Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

5

JaffaCakes...31.exe

windows7-x64

3

JaffaCakes...31.exe

windows10-2004-x64

3

$PLUGINSDI...sh.dll

windows7-x64

3

$PLUGINSDI...sh.dll

windows10-2004-x64

3

$PLUGINSDI...ar.exe

windows7-x64

7

$PLUGINSDI...ar.exe

windows10-2004-x64

3

$PROGRAM_F...er.exe

windows7-x64

3

$PROGRAM_F...er.exe

windows10-2004-x64

3

$PROGRAM_F...ar.dll

windows7-x64

7

$PROGRAM_F...ar.dll

windows10-2004-x64

7

$PROGRAM_F...rX.dll

windows7-x64

7

$PROGRAM_F...rX.dll

windows10-2004-x64

7

$PROGRAM_F...er.exe

windows7-x64

3

$PROGRAM_F...er.exe

windows10-2004-x64

3

$PROGRAM_F...rc.dll

windows7-x64

3

$PROGRAM_F...rc.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...pt.exe

windows7-x64

7

$PLUGINSDI...pt.exe

windows10-2004-x64

7

$PLUGINSDI...an.exe

windows7-x64

7

$PLUGINSDI...an.exe

windows10-2004-x64

7

$PLUGINSDI...an.exe

windows7-x64

7

$PLUGINSDI...an.exe

windows10-2004-x64

7

$PLUGINSDI...st.exe

windows7-x64

7

$PLUGINSDI...st.exe

windows10-2004-x64

3

$PLUGINSDIR/v9fft.exe

windows7-x64

10

$PLUGINSDIR/v9fft.exe

windows10-2004-x64

10

$TEMP/AskPIP_FF_.exe

windows7-x64

3

$TEMP/AskPIP_FF_.exe

windows10-2004-x64

3

$TEMP/AskT...IC.dll

windows7-x64

8

$TEMP/AskT...IC.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21/02/2025, 20:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    $PLUGINSDIR/Baidu-TB-ASBar.exe

  • Size

    1.3MB

  • MD5

    d848ef0636ea49d340f074f939db817b

  • SHA1

    56a9d762d288ab173b7bfd42c9902e12b673bdb7

  • SHA256

    c91716ba6dd14b67c3ccd797ac90a07f535b9d1db9a2a58c20738c791bc793ba

  • SHA512

    6117d668f40bc468e20cd93527435858c23557ef24947ed8fe7206db4b02a34eaa0b37a1f3d3897057b74bec23d784b1f462faf2027e007ba52b503269b5cbc5

  • SSDEEP

    24576:Q2kD39pDYvFHvnLdktGrNX8syDaOmQuHYwRjXq8kWfPRwxVdBwQOOTG8Yz:Q2kLfYvFvnBFBXIgpRD/kWfPRYVMYTGB

Score
7/10
adwarediscoverystealer

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 26 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 5 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in Program Files directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Baidu-TB-ASBar.exe
    "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Baidu-TB-ASBar.exe"
    1⤵
    • Loads dropped DLL
    • Installs/modifies Browser Helper Object
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2448
    • C:\Program Files (x86)\Baidu\Toolbar\BarBroker.exe
      "C:\Program Files (x86)\Baidu\Toolbar\BarBroker.exe" -RegServer
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies registry class
      PID:2768
    • C:\PROGRA~2\baidu\{5CA09~1\ASBarBroker.exe
      "C:\PROGRA~2\baidu\{5CA09~1\ASBarBroker.exe" -RegServer
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies registry class
      PID:2560

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\PROGRA~2\Baidu\{5CA09~1\ASBarBroker.exe
    Filesize

    129KB

    MD5

    74f5e70ef8ed469759474c64ac6fd35b

    SHA1

    ff52fa0039c835bf78356dc87ba1390e7e4dafe5

    SHA256

    d7a15f7a7c8e48876aebf99056d212e57c7c1c250be7f61a96e44b0161f27da2

    SHA512

    a528b1d17d1dfe54d46decd7b553f090d1372a30528aa88ce74eb6b4ede20a9f0f247cd1785c956d33dd0c4b7d776b6fc1e052ba3da99db1548ba7f4ba4ade8e

    Download Submit

  • C:\PROGRA~2\Baidu\{5CA09~1\conf.xml
    Filesize

    333B

    MD5

    7586734b2ff8a3dfe8968bfd70be9d0b

    SHA1

    91bdad6fcc4e6a2a0efb8886d53481a1f6508b63

    SHA256

    6ee461fe144e794a4ed8de17f2f85dc3d4a51cfe7e6b3619c294ddb256c7eb8d

    SHA512

    76ebef92b0e20a2183bd723b49b25f5a011c5ce0371d9e8eb161fea8ef8f1414fab4c0eabc598d4b1ad48f98519dfaf6a1590a4a90cc1da8c47c8e2b0bed71e9

    Download Submit

  • C:\Program Files (x86)\Baidu\Toolbar\BarBroker.exe
    Filesize

    232KB

    MD5

    6b224c78c4b3433e754676dfab012142

    SHA1

    0ef3ad9248de0f4cef24ff110c87157c8433cc83

    SHA256

    567ea2b8aee289f74b5affd5ff6e22ca0fd68d03071670ae060359fc5dae2e88

    SHA512

    9561fa4efe992781a5692c7da7eb9b765668b7592f41417c3de9e1841f8e85f6dfc3fcd0233842489da54157c81c31211123bda45798539efa696f8cae6149d7

    Download Submit

  • \Program Files (x86)\Baidu\AddressBar.dll
    Filesize

    1.1MB

    MD5

    1650515a849b044871bd0703ebc87ff1

    SHA1

    fa99046655efcf31bc8df831bfef9ee0c94b070a

    SHA256

    d0b8a57c604cd89a37fbe6e56412ed9a4bdf04b61d16300f4409167a76206b85

    SHA512

    3593716fd0c4a56ac0e7ef92803b3553ad94c2abd7d547939004af804f00b60a7bec890aaa51810f6fc42c2b182daf20109a4548c66231d87307321d12a9951c

    Download Submit

  • \Program Files (x86)\Baidu\Toolbar\BaiduBarX_Tmp\BaiduBarX.dll
    Filesize

    2.7MB

    MD5

    9929bf8efb3087a1a832fc09ac97bef4

    SHA1

    4df24505648dec56488d68cd1ce5265c4c31e5bb

    SHA256

    2867243b3b6584986098d5e5f921f2dff5dfe5fe605725b263371bc8ff3fa279

    SHA512

    a172e659ac803bf8ed260af80caf6e94ab076e6759a8f77e30e0cf8dd99fb0db690db7b0656bfeb3bae324082665d6ca219d775591df988f90be0d5633054cdb

    Download Submit

  • \Program Files (x86)\Baidu\Toolbar\rc.dll
    Filesize

    496KB

    MD5

    51e4f617d2ad241171f437001565ac71

    SHA1

    1af01b7428e3493825451980e25306941ca50e31

    SHA256

    ca30dd00c9586efc075376c4b53fdcc2dcee6c1ad3ee83eb8f801e95d1dd250a

    SHA512

    93044c79020a710dc85a848fef030084b41e12334492e7a11973107c7d79e352c1ea7b9f8fc0f116d5fce341cb6d3317acd4fa8fb5396765cc3724773f571e6f

    Download Submit

  • memory/2448-23-0x0000000003990000-0x0000000003C45000-memory.dmp

    Filesize

    2.7MB

    Download

  • memory/2448-36-0x0000000003D50000-0x0000000003DCC000-memory.dmp

    Filesize

    496KB

    Download

  • memory/2448-80-0x0000000004550000-0x0000000004676000-memory.dmp

    Filesize

    1.1MB

    Download