Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/09/2024, 05:49
Static task
static1
Behavioral task
behavioral1
Sample
HB_BatteryMon_2.0.1007_Georgewing.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
HB_BatteryMon_2.0.1007_Georgewing.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
batmon.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
batmon.exe
Resource
win10v2004-20240802-en
General
-
Target
HB_BatteryMon_2.0.1007_Georgewing.exe
-
Size
683KB
-
MD5
2b39a73727c81bd823e9dba55af3edf7
-
SHA1
5b767a40f66ae6825e20757d7da293bf083fc664
-
SHA256
d8afdee398465be5f83ca6614508a4c211f751806162f7726255b92df58eaaaa
-
SHA512
8c20aaa2d98b73d5f9abbd6105ed827387fec3d53f998ad5416a388e9d8106e7ef3cfe33e7c86fb05fbc349643dcd0dba5d04862bdd2cef2fc5e4375381ea275
-
SSDEEP
12288:7mz39dIPn12cj1FKQy/VxX1oZas65y6zC8e7uXNmhp15eRtgIMV:7I39di1ZFKx+4s6M6zm6XNA15UrMV
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2824 is-CN6EV.tmp -
Loads dropped DLL 4 IoCs
pid Process 1656 HB_BatteryMon_2.0.1007_Georgewing.exe 2824 is-CN6EV.tmp 2824 is-CN6EV.tmp 2824 is-CN6EV.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HB_BatteryMon_2.0.1007_Georgewing.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language is-CN6EV.tmp -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2824 is-CN6EV.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1656 wrote to memory of 2824 1656 HB_BatteryMon_2.0.1007_Georgewing.exe 29 PID 1656 wrote to memory of 2824 1656 HB_BatteryMon_2.0.1007_Georgewing.exe 29 PID 1656 wrote to memory of 2824 1656 HB_BatteryMon_2.0.1007_Georgewing.exe 29 PID 1656 wrote to memory of 2824 1656 HB_BatteryMon_2.0.1007_Georgewing.exe 29 PID 1656 wrote to memory of 2824 1656 HB_BatteryMon_2.0.1007_Georgewing.exe 29 PID 1656 wrote to memory of 2824 1656 HB_BatteryMon_2.0.1007_Georgewing.exe 29 PID 1656 wrote to memory of 2824 1656 HB_BatteryMon_2.0.1007_Georgewing.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\HB_BatteryMon_2.0.1007_Georgewing.exe"C:\Users\Admin\AppData\Local\Temp\HB_BatteryMon_2.0.1007_Georgewing.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\is-G7HGJ.tmp\is-CN6EV.tmp"C:\Users\Admin\AppData\Local\Temp\is-G7HGJ.tmp\is-CN6EV.tmp" /SL4 $130150 "C:\Users\Admin\AppData\Local\Temp\HB_BatteryMon_2.0.1007_Georgewing.exe" 448992 522242⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:2824
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
635KB
MD55ba571eb89bacef396539841970711b0
SHA1f51e65174a43784710cc2b03a5129f21f3578644
SHA256440f88196d6586d81917097b39bfb98bf338afc24116434de0c25c356e2d7452
SHA512ee46d826d1da230f75ec2e2d96ad1aa918a7f71f530422ee58cc4c50272fce08950eceadd52b103937b36039af44ce1cadeb9d6a1c8eeecdf6e8d07274471a54
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
14KB
MD5acbc8e35f20101aa40b818a76bc2b321
SHA16b0238710f6d13f94f23ef33cf6a8c88071ce5f4
SHA256c52eef06d25acaaee5e366269948dc6925b7d73de48f0913f7e83818326f59f8
SHA512bae029e06b2925a427c7b5b10f677ee37bc27d3b4d3afc58203a70d1ba90654c164ab413354d49b15ee01aa97051eac77722c2fa2b17b7cc9b0b20d060d2c1b7