Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
1002b2807a96...b0.exe
windows7-x64
702b2807a96...b0.exe
windows10-2004-x64
7$PLUGINSDI...er.exe
windows7-x64
7$PLUGINSDI...er.exe
windows10-2004-x64
7$PLUGINSDI...BI.exe
windows7-x64
7$PLUGINSDI...BI.exe
windows10-2004-x64
7$PLUGINSDI...cc.exe
windows7-x64
7$PLUGINSDI...cc.exe
windows10-2004-x64
7$PLUGINSDI...er.dll
windows7-x64
1$PLUGINSDI...er.dll
windows10-2004-x64
1$PLUGINSDIR/Failed.js
windows7-x64
1$PLUGINSDIR/Failed.js
windows10-2004-x64
1$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...lp.dll
windows7-x64
1$PLUGINSDI...lp.dll
windows10-2004-x64
1$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...os.dll
windows7-x64
3$PLUGINSDI...os.dll
windows10-2004-x64
3$PLUGINSDIR/inetc.dll
windows7-x64
3$PLUGINSDIR/inetc.dll
windows10-2004-x64
3$PLUGINSDI...ay.dll
windows7-x64
9$PLUGINSDI...ay.dll
windows10-2004-x64
9$PLUGINSDI...st.dll
windows7-x64
1$PLUGINSDI...st.dll
windows10-2004-x64
3$PLUGINSDIR/xml.dll
windows7-x64
3$PLUGINSDIR/xml.dll
windows10-2004-x64
3Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09/03/2024, 17:59
Behavioral task
behavioral1
Sample
02b2807a96708694d9b8f2f229b4d36bb1d6bbce35e910c82f87e65a4e5b08b0.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
02b2807a96708694d9b8f2f229b4d36bb1d6bbce35e910c82f87e65a4e5b08b0.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/$_286_/ProxyInstaller.exe
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/$_286_/ProxyInstaller.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/$_287_/BI.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/$_287_/BI.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/$_288_/DownloadAcc.exe
Resource
win7-20240215-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/$_288_/DownloadAcc.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/BunndleOfferManager.dll
Resource
win7-20240220-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/BunndleOfferManager.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/Failed.js
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/Failed.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/FirefoxHandler.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/FirefoxHandler.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/OCSetupHlp.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/OCSetupHlp.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/execDos.dll
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/execDos.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/inetc.dll
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/inetc.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/nsArray.dll
Resource
win7-20240215-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/nsArray.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/webapphost.dll
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/webapphost.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
$PLUGINSDIR/xml.dll
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
$PLUGINSDIR/xml.dll
Resource
win10v2004-20240226-en
General
-
Target
02b2807a96708694d9b8f2f229b4d36bb1d6bbce35e910c82f87e65a4e5b08b0.exe
-
Size
1.1MB
-
MD5
3f94f4455055fe839d283c610a76dc13
-
SHA1
dfceeec8fe6a1c9e6ef01c005fd2f426deb3bf30
-
SHA256
02b2807a96708694d9b8f2f229b4d36bb1d6bbce35e910c82f87e65a4e5b08b0
-
SHA512
8dec34239b6f25228ddba27c561bea2152a82aeccb6d95d1c030bb304a081eae1f4b2cc44641aa8fc83e0d26eb3ff22747a4602927ec6c5c5ae2c1ac6c42814f
-
SSDEEP
24576:9BLQFiYTOndhEnaHNOUUyuNSyN5DajySBkaHRx1:PEF3qn6aHuyCSyTDvSSWRx1
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 3644 BI.exe 4532 BI.exe -
Loads dropped DLL 11 IoCs
pid Process 3820 02b2807a96708694d9b8f2f229b4d36bb1d6bbce35e910c82f87e65a4e5b08b0.exe 3820 02b2807a96708694d9b8f2f229b4d36bb1d6bbce35e910c82f87e65a4e5b08b0.exe 3644 BI.exe 3644 BI.exe 3644 BI.exe 3820 02b2807a96708694d9b8f2f229b4d36bb1d6bbce35e910c82f87e65a4e5b08b0.exe 3820 02b2807a96708694d9b8f2f229b4d36bb1d6bbce35e910c82f87e65a4e5b08b0.exe 3820 02b2807a96708694d9b8f2f229b4d36bb1d6bbce35e910c82f87e65a4e5b08b0.exe 4532 BI.exe 4532 BI.exe 4532 BI.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 3820 02b2807a96708694d9b8f2f229b4d36bb1d6bbce35e910c82f87e65a4e5b08b0.exe 3820 02b2807a96708694d9b8f2f229b4d36bb1d6bbce35e910c82f87e65a4e5b08b0.exe 3820 02b2807a96708694d9b8f2f229b4d36bb1d6bbce35e910c82f87e65a4e5b08b0.exe 3820 02b2807a96708694d9b8f2f229b4d36bb1d6bbce35e910c82f87e65a4e5b08b0.exe 3820 02b2807a96708694d9b8f2f229b4d36bb1d6bbce35e910c82f87e65a4e5b08b0.exe 3820 02b2807a96708694d9b8f2f229b4d36bb1d6bbce35e910c82f87e65a4e5b08b0.exe 3820 02b2807a96708694d9b8f2f229b4d36bb1d6bbce35e910c82f87e65a4e5b08b0.exe 3820 02b2807a96708694d9b8f2f229b4d36bb1d6bbce35e910c82f87e65a4e5b08b0.exe 3820 02b2807a96708694d9b8f2f229b4d36bb1d6bbce35e910c82f87e65a4e5b08b0.exe 3820 02b2807a96708694d9b8f2f229b4d36bb1d6bbce35e910c82f87e65a4e5b08b0.exe 3820 02b2807a96708694d9b8f2f229b4d36bb1d6bbce35e910c82f87e65a4e5b08b0.exe 3820 02b2807a96708694d9b8f2f229b4d36bb1d6bbce35e910c82f87e65a4e5b08b0.exe 3820 02b2807a96708694d9b8f2f229b4d36bb1d6bbce35e910c82f87e65a4e5b08b0.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3820 wrote to memory of 3644 3820 02b2807a96708694d9b8f2f229b4d36bb1d6bbce35e910c82f87e65a4e5b08b0.exe 87 PID 3820 wrote to memory of 3644 3820 02b2807a96708694d9b8f2f229b4d36bb1d6bbce35e910c82f87e65a4e5b08b0.exe 87 PID 3820 wrote to memory of 3644 3820 02b2807a96708694d9b8f2f229b4d36bb1d6bbce35e910c82f87e65a4e5b08b0.exe 87 PID 3820 wrote to memory of 4532 3820 02b2807a96708694d9b8f2f229b4d36bb1d6bbce35e910c82f87e65a4e5b08b0.exe 103 PID 3820 wrote to memory of 4532 3820 02b2807a96708694d9b8f2f229b4d36bb1d6bbce35e910c82f87e65a4e5b08b0.exe 103 PID 3820 wrote to memory of 4532 3820 02b2807a96708694d9b8f2f229b4d36bb1d6bbce35e910c82f87e65a4e5b08b0.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\02b2807a96708694d9b8f2f229b4d36bb1d6bbce35e910c82f87e65a4e5b08b0.exe"C:\Users\Admin\AppData\Local\Temp\02b2807a96708694d9b8f2f229b4d36bb1d6bbce35e910c82f87e65a4e5b08b0.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\nsb4AA7.tmp\BI\BI.exeC:\Users\Admin\AppData\Local\Temp\nsb4AA7.tmp\BI\BI.exe { "json_send_time" : "9/3/2024 19:59:5:891" , "product_id_version" : "" , "product_type" : "" , "product_id" : "" , "offer_id" : "52286" , "user_type" : "NULL" , "result" : "Success" , "user_operating_system_bits" : "" , "current_default_search" : "" , "current_homepage" : "" , "current_toolbars" : "" , "attempt_number" : "1" , "is_silent" : "" , "user_ms_dotnet_framework_ver" : "" , "user_acount_type" : "" , "user_ie_version" : "" , "user_default_browser_version" : "" , "user_default_browser" : "" , "user_service_pack" : "" , "user_operating_system" : "" , "revision_number" : "0" , "build_id" : "00000000" , "dm_version" : "1.3.8.0.130825.01" , "bundle_id" : "6edd9812-2408-4b4d-bb69-e522c0252fef" , "machine_user_id" : "{FCB6333C-4612-4830-AFDB-C9A738E551B9}" , "send_attempt" : "0" , "channel_id" : "" , "installation_session_id" : "15DA01A3-536B-48CB-8FF2-F53678F5B29A" , "publisher_internal_id" : "1" , "publisher_id" : "Brothersoft" , "publisher_account_id" : "A-1477560" , "order" : "1.0" , "phase" : "Init" , "Is_Test" : "0" }2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3644
-
-
C:\Users\Admin\AppData\Local\Temp\nsb4AA7.tmp\BI\BI.exeC:\Users\Admin\AppData\Local\Temp\nsb4AA7.tmp\BI\BI.exe { "user_ie_security_level" : "Medium-High" , "json_send_time" : "9/3/2024 19:59:54:891" , "internal_error_description" : "HttpPost result: try1- SendRequest Error; try2- SendRequest Error; try3- SendRequest Error" , "internal_error_number" : "3" , "is_parallel" : "0" , "mrs_id" : "" , "vector_id" : "" , "rule_id" : "" , "product_id_version" : "" , "product_type" : "" , "product_id" : "" , "offer_id" : "52286" , "general_status_code" : "2" , "duration_details" : " InitPluginsDir:0 initializeParams:78 load_BITool:47 send_BI_Init:15 load_DownloadACC:16 retrieveUISource:0 unpack_webappfolder:0 unpack_icon:0 RetrieveMainOfferKey:0 unpack_OpenCandyDll:31 unpack_BunndleDll:32 load_webapphost:0 unpack_ProxyInstaller:0 navigate_loadingUI:640 navigateAsync_constMainOffer:0 BuildUserProfile:0 retrieve cid:0 callService1:16188 callService1:16031 callService1:16031 " , "phase_duration" : "" , "error_details" : "Failed communicate with the DistributionEngineService. Inner Error: SendRequest Error. InternalRetryNum: 3" , "result" : "Error" , "user_operating_system_bits" : "64" , "current_default_search" : "" , "current_homepage" : "" , "current_toolbars" : "" , "attempt_number" : "1" , "is_silent" : "" , "user_ms_dotnet_framework_ver" : "4.0" , "user_acount_type" : "" , "user_ie_version" : "9.11.19041.0" , "user_default_browser_version" : "9.11.19041.0" , "user_default_browser" : "IEXPLORE.EXE" , "user_service_pack" : "0.0" , "user_operating_system" : "Windows 10 Enterprise" , "revision_number" : "0" , "build_id" : "00000000" , "dm_version" : "1.3.8.0.130825.01" , "bundle_id" : "6edd9812-2408-4b4d-bb69-e522c0252fef" , "machine_user_id" : "{FCB6333C-4612-4830-AFDB-C9A738E551B9}" , "send_attempt" : "0" , "channel_id" : "" , "installation_session_id" : "15DA01A3-536B-48CB-8FF2-F53678F5B29A" , "publisher_internal_id" : "1" , "publisher_id" : "Brothersoft" , "publisher_account_id" : "A-1477560" , "order" : "2.0" , "phase" : "InitComplete" , "Is_Test" : "0" }2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4532
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
75KB
MD574cb7b0a801435c552d3bfd1517491a1
SHA1a46e6e1b524a608eed9e81fd7e102e280b2e95c1
SHA256fe0af5e14e37fd0b642aa08495ae63a4ed441c92909dfd7a8a25a050b5ed097e
SHA512fce908fce3e9f84740280af53813bcbed29abf3f976a2b6ba1c88a722877ce020241b36bd0cbbb4f793df9d262b413ad30198bb1e8345128b0ac5857209b3260
-
Filesize
17KB
MD5a4f38d1c7a480f5da1bb8097b8b939db
SHA1b3129c2a0e61881381463f5e0cbbffa573daa845
SHA256e1180e1e3344c7536150275e33de53dc1dd1a3ca03be66c4d4875fe5bcd4e436
SHA512fed89f7ee9364fc2f4b9f82c4563713497043947e98dbb03e7d755681adf3ae661aba80d08e59988a23695fc64481b69d9842b7ec7d2b572cc872c4c9957febc
-
Filesize
760KB
MD5ca7f07bcde734c3a3072841e412c45e5
SHA175c03a7b14b2827242447fec95e4869a76518747
SHA25654c6ca5ddcc600bb6ffd283760b843cc0af41b7b9ea1767a9aa4826262c407fc
SHA5122f134f85aaea11eb4dfbbda62efe1ce45c04781da5fb138231c2f62578c80a5cd9cbe45c901fd15c5a85c86f49f70ecf5cd8213e9784bc888f8581c8850ced1e
-
Filesize
29KB
MD5dccdcb124064a1d9a5eb12232348b898
SHA1f294fac154cb1c6c18fe054ac584f767594b93fb
SHA25637adc0183d94ae6ca1895643423dac0c97750d7103e6b00c14299dfc4ad2271e
SHA512bd89bcd513bb7120db80e1115b4caceaa18c4ea863fe29b232002d447c3813133ff2849fcb2d4df45e3ff67e0e0d9d340d61060b9c74045b17efa5b1c1f5b05e