Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

BPLogger-main.zip

windows7-x64

1

BPLogger-main.zip

windows10-2004-x64

1

BPLogger-m...er.rar

windows7-x64

10

BPLogger-m...er.rar

windows10-2004-x64

10

BPLogger.exe

windows7-x64

10

BPLogger.exe

windows10-2004-x64

10

tapi.dll

windows7-x64

1

tapi.dll

windows10-2004-x64

1

x64.dll

windows7-x64

3

x64.dll

windows10-2004-x64

3

BPLogger-m...DME.md

windows7-x64

3

BPLogger-m...DME.md

windows10-2004-x64

3

Analysis

  • max time kernel
    91s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250129-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/01/2025, 04:24 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    BPLogger-main.zip

  • Size

    1.2MB

  • MD5

    4f70daa5c48d5a22396f065a816f9b41

  • SHA1

    da08c8711ef8aac407f460e1c8f3f24f53fc81c2

  • SHA256

    77153049f33480d1b665c68aa0732e531f963f9acb04b9e016baafeca3b54dd8

  • SHA512

    dc233af831e31e3e720edb1eeffe36ac2e887f1d048fb8c9a25b5a64c840b68babf8d19b85bcb704f278b7e4edd709d32a6df5d50ed546bafc757d50e07e9c42

  • SSDEEP

    24576:3kjLFxQGJiip1cakQYJu+W4JBuMADnTy4J7aEJk4YfXnDb0FbBpbKEXENPcfVc:UPrQGpEBdJdJBuMqnZJ7aEIfXnDbcbBy

Score
1/10

Malware Config

Signatures

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\BPLogger-main.zip
    1⤵
      PID:3292

    Network

    • flag-us
      DNS
      g.bing.com
      Remote address:
      8.8.8.8:53
      Request
      g.bing.com
      IN A
      Response
      g.bing.com
      IN CNAME
      g-bing-com.ax-0001.ax-msedge.net
      g-bing-com.ax-0001.ax-msedge.net
      IN CNAME
      ax-0001.ax-msedge.net
      ax-0001.ax-msedge.net
      IN A
      150.171.28.10
      ax-0001.ax-msedge.net
      IN A
      150.171.27.10
    • flag-us
      GET
      https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=8708c71ce2b54b21944e2efb565eb6b4&localId=w:CED07D76-568E-F00B-486A-AAD2F0DB624F&deviceId=6896210250710623&anid=
      Remote address:
      150.171.28.10:443
      Request
      GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=8708c71ce2b54b21944e2efb565eb6b4&localId=w:CED07D76-568E-F00B-486A-AAD2F0DB624F&deviceId=6896210250710623&anid= HTTP/2.0
      host: g.bing.com
      accept-encoding: gzip, deflate
      user-agent: WindowsShellClient/9.0.40929.0 (Windows)
      Response
      HTTP/2.0 204
      cache-control: no-cache, must-revalidate
      pragma: no-cache
      expires: Fri, 01 Jan 1990 00:00:00 GMT
      set-cookie: MUID=172DFB4E80706DBA1A90EECB81766CAA; domain=.bing.com; expires=Wed, 25-Feb-2026 04:24:43 GMT; path=/; SameSite=None; Secure; Priority=High;
      strict-transport-security: max-age=31536000; includeSubDomains; preload
      access-control-allow-origin: *
      x-cache: CONFIG_NOCACHE
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: E109C3A498794DD6B04F7E05AEF06CF9 Ref B: LON601060108011 Ref C: 2025-01-31T04:24:43Z
      date: Fri, 31 Jan 2025 04:24:43 GMT
    • flag-us
      GET
      https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=8708c71ce2b54b21944e2efb565eb6b4&localId=w:CED07D76-568E-F00B-486A-AAD2F0DB624F&deviceId=6896210250710623&anid=
      Remote address:
      150.171.28.10:443
      Request
      GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=8708c71ce2b54b21944e2efb565eb6b4&localId=w:CED07D76-568E-F00B-486A-AAD2F0DB624F&deviceId=6896210250710623&anid= HTTP/2.0
      host: g.bing.com
      accept-encoding: gzip, deflate
      user-agent: WindowsShellClient/9.0.40929.0 (Windows)
      cookie: MUID=172DFB4E80706DBA1A90EECB81766CAA
      Response
      HTTP/2.0 204
      cache-control: no-cache, must-revalidate
      pragma: no-cache
      expires: Fri, 01 Jan 1990 00:00:00 GMT
      set-cookie: MSPTC=TF4fQtiLBJlRhOMrpii_U0vAsJvDoPfR7r6UHNzZI7Y; domain=.bing.com; expires=Wed, 25-Feb-2026 04:24:43 GMT; path=/; Partitioned; secure; SameSite=None
      strict-transport-security: max-age=31536000; includeSubDomains; preload
      access-control-allow-origin: *
      x-cache: CONFIG_NOCACHE
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 33F35054CC8F4648855813A7BD14388F Ref B: LON601060108011 Ref C: 2025-01-31T04:24:44Z
      date: Fri, 31 Jan 2025 04:24:43 GMT
    • flag-us
      GET
      https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=8708c71ce2b54b21944e2efb565eb6b4&localId=w:CED07D76-568E-F00B-486A-AAD2F0DB624F&deviceId=6896210250710623&anid=
      Remote address:
      150.171.28.10:443
      Request
      GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=8708c71ce2b54b21944e2efb565eb6b4&localId=w:CED07D76-568E-F00B-486A-AAD2F0DB624F&deviceId=6896210250710623&anid= HTTP/2.0
      host: g.bing.com
      accept-encoding: gzip, deflate
      user-agent: WindowsShellClient/9.0.40929.0 (Windows)
      cookie: MUID=172DFB4E80706DBA1A90EECB81766CAA; MSPTC=TF4fQtiLBJlRhOMrpii_U0vAsJvDoPfR7r6UHNzZI7Y
      Response
      HTTP/2.0 204
      cache-control: no-cache, must-revalidate
      pragma: no-cache
      expires: Fri, 01 Jan 1990 00:00:00 GMT
      strict-transport-security: max-age=31536000; includeSubDomains; preload
      access-control-allow-origin: *
      x-cache: CONFIG_NOCACHE
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 92E9586B1E6A427E805603E48F137056 Ref B: LON601060108011 Ref C: 2025-01-31T04:24:44Z
      date: Fri, 31 Jan 2025 04:24:43 GMT
    • flag-us
      DNS
      10.28.171.150.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      10.28.171.150.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      10.28.171.150.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      10.28.171.150.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      167.173.78.104.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      167.173.78.104.in-addr.arpa
      IN PTR
      Response
      167.173.78.104.in-addr.arpa
      IN PTR
      a104-78-173-167deploystaticakamaitechnologiescom
    • flag-us
      DNS
      167.173.78.104.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      167.173.78.104.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      69.31.126.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      69.31.126.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      69.31.126.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      69.31.126.40.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      57.169.31.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      57.169.31.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      56.163.245.4.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      56.163.245.4.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      15.164.165.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      15.164.165.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      15.164.165.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      15.164.165.52.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      43.229.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      43.229.111.52.in-addr.arpa
      IN PTR
      Response
    • 150.171.28.10:443
      https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=8708c71ce2b54b21944e2efb565eb6b4&localId=w:CED07D76-568E-F00B-486A-AAD2F0DB624F&deviceId=6896210250710623&anid=
      tls, http2
      2.0kB
       9.3kB
       21
      18

      HTTP Request

      GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=8708c71ce2b54b21944e2efb565eb6b4&localId=w:CED07D76-568E-F00B-486A-AAD2F0DB624F&deviceId=6896210250710623&anid=

      HTTP Response

      204

      HTTP Request

      GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=8708c71ce2b54b21944e2efb565eb6b4&localId=w:CED07D76-568E-F00B-486A-AAD2F0DB624F&deviceId=6896210250710623&anid=

      HTTP Response

      204

      HTTP Request

      GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=8708c71ce2b54b21944e2efb565eb6b4&localId=w:CED07D76-568E-F00B-486A-AAD2F0DB624F&deviceId=6896210250710623&anid=

      HTTP Response

      204
    • 8.8.8.8:53
      g.bing.com
      dns
      56 B
       148 B
       1
      1

      DNS Request

      g.bing.com

      DNS Response

      150.171.28.10
      150.171.27.10

    • 8.8.8.8:53
      10.28.171.150.in-addr.arpa
      dns
      144 B
       158 B
       2
      1

      DNS Request

      10.28.171.150.in-addr.arpa

      DNS Request

      10.28.171.150.in-addr.arpa

    • 8.8.8.8:53
      167.173.78.104.in-addr.arpa
      dns
      146 B
       139 B
       2
      1

      DNS Request

      167.173.78.104.in-addr.arpa

      DNS Request

      167.173.78.104.in-addr.arpa

    • 8.8.8.8:53
      69.31.126.40.in-addr.arpa
      dns
      142 B
       157 B
       2
      1

      DNS Request

      69.31.126.40.in-addr.arpa

      DNS Request

      69.31.126.40.in-addr.arpa

    • 8.8.8.8:53
      57.169.31.20.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      57.169.31.20.in-addr.arpa

    • 8.8.8.8:53
      56.163.245.4.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      56.163.245.4.in-addr.arpa

    • 8.8.8.8:53
      15.164.165.52.in-addr.arpa
      dns
      144 B
       146 B
       2
      1

      DNS Request

      15.164.165.52.in-addr.arpa

      DNS Request

      15.164.165.52.in-addr.arpa

    • 8.8.8.8:53
      43.229.111.52.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      43.229.111.52.in-addr.arpa

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.