Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    25/09/2024, 05:49

General

  • Target

    HB_BatteryMon_2.0.1007_Georgewing.exe

  • Size

    683KB

  • MD5

    2b39a73727c81bd823e9dba55af3edf7

  • SHA1

    5b767a40f66ae6825e20757d7da293bf083fc664

  • SHA256

    d8afdee398465be5f83ca6614508a4c211f751806162f7726255b92df58eaaaa

  • SHA512

    8c20aaa2d98b73d5f9abbd6105ed827387fec3d53f998ad5416a388e9d8106e7ef3cfe33e7c86fb05fbc349643dcd0dba5d04862bdd2cef2fc5e4375381ea275

  • SSDEEP

    12288:7mz39dIPn12cj1FKQy/VxX1oZas65y6zC8e7uXNmhp15eRtgIMV:7I39di1ZFKx+4s6M6zm6XNA15UrMV

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\HB_BatteryMon_2.0.1007_Georgewing.exe
    "C:\Users\Admin\AppData\Local\Temp\HB_BatteryMon_2.0.1007_Georgewing.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1656
    • C:\Users\Admin\AppData\Local\Temp\is-G7HGJ.tmp\is-CN6EV.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-G7HGJ.tmp\is-CN6EV.tmp" /SL4 $130150 "C:\Users\Admin\AppData\Local\Temp\HB_BatteryMon_2.0.1007_Georgewing.exe" 448992 52224
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: GetForegroundWindowSpam
      PID:2824

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\is-G7HGJ.tmp\is-CN6EV.tmp

    Filesize

    635KB

    MD5

    5ba571eb89bacef396539841970711b0

    SHA1

    f51e65174a43784710cc2b03a5129f21f3578644

    SHA256

    440f88196d6586d81917097b39bfb98bf338afc24116434de0c25c356e2d7452

    SHA512

    ee46d826d1da230f75ec2e2d96ad1aa918a7f71f530422ee58cc4c50272fce08950eceadd52b103937b36039af44ce1cadeb9d6a1c8eeecdf6e8d07274471a54

  • \Users\Admin\AppData\Local\Temp\is-TS7K3.tmp\_isetup\_shfoldr.dll

    Filesize

    22KB

    MD5

    92dc6ef532fbb4a5c3201469a5b5eb63

    SHA1

    3e89ff837147c16b4e41c30d6c796374e0b8e62c

    SHA256

    9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

    SHA512

    9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

  • \Users\Admin\AppData\Local\Temp\is-TS7K3.tmp\callvpatch.dll

    Filesize

    14KB

    MD5

    acbc8e35f20101aa40b818a76bc2b321

    SHA1

    6b0238710f6d13f94f23ef33cf6a8c88071ce5f4

    SHA256

    c52eef06d25acaaee5e366269948dc6925b7d73de48f0913f7e83818326f59f8

    SHA512

    bae029e06b2925a427c7b5b10f677ee37bc27d3b4d3afc58203a70d1ba90654c164ab413354d49b15ee01aa97051eac77722c2fa2b17b7cc9b0b20d060d2c1b7

  • memory/1656-2-0x0000000000401000-0x000000000040A000-memory.dmp

    Filesize

    36KB

  • memory/1656-0-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/1656-20-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/2824-22-0x00000000002D0000-0x00000000002DA000-memory.dmp

    Filesize

    40KB

  • memory/2824-21-0x0000000000400000-0x00000000004CD000-memory.dmp

    Filesize

    820KB

  • memory/2824-40-0x00000000002D0000-0x00000000002DA000-memory.dmp

    Filesize

    40KB