Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

BatiHotkey.exe

windows7-x64

3

BatiHotkey.exe

windows10-1703-x64

7

BatiHotkey.exe

windows10-2004-x64

3

BatiHotkey.exe

windows11-21h2-x64

3

Analysis

  • max time kernel
    98s
  • max time network
    100s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    06/08/2024, 17:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    BatiHotkey.exe

  • Size

    711KB

  • MD5

    37535524fdc33dc2c00621fac13cd854

  • SHA1

    b5907488b6e15d7cb846d4daab4385fa217b18a9

  • SHA256

    75702ad722cc4c3443fcef86635b0166708f35f7ee9c37344852e42bd6a53f48

  • SHA512

    409b7a091c52330399270eed76022c585efe10ab42bd96c4fcb0f18d6f4141e0bcacdab5919fc7df92b7324ad162f8f2b173fd3c8324201daaa058a74b48acdd

  • SSDEEP

    12288:YU+9H3900EJqrekLEyTYQcDL/TNuUCziP6VFGO5lrEaKYNtcBvAuvlee2NCFbLkF:YU+9XNrenyktDLdYNtcdvQNC9wHAP5c1

Score
7/10
discovery

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BatiHotkey.exe
    "C:\Users\Admin\AppData\Local\Temp\BatiHotkey.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:4144
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
    1⤵
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:3552
  • C:\Windows\system32\browser_broker.exe
    C:\Windows\system32\browser_broker.exe -Embedding
    1⤵
    • Modifies Internet Explorer settings
    PID:5076
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4988
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:732
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Drops file in Windows directory
    • Modifies registry class
    PID:3472

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\KAD4R23F\favicon[1].ico
    Filesize

    23KB

    MD5

    ec2c34cadd4b5f4594415127380a85e6

    SHA1

    e7e129270da0153510ef04a148d08702b980b679

    SHA256

    128e20b3b15c65dd470cb9d0dc8fe10e2ff9f72fac99ee621b01a391ef6b81c7

    SHA512

    c1997779ff5d0f74a7fbb359606dab83439c143fbdb52025495bdc3a7cb87188085eaf12cc434cbf63b3f8da5417c8a03f2e64f751c0a63508e4412ea4e7425c

    Download Submit

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DFDF81D9200FF9F460.TMP
    Filesize

    16KB

    MD5

    4788db7101000e5ffa2d1374a5008a5e

    SHA1

    567f49a739927e9f2a204b54e8755d13dc90d92e

    SHA256

    74fed3a0c79ac463720c71c7f5ff676cbfdd6a64bb5c758bd19bff716f6df881

    SHA512

    5b81dc1db7884b81077bcc1609a3e1637edaeec70cdae5f99bb2a00dd22405da8bd807e49bf9eccfd38a8aa611350943f2557d5d0f59681ae8c6cd226e103939

    Download Submit

  • memory/732-43-0x000002599B4C0000-0x000002599B5C0000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/732-44-0x000002599B4C0000-0x000002599B5C0000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/732-45-0x000002599B4C0000-0x000002599B5C0000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/3472-71-0x000001B414240000-0x000001B414242000-memory.dmp

    Filesize

    8KB

    Download

  • memory/3472-75-0x000001B414400000-0x000001B414402000-memory.dmp

    Filesize

    8KB

    Download

  • memory/3472-73-0x000001B4143E0000-0x000001B4143E2000-memory.dmp

    Filesize

    8KB

    Download

  • memory/3552-0-0x000002ADD4D20000-0x000002ADD4D30000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3552-128-0x000002ADDB670000-0x000002ADDB671000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3552-127-0x000002ADDB660000-0x000002ADDB661000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3552-35-0x000002ADD3FE0000-0x000002ADD3FE2000-memory.dmp

    Filesize

    8KB

    Download

  • memory/3552-173-0x000002ADD9170000-0x000002ADD9172000-memory.dmp

    Filesize

    8KB

    Download

  • memory/3552-176-0x000002ADD8FF0000-0x000002ADD8FF1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3552-180-0x000002ADD23F0000-0x000002ADD23F1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3552-16-0x000002ADD4E20000-0x000002ADD4E30000-memory.dmp

    Filesize

    64KB

    Download