Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/01/2024, 09:33
Static task
static1
Behavioral task
behavioral1
Sample
HA_BatchPictureResizer-v1.7/setup.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
HA_BatchPictureResizer-v1.7/setup.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
HA_BatchPictureResizer-v1.7/新云软件.url
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
HA_BatchPictureResizer-v1.7/新云软件.url
Resource
win10v2004-20231215-en
General
-
Target
HA_BatchPictureResizer-v1.7/setup.exe
-
Size
2.3MB
-
MD5
da9c67250c87934f1d6e916dbdd62329
-
SHA1
b99e25a9b6233f3ae683edee55902dca18dcf1a6
-
SHA256
e5f4ec78122534073220b0b6819c1cc2b08f48fdb727dcd657de190868b051a1
-
SHA512
af71aa5be9f6a3e5434da962fe9febfb18b359b6c823605b79c2b325ce740f867ad8cf262fa0f5798c937f719cac98946a67be08eaa85e0a06943f1c13c463bb
-
SSDEEP
49152:a2N/sDdWUe4IJQC7mtCnI9vkqZvaGprmZ33iLS1XBg:7eDvrC7HnKksvaGprmh3oV
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2408 setup.tmp -
Loads dropped DLL 3 IoCs
pid Process 2540 setup.exe 2408 setup.tmp 2408 setup.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2408 setup.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2540 wrote to memory of 2408 2540 setup.exe 28 PID 2540 wrote to memory of 2408 2540 setup.exe 28 PID 2540 wrote to memory of 2408 2540 setup.exe 28 PID 2540 wrote to memory of 2408 2540 setup.exe 28 PID 2540 wrote to memory of 2408 2540 setup.exe 28 PID 2540 wrote to memory of 2408 2540 setup.exe 28 PID 2540 wrote to memory of 2408 2540 setup.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\HA_BatchPictureResizer-v1.7\setup.exe"C:\Users\Admin\AppData\Local\Temp\HA_BatchPictureResizer-v1.7\setup.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\is-F4GUB.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-F4GUB.tmp\setup.tmp" /SL5="$5014E,2196488,73728,C:\Users\Admin\AppData\Local\Temp\HA_BatchPictureResizer-v1.7\setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2408
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
685KB
MD5fe47dfd4f24d4bd585584c5fd5d11138
SHA1f7a7e1e085d5ef6da35a9525b76d2d1a2e1231a5
SHA25662377d5be63922f0f30d670f1bfdbb1db52585267ffdbf259eff628b806b2fb5
SHA512b78cdcfc2479b71d950e94ecf7c090aba5aaf2c8488fb64d8e0c296f47fa77b483b62c18384ecc09a5609476135623c3eed5a510cdda56f5f84b4a61211a0174
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3