID 5484 wrote to memory of 3144 5484 2025-03-20_f154c8e7b92c66929392b1bfa78e8199_mafia_wapomi.exe 86 PID 3144 wrote to memory of 732 3144 EbSMYU.exe 95 PID 3144 wrote to memory of 732 3144 EbSMYU.exe 95 PID 3144 wrote to memory of 732 3144 EbSMYU.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-03-20_f154c8e7b92c66929392b1bfa78e8199_mafia_wapomi.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-20_f154c8e7b92c66929392b1bfa78e8199_mafia_wapomi.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:5484 -
C:\Users\Admin\AppData\Local\Temp\EbSMYU.exeC:\Users\Admin\AppData\Local\Temp\EbSMYU.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3f727bc0.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:732
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
187B
MD5d66502beaad8e1c1686eace13d6898b6
SHA150f31a674515b49708242c945a008f7fec3f3e77
SHA2567dde85fb5d0a11e5b70cd4b12378c862bbb1f3e715febd25ca09b64d3b7cb60c
SHA5122868ed3b19c263b04ca2c52e66a548c5e9d2bc463dd85d2dc41b4bac70d366d2771538ae63aff996e9a91a4f5a3723a289ce5baed49b122be2313eb81e1d0d5f
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e