Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    28/03/2024, 11:18

General

  • Target

    Proxy Grabber by Mathian/Proxy Grabber by Mathian/Proxy Grabber by Mathian Developer.exe

  • Size

    246KB

  • MD5

    d073428ed496be35b6ec207e6395dffb

  • SHA1

    425829295fc203ef8ee036a00b6c380acd95078f

  • SHA256

    b8bcaefa4f1a500db12252c6ab7f1eae4733e8f54bf5e65b7f47abef949c3200

  • SHA512

    e37efcc7a3a5b90f79e9797dd8f8d0aafc507fc3526a28b41346f4be6821668169154f4b8e297b289493ff2fc52b3a26dd5782123f48b152ddabd3895c79905c

  • SSDEEP

    6144:Pb6g4ipqFpgRMeQHjIkq7DdXNwBHr1lk/:GBiAFsMe6IkUpOpBy

Score
7/10

Malware Config

Signatures

  • Drops startup file 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Proxy Grabber by Mathian\Proxy Grabber by Mathian\Proxy Grabber by Mathian Developer.exe
    "C:\Users\Admin\AppData\Local\Temp\Proxy Grabber by Mathian\Proxy Grabber by Mathian\Proxy Grabber by Mathian Developer.exe"
    1⤵
    • Drops startup file
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2088
    • C:\Windows\Program Files (x86)\Microsoft Host Interface\data\Microsoft Windows Protocol Services Host.exe
      "C:\Windows\Program Files (x86)\Microsoft Host Interface\data\Microsoft Windows Protocol Services Host.exe" {Arguments If Needed}
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2668
      • C:\Windows\Program Files (x86)\Microsoft Host Interface\data\Microsoft Windows Protocol Monitor.exe
        "C:\Windows\Program Files (x86)\Microsoft Host Interface\data\Microsoft Windows Protocol Monitor.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2468
    • C:\Users\Admin\AppData\Local\Temp\Proxy Grabber by Mathian\Proxy Grabber by Mathian\data\dev32.exe
      "C:\Users\Admin\AppData\Local\Temp\Proxy Grabber by Mathian\Proxy Grabber by Mathian\data\dev32.exe" {Arguments If Needed}
      2⤵
        PID:2720

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\Program Files (x86)\Microsoft Host Interface\data\Microsoft Windows Protocol Monitor.exe

      Filesize

      9KB

      MD5

      61fce223872024b0ecb0bb2a7ffb7c47

      SHA1

      f893d620f9d843c8bdb86a0375f856508a6ce136

      SHA256

      4b5069b9708a8e97b17af6aa96cf2112877a675b4dbc1f6dbc2601b494b35d11

      SHA512

      8926a5f7d6aa862351044d79a634decda989b50ad422ba3e9a97c573ff618a8314607a7afe093925f56d87861eefb31d3820d9e02b1cf2847c0e6072880ac192

    • \Windows\Program Files (x86)\Microsoft Host Interface\data\Microsoft Windows Protocol Services Host.exe

      Filesize

      10KB

      MD5

      7e4ec49968cdfeb455c1f56c5a944287

      SHA1

      01a9bc140345909f970e4ef6f7c4efd0ebc0fe09

      SHA256

      c68300968c576203725e09edf1ac9b069b903ee06a4321c8c8fe5582898c10e4

      SHA512

      61823c4fcb0e3bbab44286215b702a0306984083f4b55347a82671b6393e67522c91269686d910b229781470db79ce4b46a1336a6e6afb077b8fb6f9d9c5094f

    • memory/2088-17-0x00000000745C0000-0x0000000074CAE000-memory.dmp

      Filesize

      6.9MB

    • memory/2088-1-0x00000000745C0000-0x0000000074CAE000-memory.dmp

      Filesize

      6.9MB

    • memory/2088-2-0x0000000004850000-0x0000000004890000-memory.dmp

      Filesize

      256KB

    • memory/2088-0-0x0000000000D50000-0x0000000000D94000-memory.dmp

      Filesize

      272KB

    • memory/2468-31-0x0000000004B90000-0x0000000004BD0000-memory.dmp

      Filesize

      256KB

    • memory/2468-23-0x00000000013E0000-0x00000000013E8000-memory.dmp

      Filesize

      32KB

    • memory/2468-30-0x00000000745C0000-0x0000000074CAE000-memory.dmp

      Filesize

      6.9MB

    • memory/2468-24-0x00000000745C0000-0x0000000074CAE000-memory.dmp

      Filesize

      6.9MB

    • memory/2668-28-0x000007FEF5680000-0x000007FEF606C000-memory.dmp

      Filesize

      9.9MB

    • memory/2668-18-0x00000000013B0000-0x00000000013B8000-memory.dmp

      Filesize

      32KB

    • memory/2668-19-0x000007FEF5680000-0x000007FEF606C000-memory.dmp

      Filesize

      9.9MB

    • memory/2668-32-0x00000000004C0000-0x0000000000540000-memory.dmp

      Filesize

      512KB

    • memory/2668-25-0x00000000004C0000-0x0000000000540000-memory.dmp

      Filesize

      512KB

    • memory/2720-15-0x00000000745C0000-0x0000000074CAE000-memory.dmp

      Filesize

      6.9MB

    • memory/2720-27-0x00000000007C0000-0x0000000000800000-memory.dmp

      Filesize

      256KB

    • memory/2720-26-0x00000000745C0000-0x0000000074CAE000-memory.dmp

      Filesize

      6.9MB

    • memory/2720-29-0x00000000007C0000-0x0000000000800000-memory.dmp

      Filesize

      256KB

    • memory/2720-22-0x00000000007C0000-0x0000000000800000-memory.dmp

      Filesize

      256KB

    • memory/2720-16-0x00000000007C0000-0x0000000000800000-memory.dmp

      Filesize

      256KB

    • memory/2720-14-0x0000000001280000-0x000000000128C000-memory.dmp

      Filesize

      48KB