Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3Proxy Grab...rp.dll
windows7-x64
1Proxy Grab...rp.dll
windows10-2004-x64
1Proxy Grab...ic.dll
windows7-x64
1Proxy Grab...ic.dll
windows10-2004-x64
1Proxy Grab...er.exe
windows7-x64
7Proxy Grab...er.exe
windows10-2004-x64
7Proxy Grab...rp.dll
windows7-x64
1Proxy Grab...rp.dll
windows10-2004-x64
1Proxy Grab...or.exe
windows7-x64
3Proxy Grab...or.exe
windows10-2004-x64
7Proxy Grab...st.exe
windows7-x64
3Proxy Grab...st.exe
windows10-2004-x64
7Proxy Grab...ic.dll
windows7-x64
1Proxy Grab...ic.dll
windows10-2004-x64
1Proxy Grab...32.exe
windows7-x64
1Proxy Grab...32.exe
windows10-2004-x64
1Proxy Grab...ht.dll
windows7-x64
1Proxy Grab...ht.dll
windows10-2004-x64
1Proxy Grab...ht.dll
windows7-x64
1Proxy Grab...ht.dll
windows10-2004-x64
1Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/03/2024, 11:18
Static task
static1
Behavioral task
behavioral1
Sample
Proxy Grabber by Mathian/Proxy Grabber by Mathian/AngleSharp.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
Proxy Grabber by Mathian/Proxy Grabber by Mathian/AngleSharp.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Proxy Grabber by Mathian/Proxy Grabber by Mathian/Microsoft.Dynamic.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Proxy Grabber by Mathian/Proxy Grabber by Mathian/Microsoft.Dynamic.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
Proxy Grabber by Mathian/Proxy Grabber by Mathian/Proxy Grabber by Mathian Developer.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
Proxy Grabber by Mathian/Proxy Grabber by Mathian/Proxy Grabber by Mathian Developer.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
Proxy Grabber by Mathian/Proxy Grabber by Mathian/data/AngleSharp.dll
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
Proxy Grabber by Mathian/Proxy Grabber by Mathian/data/AngleSharp.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
Proxy Grabber by Mathian/Proxy Grabber by Mathian/data/Microsoft Windows Protocol Monitor.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Proxy Grabber by Mathian/Proxy Grabber by Mathian/data/Microsoft Windows Protocol Monitor.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
Proxy Grabber by Mathian/Proxy Grabber by Mathian/data/Microsoft Windows Protocol Services Host.exe
Resource
win7-20240220-en
Behavioral task
behavioral12
Sample
Proxy Grabber by Mathian/Proxy Grabber by Mathian/data/Microsoft Windows Protocol Services Host.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
Proxy Grabber by Mathian/Proxy Grabber by Mathian/data/Microsoft.Dynamic.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
Proxy Grabber by Mathian/Proxy Grabber by Mathian/data/Microsoft.Dynamic.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
Proxy Grabber by Mathian/Proxy Grabber by Mathian/data/dev32.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
Proxy Grabber by Mathian/Proxy Grabber by Mathian/data/dev32.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
Proxy Grabber by Mathian/Proxy Grabber by Mathian/data/mfc100cht.dll
Resource
win7-20240319-en
Behavioral task
behavioral18
Sample
Proxy Grabber by Mathian/Proxy Grabber by Mathian/data/mfc100cht.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
Proxy Grabber by Mathian/Proxy Grabber by Mathian/mfc100cht.dll
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
Proxy Grabber by Mathian/Proxy Grabber by Mathian/mfc100cht.dll
Resource
win10v2004-20240226-en
General
-
Target
Proxy Grabber by Mathian/Proxy Grabber by Mathian/Proxy Grabber by Mathian Developer.exe
-
Size
246KB
-
MD5
d073428ed496be35b6ec207e6395dffb
-
SHA1
425829295fc203ef8ee036a00b6c380acd95078f
-
SHA256
b8bcaefa4f1a500db12252c6ab7f1eae4733e8f54bf5e65b7f47abef949c3200
-
SHA512
e37efcc7a3a5b90f79e9797dd8f8d0aafc507fc3526a28b41346f4be6821668169154f4b8e297b289493ff2fc52b3a26dd5782123f48b152ddabd3895c79905c
-
SSDEEP
6144:Pb6g4ipqFpgRMeQHjIkq7DdXNwBHr1lk/:GBiAFsMe6IkUpOpBy
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Startup.lnk Proxy Grabber by Mathian Developer.exe -
Executes dropped EXE 2 IoCs
pid Process 2668 Microsoft Windows Protocol Services Host.exe 2468 Microsoft Windows Protocol Monitor.exe -
Loads dropped DLL 2 IoCs
pid Process 2088 Proxy Grabber by Mathian Developer.exe 2088 Proxy Grabber by Mathian Developer.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\Program Files (x86)\Microsoft Host Interface\data\Microsoft Windows Protocol Monitor.exe Proxy Grabber by Mathian Developer.exe File opened for modification C:\Windows\Program Files (x86)\Microsoft Host Interface\data\Microsoft Windows Protocol Monitor.exe Proxy Grabber by Mathian Developer.exe File created C:\Windows\Program Files (x86)\Microsoft Host Interface\data\Microsoft Windows Protocol Services Host.exe Proxy Grabber by Mathian Developer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2668 Microsoft Windows Protocol Services Host.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2668 Microsoft Windows Protocol Services Host.exe 2668 Microsoft Windows Protocol Services Host.exe 2468 Microsoft Windows Protocol Monitor.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2668 Microsoft Windows Protocol Services Host.exe Token: SeDebugPrivilege 2468 Microsoft Windows Protocol Monitor.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2088 wrote to memory of 2668 2088 Proxy Grabber by Mathian Developer.exe 28 PID 2088 wrote to memory of 2668 2088 Proxy Grabber by Mathian Developer.exe 28 PID 2088 wrote to memory of 2668 2088 Proxy Grabber by Mathian Developer.exe 28 PID 2088 wrote to memory of 2668 2088 Proxy Grabber by Mathian Developer.exe 28 PID 2088 wrote to memory of 2720 2088 Proxy Grabber by Mathian Developer.exe 29 PID 2088 wrote to memory of 2720 2088 Proxy Grabber by Mathian Developer.exe 29 PID 2088 wrote to memory of 2720 2088 Proxy Grabber by Mathian Developer.exe 29 PID 2088 wrote to memory of 2720 2088 Proxy Grabber by Mathian Developer.exe 29 PID 2668 wrote to memory of 2468 2668 Microsoft Windows Protocol Services Host.exe 30 PID 2668 wrote to memory of 2468 2668 Microsoft Windows Protocol Services Host.exe 30 PID 2668 wrote to memory of 2468 2668 Microsoft Windows Protocol Services Host.exe 30 PID 2668 wrote to memory of 2468 2668 Microsoft Windows Protocol Services Host.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\Proxy Grabber by Mathian\Proxy Grabber by Mathian\Proxy Grabber by Mathian Developer.exe"C:\Users\Admin\AppData\Local\Temp\Proxy Grabber by Mathian\Proxy Grabber by Mathian\Proxy Grabber by Mathian Developer.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\Program Files (x86)\Microsoft Host Interface\data\Microsoft Windows Protocol Services Host.exe"C:\Windows\Program Files (x86)\Microsoft Host Interface\data\Microsoft Windows Protocol Services Host.exe" {Arguments If Needed}2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\Program Files (x86)\Microsoft Host Interface\data\Microsoft Windows Protocol Monitor.exe"C:\Windows\Program Files (x86)\Microsoft Host Interface\data\Microsoft Windows Protocol Monitor.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2468
-
-
-
C:\Users\Admin\AppData\Local\Temp\Proxy Grabber by Mathian\Proxy Grabber by Mathian\data\dev32.exe"C:\Users\Admin\AppData\Local\Temp\Proxy Grabber by Mathian\Proxy Grabber by Mathian\data\dev32.exe" {Arguments If Needed}2⤵PID:2720
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD561fce223872024b0ecb0bb2a7ffb7c47
SHA1f893d620f9d843c8bdb86a0375f856508a6ce136
SHA2564b5069b9708a8e97b17af6aa96cf2112877a675b4dbc1f6dbc2601b494b35d11
SHA5128926a5f7d6aa862351044d79a634decda989b50ad422ba3e9a97c573ff618a8314607a7afe093925f56d87861eefb31d3820d9e02b1cf2847c0e6072880ac192
-
\Windows\Program Files (x86)\Microsoft Host Interface\data\Microsoft Windows Protocol Services Host.exe
Filesize10KB
MD57e4ec49968cdfeb455c1f56c5a944287
SHA101a9bc140345909f970e4ef6f7c4efd0ebc0fe09
SHA256c68300968c576203725e09edf1ac9b069b903ee06a4321c8c8fe5582898c10e4
SHA51261823c4fcb0e3bbab44286215b702a0306984083f4b55347a82671b6393e67522c91269686d910b229781470db79ce4b46a1336a6e6afb077b8fb6f9d9c5094f