Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
8Static
static
7BH2002/BH2002.exe
windows7-x64
8BH2002/BH2002.exe
windows10-2004-x64
1BH2002/BH2...H2.exe
windows7-x64
3BH2002/BH2...H2.exe
windows10-2004-x64
1BH2002/PlayGame.exe
windows7-x64
7BH2002/PlayGame.exe
windows10-2004-x64
7BH2002/RegSetup.exe
windows7-x64
1BH2002/RegSetup.exe
windows10-2004-x64
1BH2002/bh2.exe
windows7-x64
3BH2002/bh2.exe
windows10-2004-x64
1安装程序.exe
windows7-x64
7安装程序.exe
windows10-2004-x64
7Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 12:38
Behavioral task
behavioral1
Sample
BH2002/BH2002.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
BH2002/BH2002.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
BH2002/BH2Game/BH2.exe
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
BH2002/BH2Game/BH2.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
BH2002/PlayGame.exe
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
BH2002/PlayGame.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
BH2002/RegSetup.exe
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
BH2002/RegSetup.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
BH2002/bh2.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
BH2002/bh2.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
安装程序.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
安装程序.exe
Resource
win10v2004-20240426-en
General
-
Target
BH2002/bh2.exe
-
Size
168KB
-
MD5
6d715f40e03559d62583e39ff3d71df4
-
SHA1
ad33aa2ca168abd3cd723fa98be66b32d936b7c6
-
SHA256
2633bf56272138bf3cb10138c595c4997459752a346aa9c3f1d804d9d8e614dc
-
SHA512
1486fdb0c406329961aef6f9e37b6a4edfcb10608cc5ed4b82a6ec5f2d6863f633946bfbdff4d3a3e7dedcc0cb505e064a2966bfbcfb94090605fb8e3950362b
-
SSDEEP
3072:qNnZNJQCxti+gt0zsbXq7MCti4Ok1q5DfE6IHMmzoc:AZNJQCxti+ggT7Vq5DfNIH
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2348 bh2.exe 2348 bh2.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2348 bh2.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 1408 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1408 AUDIODG.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2348 bh2.exe 2348 bh2.exe 2348 bh2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\BH2002\bh2.exe"C:\Users\Admin\AppData\Local\Temp\BH2002\bh2.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2348
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4ec 0x4e41⤵
- Suspicious use of AdjustPrivilegeToken
PID:1408
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
450B
MD546f41e004709c7db1cb81d77d89df1ba
SHA1e08f33bb3d5acd91d9b962b824f663372a820e32
SHA256ad4b1821ecd6f8690f7169a2b120e775dac1c65b185ecada1ddddc41b6fb8c60
SHA5127a7d7b0a09baab6278f70edf0a5d7dcc591f7d0cd790247331d2ee1590700baad2358c6cd6cc7e3ec1b54733d10d521fdc011771bd4cdabb4d9f0dd7926342e1