Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/01/2024, 09:33
Static task
static1
Behavioral task
behavioral1
Sample
HA_BatchPictureResizer-v1.7/setup.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
HA_BatchPictureResizer-v1.7/setup.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
HA_BatchPictureResizer-v1.7/新云软件.url
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
HA_BatchPictureResizer-v1.7/新云软件.url
Resource
win10v2004-20231215-en
General
-
Target
HA_BatchPictureResizer-v1.7/setup.exe
-
Size
2.3MB
-
MD5
da9c67250c87934f1d6e916dbdd62329
-
SHA1
b99e25a9b6233f3ae683edee55902dca18dcf1a6
-
SHA256
e5f4ec78122534073220b0b6819c1cc2b08f48fdb727dcd657de190868b051a1
-
SHA512
af71aa5be9f6a3e5434da962fe9febfb18b359b6c823605b79c2b325ce740f867ad8cf262fa0f5798c937f719cac98946a67be08eaa85e0a06943f1c13c463bb
-
SSDEEP
49152:a2N/sDdWUe4IJQC7mtCnI9vkqZvaGprmZ33iLS1XBg:7eDvrC7HnKksvaGprmh3oV
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4648 setup.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1372 wrote to memory of 4648 1372 setup.exe 88 PID 1372 wrote to memory of 4648 1372 setup.exe 88 PID 1372 wrote to memory of 4648 1372 setup.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\HA_BatchPictureResizer-v1.7\setup.exe"C:\Users\Admin\AppData\Local\Temp\HA_BatchPictureResizer-v1.7\setup.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\is-NOHOJ.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-NOHOJ.tmp\setup.tmp" /SL5="$70066,2196488,73728,C:\Users\Admin\AppData\Local\Temp\HA_BatchPictureResizer-v1.7\setup.exe"2⤵
- Executes dropped EXE
PID:4648
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
685KB
MD5fe47dfd4f24d4bd585584c5fd5d11138
SHA1f7a7e1e085d5ef6da35a9525b76d2d1a2e1231a5
SHA25662377d5be63922f0f30d670f1bfdbb1db52585267ffdbf259eff628b806b2fb5
SHA512b78cdcfc2479b71d950e94ecf7c090aba5aaf2c8488fb64d8e0c296f47fa77b483b62c18384ecc09a5609476135623c3eed5a510cdda56f5f84b4a61211a0174