Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
9Static
static
3FiddlerSet...st.exe
windows7-x64
9FiddlerSet...st.exe
windows10-2004-x64
9$PLUGINSDI...up.exe
windows7-x64
9$PLUGINSDI...up.exe
windows10-2004-x64
9$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Analytics.dll
windows7-x64
1Analytics.dll
windows10-2004-x64
1Be.Windows...ox.dll
windows7-x64
1Be.Windows...ox.dll
windows10-2004-x64
1DotNetZip.dll
windows7-x64
1DotNetZip.dll
windows10-2004-x64
1EnableLoopback.exe
windows7-x64
3EnableLoopback.exe
windows10-2004-x64
7ExecAction.exe
windows7-x64
1ExecAction.exe
windows10-2004-x64
1FSE2.exe
windows7-x64
3FSE2.exe
windows10-2004-x64
3Fiddler.exe
windows7-x64
1Fiddler.exe
windows10-2004-x64
3ForceCPU.exe
windows7-x64
1ForceCPU.exe
windows10-2004-x64
1GA.Analyti...or.dll
windows7-x64
1GA.Analyti...or.dll
windows10-2004-x64
1ImportExpo...ts.dll
windows7-x64
1ImportExpo...ts.dll
windows10-2004-x64
1ImportExpo...rt.dll
windows7-x64
1ImportExpo...rt.dll
windows10-2004-x64
1Inspectors...on.dll
windows7-x64
1Inspectors...on.dll
windows10-2004-x64
1Inspectors...or.dll
windows7-x64
1Inspectors...or.dll
windows10-2004-x64
1Analysis
-
max time kernel
144s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
10/10/2024, 10:02
Static task
static1
Behavioral task
behavioral1
Sample
FiddlerSetup.5.0.20242.10753-latest.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
FiddlerSetup.5.0.20242.10753-latest.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/FiddlerSetup.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/FiddlerSetup.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Analytics.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Analytics.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Be.Windows.Forms.HexBox.dll
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
Be.Windows.Forms.HexBox.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
DotNetZip.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
DotNetZip.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
EnableLoopback.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
EnableLoopback.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
ExecAction.exe
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
ExecAction.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
FSE2.exe
Resource
win7-20241010-en
Behavioral task
behavioral18
Sample
FSE2.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
Fiddler.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
Fiddler.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
ForceCPU.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
ForceCPU.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
GA.Analytics.Monitor.dll
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
GA.Analytics.Monitor.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
ImportExport/BasicFormats.dll
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
ImportExport/BasicFormats.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
ImportExport/VSWebTestExport.dll
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
ImportExport/VSWebTestExport.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
Inspectors/QWhale.Common.dll
Resource
win7-20241010-en
Behavioral task
behavioral30
Sample
Inspectors/QWhale.Common.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
Inspectors/QWhale.Editor.dll
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
Inspectors/QWhale.Editor.dll
Resource
win10v2004-20241007-en
General
-
Target
Fiddler.exe
-
Size
3.5MB
-
MD5
32cf2e7c6ae825d5f7cb2a7d39c2ee24
-
SHA1
262176d879e7727375025cae4aafc90698adad26
-
SHA256
d7ea71114bfe70383c1ac2be6dd19676805a0afb6e20c0ad3000018afad093e5
-
SHA512
a72e70f1a11d4443aedc56a2453cb3ed05bd8106b0e906364f23f01098a378440d2d86ac15f6d98ceedfe18b0a60d80f6806300b390c2969c3de97cb380b82c2
-
SSDEEP
49152:0Ms91NvXsJm+5Tti9og1fcaufet3YG5kCTnEsRH0jgB3:RsfNvXsJm+5TtiTMfeJnEsRHAgt
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main Fiddler.exe -
Suspicious behavior: EnumeratesProcesses 17 IoCs
pid Process 2148 Fiddler.exe 2148 Fiddler.exe 2148 Fiddler.exe 2148 Fiddler.exe 2148 Fiddler.exe 2148 Fiddler.exe 2148 Fiddler.exe 2148 Fiddler.exe 2148 Fiddler.exe 2148 Fiddler.exe 2148 Fiddler.exe 2148 Fiddler.exe 2148 Fiddler.exe 2148 Fiddler.exe 2148 Fiddler.exe 2148 Fiddler.exe 2148 Fiddler.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2148 Fiddler.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2148 Fiddler.exe 2148 Fiddler.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fiddler.exe"C:\Users\Admin\AppData\Local\Temp\Fiddler.exe"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2148
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:2804
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Progress_Software_Corpora\Fiddler.exe_Url_sblwdlp4jxb3bmuxfbi1zl1jd5acanau\5.0.20242.10753\user.config
Filesize966B
MD50614bfd813d8b79da1f4ad1b5f8c2d80
SHA1a43a88b65b24821670138f0db7424005dddccb1b
SHA2568480578c28d9f5df51fe7df8199514f00b520e696975249a4e15cf2a9d4457d4
SHA512891f7c006154fa8c36578906221e1a6c577ca05053417c49ba852e3f3ff012c8c7d4438202025aa5ecf983ecbd35cf1241ba63950583d7da419651cdb36f5948
-
C:\Users\Admin\AppData\Local\Progress_Software_Corpora\Fiddler.exe_Url_sblwdlp4jxb3bmuxfbi1zl1jd5acanau\5.0.20242.10753\user.config
Filesize1KB
MD5469899558574f01ff57606562e413372
SHA1eaf070b8bc7f0770e87d66dc84e3d1c62837aac4
SHA256ec3e0f7049df6d7e69b162f91f3cf819ee1f6fbbd87926824ec2f3f575250b5e
SHA512cb97f624ddade7a0fa4c66d072f1bad281af5e4c14c0bda903a82fe54f664d29fec751a3f733d7bedf80fcc25e644700f707cc9545c06c29d0c817deb8f142e4
-
C:\Users\Admin\AppData\Local\Progress_Software_Corpora\Fiddler.exe_Url_sblwdlp4jxb3bmuxfbi1zl1jd5acanau\5.0.20242.10753\user.config
Filesize1KB
MD5070cd3a2e9a881c8505d90ce3f6fb478
SHA13fbbac45de3a301a5af3aa7f897b560642c5c66d
SHA256467300b24bd1474d3a145d128fd25f40e54d8996396f1a5251761dc0f31b24a0
SHA5122fe00a66aa4f4e7831963212d271f846b948e7c9d6ebb67ff26031606997ef4bbe1e64972ca6e90f9e70c6a5e95d0fca2a391892d06eb365235c8a17a3fa9612