Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
8Static
static
7BH2002/BH2002.exe
windows7-x64
8BH2002/BH2002.exe
windows10-2004-x64
1BH2002/BH2...H2.exe
windows7-x64
3BH2002/BH2...H2.exe
windows10-2004-x64
1BH2002/PlayGame.exe
windows7-x64
7BH2002/PlayGame.exe
windows10-2004-x64
7BH2002/RegSetup.exe
windows7-x64
1BH2002/RegSetup.exe
windows10-2004-x64
1BH2002/bh2.exe
windows7-x64
3BH2002/bh2.exe
windows10-2004-x64
1安装程序.exe
windows7-x64
7安装程序.exe
windows10-2004-x64
7Analysis
-
max time kernel
147s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 12:38
Behavioral task
behavioral1
Sample
BH2002/BH2002.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
BH2002/BH2002.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
BH2002/BH2Game/BH2.exe
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
BH2002/BH2Game/BH2.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
BH2002/PlayGame.exe
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
BH2002/PlayGame.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
BH2002/RegSetup.exe
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
BH2002/RegSetup.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
BH2002/bh2.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
BH2002/bh2.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
安装程序.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
安装程序.exe
Resource
win10v2004-20240426-en
General
-
Target
安装程序.exe
-
Size
475KB
-
MD5
58860f344ef256d89bdb2da87956e1df
-
SHA1
29dd02d0189427f01bf06061fa2cb1cce52d5420
-
SHA256
80eb3ae83a4677c885ec10b0d9c0b6c99f71fcc2ee313c5783e3b4d741531672
-
SHA512
a40988a7a8d0e6cb5c9a28148aa0b153be8dcd1f2c4cc843dc29187bb17c6ea9e3006c42badeb65bfbf08a48436e8dbd497ba09cbccc9b100ae23d3c6693940d
-
SSDEEP
12288:BidNsyc5AeVjDe+NImEULEUm0DE9nCWpcHvmX//XZ4Nzdd:BENwAeIuzLE3owCa2eXXZ4Nzdd
Malware Config
Signatures
-
resource yara_rule behavioral12/memory/392-0-0x0000000000FD0000-0x00000000010CF000-memory.dmp upx behavioral12/memory/392-418-0x0000000000FD0000-0x00000000010CF000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 392 安装程序.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 392 安装程序.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192KB
MD54d1cd5a570ddd8b79f3d605dc4992e1f
SHA1f22c35045123ce9af7cfe94920676bc2af268df0
SHA25688cf636b8050e308804559dc9bf6b2d6e504275e928896bc81c733125b87fdb5
SHA512df064a587b76e97702c37900cd17a6c03ccdd3d4f43ea9aede8a511c3fb979ec32b5d4eb0255d8776519ffab0471c499c5707315d7d4070869644a71432438ae
-
Filesize
256KB
MD5d8d9c4487d50f761fa5d67293f34b9c6
SHA116e925ceeb674240ebef6194fcfcdf40d6f27eaf
SHA256f9f04ac9d24a0a66baefb7f10ce3012ca069c2993dfc8f1eae58b709c25d894b
SHA512dda65325db90f42dedd019566e2e794b1e12a3246108c3505c04d10b16725005ace738965fb586224b1f5d5f7ed3d00093856a3469efc0b4c1592790f9254fb7
-
Filesize
96KB
MD537ffc547dd151b44186ae3bb7963eaec
SHA1d6b45691f6c11535fe07aeca50dbb62e6900a85a
SHA2563a48ab5e024902907e074494c2c79190fa86052e5ad79b19cd07f3cdca3d1b1c
SHA512496f0f5b1ad3053a8d7a47048ee5a22f9d90ffadf21d656ead6cec1c8f3f567ad3c555f7581c20e37768495f4bf0c88777dc94e0cafc1d50a6810b190efca70d
-
Filesize
96KB
MD538a83a9dede09a5c7405f847a3942505
SHA16965c6b005c7ad1008eda710c121e3793bd6fc50
SHA2560af5c14a6fd20157bd9986048656ed72f0fe12026955fabcfca31730ce49e002
SHA512ee8c8ae8f1f4803f192cf97611495b04ecaee5fff244dc4bc9734470cd78e503e8d57c036a885e8a95bd072bd3fe7aa4768aa700d2b476dc8f365601255ac34d
-
Filesize
96KB
MD5954128cdb3b7d54a032cac323df07c36
SHA1522e06ce4ae75ad3b7a36f31040d781d91546c91
SHA25619e6ff911bbf9fbf711088424fa1d7ec8463938f073c14752e76abcf6f107a30
SHA512eff7650d539ae340a4c4f697ce9131ff51d2cd75803dd18a66e0d037373fdf68f135fbad2bb6fe4b43a62a81a5106f89ebac53a97f4cfbfb5de11c998a5f5d97
-
Filesize
96KB
MD5cf0b986ee1a87211469d4dc7ee7cb091
SHA1335cf09097cc50cbd11407ce5a9bfd79c91b09e9
SHA256a7e4760700fb79cf7023b04eec4e8a6f477101eb77702f0db45538d5c230bca2
SHA512660aca847da7f32910f742b68dd75a576a49ecec4a8bba7a1db2b8f64416c6c46c1ab39fcd75152a0636e3916978fc3b98703d33d1acbd281ff6bf6c55c5dd44
-
Filesize
192KB
MD56dce83fa4ab6162e860ceaf28a7588a1
SHA1b468f0a3e9d4c7fa95412859795ea522c526c2d0
SHA2567757887d55aefa7b07e81be85489e57b59f27ff051ebc0157b180593e7c7175b
SHA512e2ce04c3c043e9fb3f5349ff5489ecb37c272a90e7d6b92963923a44d11c7f9bc0c6b3bbbf23a23a7d9668db53849a601323d035148efc6b08b247179498cfb3
-
Filesize
192KB
MD50268652e66817c76ec0afd9287abb73e
SHA1822f0002371541318d103e3dc43a1d89981bbdf9
SHA256b1d8a16dae51fd4d583fa499a97a88c735f70253e8eafbbc170da0e664eb8d5f
SHA51284a78e9892252a6950b2916d009e0fbee39446e8e17dcb72a6716f50da7ec677a504488f943e6d3b46582f29100b16768e212e6daa95a9d9e30dded0ace795c4