Overview
overview
10Static
static
10Battly-Lau...ws.exe
windows7-x64
7Battly-Lau...ws.exe
windows10-2004-x64
7resources/...e.json
windows7-x64
3resources/...e.json
windows10-2004-x64
3resources/...e.json
windows7-x64
3resources/...e.json
windows10-2004-x64
3resources/...Me.txt
windows7-x64
1resources/...Me.txt
windows10-2004-x64
1resources/...e.json
windows7-x64
3resources/...e.json
windows10-2004-x64
3resources/...e.json
windows7-x64
3resources/...e.json
windows10-2004-x64
3resources/...ds.ejs
windows7-x64
3resources/...ds.ejs
windows10-2004-x64
3resources/...ex.css
windows7-x64
3resources/...ex.css
windows10-2004-x64
7resources/...n.icns
windows7-x64
3resources/...n.icns
windows10-2004-x64
3resources/...on.ico
windows7-x64
3resources/...on.ico
windows10-2004-x64
3resources/...on.png
windows7-x64
3resources/...on.png
windows10-2004-x64
3resources/...nd.png
windows7-x64
3resources/...nd.png
windows10-2004-x64
3resources/...ar.png
windows7-x64
3resources/...ar.png
windows10-2004-x64
3resources/...de.png
windows7-x64
3resources/...de.png
windows10-2004-x64
3resources/...en.png
windows7-x64
3resources/...en.png
windows10-2004-x64
3resources/...es.png
windows7-x64
3resources/...es.png
windows10-2004-x64
3Analysis
-
max time kernel
120s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
18-08-2024 22:18
Behavioral task
behavioral1
Sample
Battly-Launcher-Windows.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Battly-Launcher-Windows.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
resources/app/node_modules/color-name/package.json
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
resources/app/node_modules/color-name/package.json
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
resources/app/node_modules/protocol/package.json
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
resources/app/node_modules/protocol/package.json
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
resources/app/node_modules/windows-shortcuts/lib/shortcut/ReadMe.txt
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
resources/app/node_modules/windows-shortcuts/lib/shortcut/ReadMe.txt
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
resources/app/node_modules/windows-shortcuts/package.json
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
resources/app/node_modules/windows-shortcuts/package.json
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
resources/app/package.json
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
resources/app/package.json
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
resources/app/src/ads.ejs
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
resources/app/src/ads.ejs
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
resources/app/src/assets/css/index.css
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
resources/app/src/assets/css/index.css
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
resources/app/src/assets/icon.icns
Resource
win7-20240729-en
Behavioral task
behavioral18
Sample
resources/app/src/assets/icon.icns
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
resources/app/src/assets/icon.ico
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
resources/app/src/assets/icon.ico
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
resources/app/src/assets/icon.png
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
resources/app/src/assets/icon.png
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
resources/app/src/assets/images/background.png
Resource
win7-20240729-en
Behavioral task
behavioral24
Sample
resources/app/src/assets/images/background.png
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
resources/app/src/assets/images/flags/ar.png
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
resources/app/src/assets/images/flags/ar.png
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
resources/app/src/assets/images/flags/de.png
Resource
win7-20240705-en
Behavioral task
behavioral28
Sample
resources/app/src/assets/images/flags/de.png
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
resources/app/src/assets/images/flags/en.png
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
resources/app/src/assets/images/flags/en.png
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
resources/app/src/assets/images/flags/es.png
Resource
win7-20240704-en
Behavioral task
behavioral32
Sample
resources/app/src/assets/images/flags/es.png
Resource
win10v2004-20240802-en
General
-
Target
resources/app/src/assets/icon.icns
-
Size
52KB
-
MD5
a9ac947c7d14b1827647cd7232df4994
-
SHA1
4d914955e8d9dcc566e56d912dc4227e5048bf4e
-
SHA256
3163ed50c1b8301bb87cbbe983d87e072aaf1fa4b9c2e5917a9df858033059a9
-
SHA512
49c664e58050a47efce4da174658bfa94efb434d93a896edc9658a0b594c818a0a98254c197e241ee9c235d0707baa7efa4f7b3f571f10c48c4bd6c2facd538f
-
SSDEEP
1536:wu8c5oFMRj2A+zRBWQ7bxIqcY0652Ke1YfR93rkQ:wuJoFMFGyQJIqcY0O2KWYv7kQ
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\icns_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\icns_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\icns_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\icns_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\.icns rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\.icns\ = "icns_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\icns_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\icns_auto_file rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2688 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2688 AcroRd32.exe 2688 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1956 wrote to memory of 2820 1956 cmd.exe 31 PID 1956 wrote to memory of 2820 1956 cmd.exe 31 PID 1956 wrote to memory of 2820 1956 cmd.exe 31 PID 2820 wrote to memory of 2688 2820 rundll32.exe 32 PID 2820 wrote to memory of 2688 2820 rundll32.exe 32 PID 2820 wrote to memory of 2688 2820 rundll32.exe 32 PID 2820 wrote to memory of 2688 2820 rundll32.exe 32
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\resources\app\src\assets\icon.icns1⤵
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\resources\app\src\assets\icon.icns2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\resources\app\src\assets\icon.icns"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2688
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD55be0a9038730d6eac4751d592fe14176
SHA1d6128a40966c1fa2079842a46261c6920d2a36b4
SHA256cb5d4126ac52edc8edf7e95299d76e3f4e4547ba78a60b02e9f39f9f26dd7001
SHA5123e0bf654067ba08021784a8297db37d6824c0d252e0c64a4ddc111960b8252573410f0154d68aece15c49c4838185736f320c2d7819f59ab5d9a4e6c857ae038