Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
8Static
static
7BH2002/BH2002.exe
windows7-x64
8BH2002/BH2002.exe
windows10-2004-x64
1BH2002/BH2...H2.exe
windows7-x64
3BH2002/BH2...H2.exe
windows10-2004-x64
1BH2002/PlayGame.exe
windows7-x64
7BH2002/PlayGame.exe
windows10-2004-x64
7BH2002/RegSetup.exe
windows7-x64
1BH2002/RegSetup.exe
windows10-2004-x64
1BH2002/bh2.exe
windows7-x64
3BH2002/bh2.exe
windows10-2004-x64
1安装程序.exe
windows7-x64
7安装程序.exe
windows10-2004-x64
7Analysis
-
max time kernel
140s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 12:38
Behavioral task
behavioral1
Sample
BH2002/BH2002.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
BH2002/BH2002.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
BH2002/BH2Game/BH2.exe
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
BH2002/BH2Game/BH2.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
BH2002/PlayGame.exe
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
BH2002/PlayGame.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
BH2002/RegSetup.exe
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
BH2002/RegSetup.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
BH2002/bh2.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
BH2002/bh2.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
安装程序.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
安装程序.exe
Resource
win10v2004-20240426-en
General
-
Target
安装程序.exe
-
Size
475KB
-
MD5
58860f344ef256d89bdb2da87956e1df
-
SHA1
29dd02d0189427f01bf06061fa2cb1cce52d5420
-
SHA256
80eb3ae83a4677c885ec10b0d9c0b6c99f71fcc2ee313c5783e3b4d741531672
-
SHA512
a40988a7a8d0e6cb5c9a28148aa0b153be8dcd1f2c4cc843dc29187bb17c6ea9e3006c42badeb65bfbf08a48436e8dbd497ba09cbccc9b100ae23d3c6693940d
-
SSDEEP
12288:BidNsyc5AeVjDe+NImEULEUm0DE9nCWpcHvmX//XZ4Nzdd:BENwAeIuzLE3owCa2eXXZ4Nzdd
Malware Config
Signatures
-
resource yara_rule behavioral11/memory/2968-0-0x0000000001080000-0x000000000117F000-memory.dmp upx behavioral11/memory/2968-427-0x0000000001080000-0x000000000117F000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 安装程序.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde 安装程序.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2968 安装程序.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2968 安装程序.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192KB
MD54d1cd5a570ddd8b79f3d605dc4992e1f
SHA1f22c35045123ce9af7cfe94920676bc2af268df0
SHA25688cf636b8050e308804559dc9bf6b2d6e504275e928896bc81c733125b87fdb5
SHA512df064a587b76e97702c37900cd17a6c03ccdd3d4f43ea9aede8a511c3fb979ec32b5d4eb0255d8776519ffab0471c499c5707315d7d4070869644a71432438ae
-
Filesize
256KB
MD5d8d9c4487d50f761fa5d67293f34b9c6
SHA116e925ceeb674240ebef6194fcfcdf40d6f27eaf
SHA256f9f04ac9d24a0a66baefb7f10ce3012ca069c2993dfc8f1eae58b709c25d894b
SHA512dda65325db90f42dedd019566e2e794b1e12a3246108c3505c04d10b16725005ace738965fb586224b1f5d5f7ed3d00093856a3469efc0b4c1592790f9254fb7
-
Filesize
96KB
MD537ffc547dd151b44186ae3bb7963eaec
SHA1d6b45691f6c11535fe07aeca50dbb62e6900a85a
SHA2563a48ab5e024902907e074494c2c79190fa86052e5ad79b19cd07f3cdca3d1b1c
SHA512496f0f5b1ad3053a8d7a47048ee5a22f9d90ffadf21d656ead6cec1c8f3f567ad3c555f7581c20e37768495f4bf0c88777dc94e0cafc1d50a6810b190efca70d
-
Filesize
96KB
MD538a83a9dede09a5c7405f847a3942505
SHA16965c6b005c7ad1008eda710c121e3793bd6fc50
SHA2560af5c14a6fd20157bd9986048656ed72f0fe12026955fabcfca31730ce49e002
SHA512ee8c8ae8f1f4803f192cf97611495b04ecaee5fff244dc4bc9734470cd78e503e8d57c036a885e8a95bd072bd3fe7aa4768aa700d2b476dc8f365601255ac34d
-
Filesize
96KB
MD5954128cdb3b7d54a032cac323df07c36
SHA1522e06ce4ae75ad3b7a36f31040d781d91546c91
SHA25619e6ff911bbf9fbf711088424fa1d7ec8463938f073c14752e76abcf6f107a30
SHA512eff7650d539ae340a4c4f697ce9131ff51d2cd75803dd18a66e0d037373fdf68f135fbad2bb6fe4b43a62a81a5106f89ebac53a97f4cfbfb5de11c998a5f5d97
-
Filesize
96KB
MD5cf0b986ee1a87211469d4dc7ee7cb091
SHA1335cf09097cc50cbd11407ce5a9bfd79c91b09e9
SHA256a7e4760700fb79cf7023b04eec4e8a6f477101eb77702f0db45538d5c230bca2
SHA512660aca847da7f32910f742b68dd75a576a49ecec4a8bba7a1db2b8f64416c6c46c1ab39fcd75152a0636e3916978fc3b98703d33d1acbd281ff6bf6c55c5dd44
-
Filesize
192KB
MD56dce83fa4ab6162e860ceaf28a7588a1
SHA1b468f0a3e9d4c7fa95412859795ea522c526c2d0
SHA2567757887d55aefa7b07e81be85489e57b59f27ff051ebc0157b180593e7c7175b
SHA512e2ce04c3c043e9fb3f5349ff5489ecb37c272a90e7d6b92963923a44d11c7f9bc0c6b3bbbf23a23a7d9668db53849a601323d035148efc6b08b247179498cfb3
-
Filesize
192KB
MD50268652e66817c76ec0afd9287abb73e
SHA1822f0002371541318d103e3dc43a1d89981bbdf9
SHA256b1d8a16dae51fd4d583fa499a97a88c735f70253e8eafbbc170da0e664eb8d5f
SHA51284a78e9892252a6950b2916d009e0fbee39446e8e17dcb72a6716f50da7ec677a504488f943e6d3b46582f29100b16768e212e6daa95a9d9e30dded0ace795c4