Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3Proxy Grab...rp.dll
windows7-x64
1Proxy Grab...rp.dll
windows10-2004-x64
1Proxy Grab...ic.dll
windows7-x64
1Proxy Grab...ic.dll
windows10-2004-x64
1Proxy Grab...er.exe
windows7-x64
7Proxy Grab...er.exe
windows10-2004-x64
7Proxy Grab...rp.dll
windows7-x64
1Proxy Grab...rp.dll
windows10-2004-x64
1Proxy Grab...or.exe
windows7-x64
3Proxy Grab...or.exe
windows10-2004-x64
7Proxy Grab...st.exe
windows7-x64
3Proxy Grab...st.exe
windows10-2004-x64
7Proxy Grab...ic.dll
windows7-x64
1Proxy Grab...ic.dll
windows10-2004-x64
1Proxy Grab...32.exe
windows7-x64
1Proxy Grab...32.exe
windows10-2004-x64
1Proxy Grab...ht.dll
windows7-x64
1Proxy Grab...ht.dll
windows10-2004-x64
1Proxy Grab...ht.dll
windows7-x64
1Proxy Grab...ht.dll
windows10-2004-x64
1Analysis
-
max time kernel
113s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28/03/2024, 11:18
Static task
static1
Behavioral task
behavioral1
Sample
Proxy Grabber by Mathian/Proxy Grabber by Mathian/AngleSharp.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
Proxy Grabber by Mathian/Proxy Grabber by Mathian/AngleSharp.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Proxy Grabber by Mathian/Proxy Grabber by Mathian/Microsoft.Dynamic.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Proxy Grabber by Mathian/Proxy Grabber by Mathian/Microsoft.Dynamic.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
Proxy Grabber by Mathian/Proxy Grabber by Mathian/Proxy Grabber by Mathian Developer.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
Proxy Grabber by Mathian/Proxy Grabber by Mathian/Proxy Grabber by Mathian Developer.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
Proxy Grabber by Mathian/Proxy Grabber by Mathian/data/AngleSharp.dll
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
Proxy Grabber by Mathian/Proxy Grabber by Mathian/data/AngleSharp.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
Proxy Grabber by Mathian/Proxy Grabber by Mathian/data/Microsoft Windows Protocol Monitor.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Proxy Grabber by Mathian/Proxy Grabber by Mathian/data/Microsoft Windows Protocol Monitor.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
Proxy Grabber by Mathian/Proxy Grabber by Mathian/data/Microsoft Windows Protocol Services Host.exe
Resource
win7-20240220-en
Behavioral task
behavioral12
Sample
Proxy Grabber by Mathian/Proxy Grabber by Mathian/data/Microsoft Windows Protocol Services Host.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
Proxy Grabber by Mathian/Proxy Grabber by Mathian/data/Microsoft.Dynamic.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
Proxy Grabber by Mathian/Proxy Grabber by Mathian/data/Microsoft.Dynamic.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
Proxy Grabber by Mathian/Proxy Grabber by Mathian/data/dev32.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
Proxy Grabber by Mathian/Proxy Grabber by Mathian/data/dev32.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
Proxy Grabber by Mathian/Proxy Grabber by Mathian/data/mfc100cht.dll
Resource
win7-20240319-en
Behavioral task
behavioral18
Sample
Proxy Grabber by Mathian/Proxy Grabber by Mathian/data/mfc100cht.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
Proxy Grabber by Mathian/Proxy Grabber by Mathian/mfc100cht.dll
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
Proxy Grabber by Mathian/Proxy Grabber by Mathian/mfc100cht.dll
Resource
win10v2004-20240226-en
General
-
Target
Proxy Grabber by Mathian/Proxy Grabber by Mathian/Proxy Grabber by Mathian Developer.exe
-
Size
246KB
-
MD5
d073428ed496be35b6ec207e6395dffb
-
SHA1
425829295fc203ef8ee036a00b6c380acd95078f
-
SHA256
b8bcaefa4f1a500db12252c6ab7f1eae4733e8f54bf5e65b7f47abef949c3200
-
SHA512
e37efcc7a3a5b90f79e9797dd8f8d0aafc507fc3526a28b41346f4be6821668169154f4b8e297b289493ff2fc52b3a26dd5782123f48b152ddabd3895c79905c
-
SSDEEP
6144:Pb6g4ipqFpgRMeQHjIkq7DdXNwBHr1lk/:GBiAFsMe6IkUpOpBy
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation Proxy Grabber by Mathian Developer.exe Key value queried \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation Microsoft Windows Protocol Services Host.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Startup.lnk Proxy Grabber by Mathian Developer.exe -
Executes dropped EXE 2 IoCs
pid Process 4204 Microsoft Windows Protocol Services Host.exe 4400 Microsoft Windows Protocol Monitor.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\Program Files (x86)\Microsoft Host Interface\data\Microsoft Windows Protocol Monitor.exe Proxy Grabber by Mathian Developer.exe File opened for modification C:\Windows\Program Files (x86)\Microsoft Host Interface\data\Microsoft Windows Protocol Monitor.exe Proxy Grabber by Mathian Developer.exe File created C:\Windows\Program Files (x86)\Microsoft Host Interface\data\Microsoft Windows Protocol Services Host.exe Proxy Grabber by Mathian Developer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4204 Microsoft Windows Protocol Services Host.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 4204 Microsoft Windows Protocol Services Host.exe 4204 Microsoft Windows Protocol Services Host.exe 4204 Microsoft Windows Protocol Services Host.exe 4400 Microsoft Windows Protocol Monitor.exe 4400 Microsoft Windows Protocol Monitor.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4204 Microsoft Windows Protocol Services Host.exe Token: SeDebugPrivilege 4400 Microsoft Windows Protocol Monitor.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4972 wrote to memory of 4204 4972 Proxy Grabber by Mathian Developer.exe 100 PID 4972 wrote to memory of 4204 4972 Proxy Grabber by Mathian Developer.exe 100 PID 4972 wrote to memory of 3376 4972 Proxy Grabber by Mathian Developer.exe 102 PID 4972 wrote to memory of 3376 4972 Proxy Grabber by Mathian Developer.exe 102 PID 4972 wrote to memory of 3376 4972 Proxy Grabber by Mathian Developer.exe 102 PID 4204 wrote to memory of 4400 4204 Microsoft Windows Protocol Services Host.exe 103 PID 4204 wrote to memory of 4400 4204 Microsoft Windows Protocol Services Host.exe 103 PID 4204 wrote to memory of 4400 4204 Microsoft Windows Protocol Services Host.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\Proxy Grabber by Mathian\Proxy Grabber by Mathian\Proxy Grabber by Mathian Developer.exe"C:\Users\Admin\AppData\Local\Temp\Proxy Grabber by Mathian\Proxy Grabber by Mathian\Proxy Grabber by Mathian Developer.exe"1⤵
- Checks computer location settings
- Drops startup file
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\Program Files (x86)\Microsoft Host Interface\data\Microsoft Windows Protocol Services Host.exe"C:\Windows\Program Files (x86)\Microsoft Host Interface\data\Microsoft Windows Protocol Services Host.exe" {Arguments If Needed}2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Windows\Program Files (x86)\Microsoft Host Interface\data\Microsoft Windows Protocol Monitor.exe"C:\Windows\Program Files (x86)\Microsoft Host Interface\data\Microsoft Windows Protocol Monitor.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4400
-
-
-
C:\Users\Admin\AppData\Local\Temp\Proxy Grabber by Mathian\Proxy Grabber by Mathian\data\dev32.exe"C:\Users\Admin\AppData\Local\Temp\Proxy Grabber by Mathian\Proxy Grabber by Mathian\data\dev32.exe" {Arguments If Needed}2⤵PID:3376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1028 --field-trial-handle=2272,i,1589057049575649654,2929151440327217574,262144 --variations-seed-version /prefetch:81⤵PID:3764
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD561fce223872024b0ecb0bb2a7ffb7c47
SHA1f893d620f9d843c8bdb86a0375f856508a6ce136
SHA2564b5069b9708a8e97b17af6aa96cf2112877a675b4dbc1f6dbc2601b494b35d11
SHA5128926a5f7d6aa862351044d79a634decda989b50ad422ba3e9a97c573ff618a8314607a7afe093925f56d87861eefb31d3820d9e02b1cf2847c0e6072880ac192
-
C:\Windows\Program Files (x86)\Microsoft Host Interface\data\Microsoft Windows Protocol Services Host.exe
Filesize10KB
MD57e4ec49968cdfeb455c1f56c5a944287
SHA101a9bc140345909f970e4ef6f7c4efd0ebc0fe09
SHA256c68300968c576203725e09edf1ac9b069b903ee06a4321c8c8fe5582898c10e4
SHA51261823c4fcb0e3bbab44286215b702a0306984083f4b55347a82671b6393e67522c91269686d910b229781470db79ce4b46a1336a6e6afb077b8fb6f9d9c5094f