Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
62s -
max time network
63s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
20/07/2024, 00:03
Behavioral task
behavioral1
Sample
BLTools 2.9.1 Pro.rar
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
BLTools 2.9.1 Pro.rar
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
BLTools 2.9.1 Pro.exe
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
BLTools 2.9.1 Pro.exe
Resource
win10v2004-20240709-en
General
-
Target
BLTools 2.9.1 Pro.exe
-
Size
6.4MB
-
MD5
d3b80d2e6480771f7e418d35fdee5ef3
-
SHA1
7d9f1c09aebbf199d913b911073c99792b315f26
-
SHA256
b1906ad0d515c2e29b7bf0cc47ea25cf0c63c6be5f828f5b73943f5e6915063e
-
SHA512
01e1bcddcd0efefcf31a65809be5d8ccb679870829cf08a4c8b4aa8db298b9b002ff8971b13321c9eb64b6a41dd70d5ca13e5a886395a2883013f939736dd91a
-
SSDEEP
196608:chJoo8pE2SNowmev8lJKjieK7adi6tC2w5hz:SeHSWe0lJP7wH5it
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 4764 BLTools 2.9.1 Pro.exe 4764 BLTools 2.9.1 Pro.exe 4764 BLTools 2.9.1 Pro.exe 4764 BLTools 2.9.1 Pro.exe 4764 BLTools 2.9.1 Pro.exe 4764 BLTools 2.9.1 Pro.exe 4764 BLTools 2.9.1 Pro.exe 4764 BLTools 2.9.1 Pro.exe 4764 BLTools 2.9.1 Pro.exe 4764 BLTools 2.9.1 Pro.exe 4764 BLTools 2.9.1 Pro.exe 4764 BLTools 2.9.1 Pro.exe 4764 BLTools 2.9.1 Pro.exe 4764 BLTools 2.9.1 Pro.exe 4764 BLTools 2.9.1 Pro.exe 4764 BLTools 2.9.1 Pro.exe 1316 BLTools 2.9.1 Pro.exe 1316 BLTools 2.9.1 Pro.exe 1316 BLTools 2.9.1 Pro.exe 1316 BLTools 2.9.1 Pro.exe 1316 BLTools 2.9.1 Pro.exe 1316 BLTools 2.9.1 Pro.exe 1316 BLTools 2.9.1 Pro.exe 1316 BLTools 2.9.1 Pro.exe 1316 BLTools 2.9.1 Pro.exe 1316 BLTools 2.9.1 Pro.exe 1316 BLTools 2.9.1 Pro.exe 1316 BLTools 2.9.1 Pro.exe 1316 BLTools 2.9.1 Pro.exe 1316 BLTools 2.9.1 Pro.exe 1316 BLTools 2.9.1 Pro.exe 1316 BLTools 2.9.1 Pro.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1316 BLTools 2.9.1 Pro.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\BLTools 2.9.1 Pro.exe"C:\Users\Admin\AppData\Local\Temp\BLTools 2.9.1 Pro.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4764
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\BLTools 2.9.1 Pro.exe"C:\Users\Admin\AppData\Local\Temp\BLTools 2.9.1 Pro.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1316