Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
299s -
max time network
307s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-ja -
resource tags
arch:x64arch:x86image:win10v2004-20231215-jalocale:ja-jpos:windows10-2004-x64systemwindows -
submitted
11/02/2024, 18:50
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20231215-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20231215-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation batexe.exe Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation b2e.exe -
Executes dropped EXE 2 IoCs
pid Process 3324 b2e.exe 400 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 400 cpuminer-sse2.exe 400 cpuminer-sse2.exe 400 cpuminer-sse2.exe 400 cpuminer-sse2.exe 400 cpuminer-sse2.exe -
resource yara_rule behavioral2/memory/1168-9-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1168 wrote to memory of 3324 1168 batexe.exe 84 PID 1168 wrote to memory of 3324 1168 batexe.exe 84 PID 1168 wrote to memory of 3324 1168 batexe.exe 84 PID 3324 wrote to memory of 2964 3324 b2e.exe 85 PID 3324 wrote to memory of 2964 3324 b2e.exe 85 PID 3324 wrote to memory of 2964 3324 b2e.exe 85 PID 2964 wrote to memory of 400 2964 cmd.exe 88 PID 2964 wrote to memory of 400 2964 cmd.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\67DD.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\67DD.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\67DD.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\77CB.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:400
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
641KB
MD54015f4adb8a5e54e38f9d4d40e91c1f0
SHA1b08352c0f7dcfa9c27a5854d84f2ffdcfdf4ec1c
SHA2567bc03da8754ad76c517432cc2d0cda8fc508a37c071dedde141eef00fc8a2e36
SHA512fceb00b2318a9d373438ae11f31a112e91075601dc5a4d88ce3ef36d97c73126ae88b50e7a1353029b09154e1f8453010c00b0ca2600cbf9182f1bbf0a8f20ac
-
Filesize
2.1MB
MD56aae2084aa3f68c3e8f5808eafb8eb8e
SHA17a9452738f677a2c5bcaaac68c1de4721684e627
SHA2563be559306e5cb87d0d1cf71618ac530ffe12e220c021ff77a5ef224f0acd7656
SHA5129a5ddf7e8727c7375faaf71571f38330436f280016a4c2bfd02df65b71056183aa3732e059dd154bd7f30cf2ddea0378b41ac16142b937ea0e3dd7401d9f43c4
-
Filesize
1.9MB
MD53f313d66555efde5519ce9bf365d546b
SHA17612c86c2cbadb33cc4dd0ad56f04eeaf3a455db
SHA256e27f2d52becfb61e75b0540f1457b7e3f5ffec2d34e272e7fa2297aa9a95bb77
SHA512f4f9f7a3f35584b4d64395bf7c83951bdf7dd816c24fda651bcaf2cce043d7e15ec0d1bda00afe7333d41db20965a8e29a8c6d852b51140c3c017b2af20ab2af
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
877KB
MD583600dccfbd9810cc798df1fc5a63276
SHA189bb59e3529b14068d3d9b4c1547f8f76ee08628
SHA256c8b1e9219b08ce151ebb58e3bd79754f8b1ccab99fc54f98b5b6da55230dde68
SHA51210b29de0f42d0f55b0de4f847dec3f0d9413bd439d8f5187089fb6eed1b1f71115b52f8287601ae0fcff983daae79c770d9e24321fcef8e73f2c45d4ca70ca8b
-
Filesize
556KB
MD5e1f21b726f44b17a6ba0f64cd1be7644
SHA15c83d9562599bc7466ec8fdee88e417f0cca1307
SHA256ac4bc9e626228206854e91d8bff05a36589c59e5a6a51d510fc3751721a3db8b
SHA512e900a4cc0953ba20f8144d3a1251c91c0ad9278593d86a7e8215018095f6e8308f39215ae681e8cd9e2a951c2f4f79f8b4cc4d7407b5506884c6b1cd5ffd654e
-
Filesize
613KB
MD565b6a4c06d19ab4a829522d1dca0e362
SHA16104777ef1e5169ae1f042e063082921c3f8af01
SHA256746a79aed5bdce973fb101808a86959fa65d7f1064fca62c4b0440f71883b2e2
SHA5125d0a71a5c6a8de4e1c4cd970426626cc6aac8a6696e181bc34bdb16077c3ff61ac81a7e2faf4ee396254afedf6b8dc016774703012a1e0a75b5755f432e6cd95
-
Filesize
768KB
MD5e3f15c79f945604229fa814f57c79274
SHA119a7015dfbe622ab86c48693ee1605b26112a3fa
SHA2567b09ee53447ccf77a0f2d7bfe25908f963d681433d3cba5a16c7f45646c42175
SHA51212dc1df8a947caee13a12eca5a976feffd7408402b0495e4971d4bd7181e8d353ebc17da044d2ce6d1c273bb05a0ca5ddf7492394b355786d8b14b0997de162c
-
Filesize
813KB
MD5327965389a54b808be392a8419e9c276
SHA11172c61c2c40402a0a9b019dd1888f06d0488f2e
SHA25626d9da6448cb568cc1b45aeb9c59ddf56ec21aea03550859d6d7a0591ea4f533
SHA512b22a179b9487d962f876cc9465bfddb41154d86bbe432ce31a38352ac15a266f0034e0e9b38460e264185f7fc72d279e61b8418c8b2bd594e42d3730a9278c51
-
Filesize
558KB
MD5732bdaf0c2002bf26292116921e2db5a
SHA165d0391a95465d2ca6fac11032aaf800c16849e7
SHA2569b3adeae5fc2f144e3f5bb9939ff8c31291c0ce756cdde4a80d0294e8792c788
SHA512a7fa8f0face9b824f9b02be344e6101faab74e90e0f23e3ab943a5fe773b2dd51a6fc518bf831522c2ec038c73b8a481c786fe41e2e3796eada53a3d5d559076
-
Filesize
636KB
MD52a149d0ef4e1fdbdf2b3a6b5a9c937ba
SHA146398180205674822161d46f0f4d1ace12d7db20
SHA2562fbcf8a4e7880882b9286b1b96f5c36cd494881730b3d226c0df2a9435c147b4
SHA512401da6255751e060dc746ec5bc9278b7dcc59f1fafb0d2f43a5b33866cad5b6bbabfd083868eeb15509935031b4c0eecf47898e3576820d1d4e9160863c52884
-
Filesize
656KB
MD5cd2526b1b43b5b649fce8634046cf9cc
SHA12d6661c511fc22e1cb3f408b9249b702c60e9acb
SHA256d503438a3ca79337441e3f8229401bac3bb1e975a6cb93e37a4a857b35edf72c
SHA5126896465eab52f475a29e911e76c8c2cdfdd8bd23c9440729f629042e1eca051ee9b396918fb2158e3f969f2ac303206f9088bd05bb322a69364b6e45db787e6f
-
Filesize
540KB
MD55bcf3fd85ba10099ce430ae845b65c4b
SHA1c9be7936e40d002977c27271f94f9bc6bc8b5d91
SHA25696ff6d611c612b4f0421b1a2cd3268a237cedd79a5e81ca0deaa9efe580f5ec2
SHA5125d8530a4826e373ed7694e4eb0bf6d679f607eca057593e583dbe7a468dea88d123f7fbd9e20bf724a4e8bc316210bb67204327ddeee3ea48dac75a66f3fb213
-
Filesize
606KB
MD5585efec1bc1d4d916a4402c9875dff75
SHA1d209613666ccac9d0ddab29a3bc59aa00a0968fa
SHA2562f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232
SHA512b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770