Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
01/02/2024, 15:56
General
-
Target
Battly-Launcher-win-installer.exe
-
Size
87.5MB
-
MD5
a58cebad2cd516aa270e545101989bb6
-
SHA1
75384f9073c9df2dcc0d148c26e5ab1fd3e6ebc6
-
SHA256
8eec3876044cf62a32504157496c36ec67cbd13cf96561b5a56b4b3bd2605841
-
SHA512
fa49deb0827ae16f34aa8ed5f92c7d8f2f674a13b4164c417d7bc44f16d1863a36d060aeffec4dae7fd3bcc0c03200401d18fae0dfec4a6d90d9ba739fb0207b
-
SSDEEP
1572864:ndc4v6Skl5L+Pe16OIb08t7oQwrCzDrelX+hefmUYL+RcN6kaWEgP:dc48l5yW16OIbhahrCbelOh+YLB6kg
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 8 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 15 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Battly-Launcher-win-installer.exe"C:\Users\Admin\AppData\Local\Temp\Battly-Launcher-win-installer.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-HKD7E.tmp\Battly-Launcher-win-installer.tmp"C:\Users\Admin\AppData\Local\Temp\is-HKD7E.tmp\Battly-Launcher-win-installer.tmp" /SL5="$70126,90701607,832512,C:\Users\Admin\AppData\Local\Temp\Battly-Launcher-win-installer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Battly Launcher\Battly Launcher.exe"C:\Program Files (x86)\Battly Launcher\Battly Launcher.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Program Files (x86)\Battly Launcher\Battly Launcher.exe"C:\Program Files (x86)\Battly Launcher\Battly Launcher.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41.0MB
MD5848a593d9d14a3abd8a2d4b683eb8a8d
SHA1cb259728a1e063b26b1307e13c27a6c70ebc1ed8
SHA256396913d906870cd52f6fded5a7d6e61d8f3e0527a1b9655b8d42cbf7fe54b9f1
SHA51222546efd853954a78fa90a3ba978152d9428b52d6cd6a94574efff6dbf6b655386039ddfa406cce60c6694002e30e13e90251fe34febc6d0dfd28a9b2105bacc
-
Filesize
7.9MB
MD5bfb3e69450627c7ea85fe3656a5d6e02
SHA14d13a78a9c4316ee644c737d4ffd2c395bf00733
SHA256fc9ac3216785220a6e8e006e60319dda77014bbaf8921347ad8360bc5bdc92ee
SHA512a8eeb0e9b61a208c105bd2729ce4d4d1bb92e00ba0d4aec56c1dbce94a8c1b85eadf9b52b1869384fcd9771e5ffb12990ddf2fc5510506a1028a1c36d610517c
-
Filesize
3.3MB
MD57a260eb38e40ce04cea65d375e09395d
SHA133f150da6e669bb2624c94f82fd4078754f23894
SHA256545bbfadcf4442b8c9c3d0fc54da6013d993fb9abf5aeed71b717dfc079fe338
SHA5123d3a09ce7080cef8ab16fc73be22d77cb76f3087edcbe8eac522eb943e4a01f9432cbd889b2a30d0cbce4f6aa79aa5974e2fcb23a946a76db20cf22e7bab9326
-
Filesize
1KB
MD5532013e80f57c86a3d7176374afe6380
SHA1e40a5d2090efd5d2eae97987590d414d7b1389f8
SHA256a67b34a24a5daddcce46aea68c5004e4442bbfb63690329fa607bf4de4269794
SHA512db98bcc743122ae1ced03c2d7e4efc4cd090d61b75a2eeee0534cff58ef6ec9a313ad826d4bcf490378a8b13c8a360f20a026df83700c0244113988d7e35b7f5
-
Filesize
1KB
MD5bc3c23d98d7aa86bbf232058884e19b2
SHA1772b18147b3bf826978f984f8e01562a9e3cc254
SHA2565626c1e21f73f049d1c26ab8d34c95f26ee33d9b2dafb49af21114b087fb8d04
SHA512f92b92b1623f00ef51882f3c8d17e0d010bc5261bf0eb8e9b8b4b6cd7d9f49708e43114ff893f2788edfed945a5c02f7d13c1bb58ab3f426aa8021df362dd2dc
-
Filesize
765B
MD582703a69f6d7411dde679954c2fd9dca
SHA1bb408e929caeb1731945b2ba54bc337edb87cc66
SHA2564ec3d4c66cd87f5c8d8ad911b10f99bf27cb00cdfcff82621956e379186b016b
SHA5123fa748e59fb3af0c5293530844faa9606d9271836489d2c8013417779d10cc180187f5e670477f9ec77d341e0ef64eab7dcfb876c6390f027bc6f869a12d0f46
-
Filesize
8KB
MD5f3f8ead5440d1c311b45be065d135d90
SHA105979f0750cf5c2a17bd3aa12450849c151d8b7c
SHA256d446a8c73d7bbe4872d6524b15ae206f9a2d7eb53f8c9cb6e6c893a43acc5276
SHA512d52ead0329e9223dce3d54f83c9e8caab7974355c248e2e85a1a8aa3198af402507761c22bad31307ae3bda06528ed0b3487e9ac9f6a6c3c413e09a5acac915d
-
Filesize
77KB
MD580c6c0afb34d50084bef13963e6c212b
SHA15cdeff53cf6aa0611c4923acaae49a8dd5e457ed
SHA256bf0a1363ceb5fe2291336cbb315cf8629c6940f14ebfb5384faab553d4a611d8
SHA512febf5f748f9dd4347dd801e7fc26da2ba5b02c02515bcee8b35c3c484e5ea2bb1826f9d2ce87a6535aed1795bde8d84fe67185e57e11fc5a59f22a2165e8a73f
-
Filesize
1KB
MD538ecf0a3a3894f404ca99c2a08924afc
SHA110b8ac49ffb8f7cc8bdca9303209a1b3b2f3587d
SHA25682f8e8150cc12bb0895291c63ffa618d5652daf6265f63203ce0043955066ba4
SHA512f0c68e411d3b7759b30fa74ea37663f4ea4968fdb8ebd4016c9ecbc5bcf7d956941d0c1f81e66abb73676d40379240d828b0a6ac36c3ade7ba11b62b5ed14c62
-
Filesize
57.9MB
MD5fbc6c2acee468c8fc3661a062d312474
SHA1f1661cfea718fd9cb17ffb9326bcbcceb55120b5
SHA256ea537e65339bd364fe3844834eb594c7e89a7048bf2dba52adc2e5346b565530
SHA512c73da77cc419831793f727d05e36bddc9142cec414b4de599c764630eeee8d0695a7ff38e55a9fa4a10818df1846034a361155bf72e57a01bc496354f908ab0d
-
Filesize
4.2MB
MD5c0b62ffe3a0d030936d4b9ebbef54bdf
SHA1c836d14fbe5ede18fde97e13cffc17b44e2c8c02
SHA256bbd7875bf4214f50ca68bb1fc4a6f883160da13a812219d41b47dbd73887d34f
SHA5126dadbd0e11ee0b441264e270bc002dc29b8bc603c49cec25a9ffbeeb1067ecfdc34b7e2afa4f0c2819e9a7705c3e7de57a20e0d4f9f307eb14b770c0f4c2b0fc
-
Filesize
4.0MB
MD518b4148cd530a6803c33da79143952c6
SHA15f630cf779929725d97f4854b3980814f1f42224
SHA256151f325c0a0425263f1fed2ff6fa62297cd2bc9786e5e6ab44adced50bf4f98b
SHA51247caaf4b35c31b0107e8dad65852d551e3db74d848707eec3c24307ee89bccf326ae46c0309612bbed68af3b96d13b75fc875246fa747b45e65f5f7fb4c250fd
-
Filesize
6.3MB
MD58b45e0e18bfdd1f59e2665e285674ab9
SHA177bba14fe54bbd5e445f67e578fc9888dcf3d6d8
SHA256ca52d98f2f65c6f19ada34ec3230030d61e80ced0cba85dc3e560120b0c77f36
SHA5126ecb7eab3969848e1e5f67837ec5a26b7f01713bf13a74e8b085572825c719b1cef591336aafdf76e0ab765409d40491bccff751c920a0f6ba86d9bfcb031e71
-
Filesize
5.0MB
MD5c9cc9e887981ee1973b776842c0e0cf5
SHA1370114f0de003aa1f0e84ae94c84b272ff3e923a
SHA256d391ef50016327f4d17c92cf598d50506d6a190f7bc0985d9a1d6b37b6131fa9
SHA5129750a42fa296309572cebc902b7d7c7cb10681b3c68f1e639c51185fb4561ace6220bae1eb1ab0eea44024a6955c3d65107a04f8eb5ded243849ba8e4fa514f9
-
Filesize
2.7MB
MD5ebc33ac8fed56425d44eb3505170f331
SHA13f1e3cff6bd025374ca944903e149bd4b3f88fd5
SHA256a510ea0deb0c625675d16a07bb7a0542bdd01b42e69ddfb894051bcd9ef23417
SHA5124ae16f840c31cbff06c80b5370456de98fdbddd05c49ea82f9299a6ab4ef5964a283d4fb119a424783d836a5488440e5f2baf876c755a4f19eb40861a70775d8
-
Filesize
2.5MB
MD5c8b45dca750a48fd25452d5fb31cce60
SHA1767dc50117a153fbebc72950b9651590eca704c0
SHA256074ed168682d95659a4d7297d8c6cdc542bd2d5ee79e8572b954367593b1958b
SHA512eddfb16f8dd0d883a0d716a1a9b20b850623ef7847b7d2d44755fcb4e854ecd0ac9dbb4c5f31b2af418012750247e62317a3ea629a1e318f3040f0b181b03d1b
-
Filesize
3.1MB
MD5d7967ad8ffbc60b7255b62dbf6a733cc
SHA10a293aa4a177a93879eb40aba7930c1d7be0c0ff
SHA256145f163d01ffbff37ea6cd7acc5f3384cd3e385a41ed707c3c2c67600b0e2da9
SHA512e7efecd12b28881bd510897b026b00df759bb9e97896d6904504eeefd18750f96571f62b1e8dc2d19de43dd1d7a333c685d9396b3e5889199a73094e93ec5d69
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
4KB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
4KB