Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
306s -
max time network
336s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-ja -
resource tags
arch:x64arch:x86image:win10v2004-20231215-jalocale:ja-jpos:windows10-2004-x64systemwindows -
submitted
12/02/2024, 06:27
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20231220-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20231215-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation batexe.exe Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation b2e.exe -
Executes dropped EXE 2 IoCs
pid Process 5744 b2e.exe 5220 cpuminer-sse2.exe -
Loads dropped DLL 6 IoCs
pid Process 5220 cpuminer-sse2.exe 5220 cpuminer-sse2.exe 5220 cpuminer-sse2.exe 5220 cpuminer-sse2.exe 5220 cpuminer-sse2.exe 5220 cpuminer-sse2.exe -
resource yara_rule behavioral2/memory/4892-0-0x0000000000400000-0x000000000393A000-memory.dmp upx behavioral2/memory/4892-2-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4892 wrote to memory of 5744 4892 batexe.exe 87 PID 4892 wrote to memory of 5744 4892 batexe.exe 87 PID 4892 wrote to memory of 5744 4892 batexe.exe 87 PID 5744 wrote to memory of 2100 5744 b2e.exe 88 PID 5744 wrote to memory of 2100 5744 b2e.exe 88 PID 5744 wrote to memory of 2100 5744 b2e.exe 88 PID 2100 wrote to memory of 5220 2100 cmd.exe 91 PID 2100 wrote to memory of 5220 2100 cmd.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\E838.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\E838.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\E838.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5191.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5220
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
1.5MB
MD5399e1aacae874190bd8e2ad6bfa77b5e
SHA123a83afd2e7cd764fe425c33c374737013636aba
SHA2565e589125ec835723f23e0fbcf21b4e18df05ec8d4069b2b38a784a6d02727f33
SHA512cc08a92083eb2617eb602d738734bbb859de964b2c27fdb5aa8a8952079294fe6d14dadac3f902f26ccfb839425d3e8ef826a1ab3a7f2ba1d7687535ac949dfb
-
Filesize
1.3MB
MD532268e166d96accfa590eff10dd29cd3
SHA10a16d8586fa5d24b59e8316000f9e855cf3220bc
SHA25689801d7a0bae323469effabdd6680f856d3e0fb3371efa51c5ea601e89b6479a
SHA5129bd2103b3023d671aadc7f83490c24e747c70d7be75ce2b8a1041de5410229571e5f6779be255d5ca7c82d639d09d48f4194e63dd4bfaa03f5400f2924d9f914
-
Filesize
3.7MB
MD5f53d14a21fac7b7492462a6edb2bb121
SHA1fcd82097668b397d1df76126a6328e23f4dfceaf
SHA256032c55051093ff20a6c5a6fc90fa9eb0e5d2342f702c0105ea98de8af53d6ce3
SHA51282a31012a42c335d38b23f900b44856fa4da305410490995e881339ad221ea3fb732d083ce4867db71a02c4d69d7c7a97273f8bf4e4012dc6e1a0fbe05447731
-
Filesize
820KB
MD5c2bbafcdb93a476a9e258843c4affb3e
SHA16fec1b0b520063c2368813cf62b06128130dffd6
SHA256af71dd763fade0666ec2e6face237da19a86455e67bb4739f031ff2aa28f7076
SHA512b07af60d580b8b87ead59121180105a2c0c1ed20f3d03e64a6f0f04cb76ecd707a68a574a99a476b6ffa7b64180057aff8b8148aadec20ae3f3624dacc4be55f
-
Filesize
743KB
MD53474cc584d07991e859a73b76b4cf779
SHA15f609d264b94a40e9f6fc51c916b8d0ef5d892f3
SHA2565d0ebf353973575cf42b8d3cd83bf6e819002ece0514698c109cb6da550bd41c
SHA512dbcfd107adf1122da6512fedd2c560ae194889f06149a2706c03b2938109e09fce59b9eac31d390a5e2b9ec5da1b5b58e1abc93bfdc1c245966780e41d50b061
-
Filesize
836KB
MD5aeab40ed9a8e627ea7cefc1f5cf9bf7a
SHA15e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8
SHA256218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9
SHA512c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8
-
Filesize
692KB
MD57ec0f9f6ef96896ea25da9f5eeea72a0
SHA1ad171ea679162891afda51b58a234f080428cae4
SHA25613263a1775f64fe5450fd399d64503c41470150ab30cc9cd4169124633bbcf79
SHA51299e8f743410edfada872f6202492b736371cb77d4ba112386f4068595429c9321d9d7d552b2b2edebcbab368a7e8de44c2bed5ab16213c4adccac5b5fe5346b2
-
Filesize
100KB
MD558ed5245e64adc70fc2441fa457e6379
SHA176935676ad93dbf6e69496408bf4fd6eb3e0c1f5
SHA256030da3b8ee6a11975841363c4272de2ac5976a060a1b29e902ad65cdc4490eea
SHA5129d553f9dc0eda0598bcdb2147b592a00ff901113cd2e5571d32f2b0e21f3b2e15995f0c06d1e91bbd8d4b6def73551af92b764d625d3d7d921de9805b015958f
-
Filesize
985KB
MD5dc99c1d0162d06fdd38a0e37e4c9e047
SHA15e2007646224216907662c040ecf71b42af7a374
SHA2568d96eb0fef532a4f1a79ded24940f356e1009aceb4cba1c201e39e71ae518c9e
SHA51209c21c586b5109b522b807afc8f95c683175b7b01f330a54ec33f6a9cd3142ad5feed744dd88e563e724f97ebca504635d7174c6c0d5e9ec094bfc75ab4e3d78
-
Filesize
218KB
MD55aa236c57902650ac7b246dd30246c60
SHA1143872ece1e5a6fab1c0bd4e154291c660f8662e
SHA2560c27d3d1bbaa16f93fd60fb683bbaac62ac05f9e68a2902aae2fe3563e473b8d
SHA512831fc8fff6094e3bee4ba84e3c8482d0b6eb3745e0e84f19c4ee2bcc11ea7ceb2803cca9d49571af242f39b212365b983d8aaf1ce258babb7e79ae03fd0916f1
-
Filesize
191KB
MD59551544f83c245ec88742980b257e38a
SHA101f5df1ad71ae6fa9b40a2971cf4ff911ad0c81e
SHA256aa397c69e6bec882d2ad3d7e0a0466d17cbc976cacc29b2a19e08fb2a5a93d49
SHA512848d9db9df3361cfe61e8daeece5af79091a611b04f0c073eda1a2d61797af4034f7b96b99b1e551521207ea3f41ebd77381247a49df17744ebd3fdf8759a27c
-
Filesize
1.3MB
MD5172a8fb026b1cbeb3df0e8aff6370281
SHA1512ac4054b07cbf606cb1bd9ccc303b8c6528837
SHA2563f60f6892799b8dfc7d4385c0179ae4f417080a9511a38dbb2b96824434e0f35
SHA512affa811ad9698a31d99b66f1ec5f4724572a54479e16ef57ee98ce5dfd96978fa0c9b8538f71b61f0747ff5c834836dda0de3cad77f70f9f616e39fbb9825747
-
Filesize
548KB
MD5ce067c679949e0a71d1429d82c91ca63
SHA1e182331d4ca4c38d1efe412b124e216b5663b196
SHA256e7dd5c229cb85095a77cce5a7d711c1872351bfb2946fe468898948ad55cd172
SHA5129f7176d5e8c0197daca48ca7ae628ffcf70aa319d5aae3ccb6fe67f47ffcdb6873ef9ca5faeb7ae17a97d033abe9d49a23f52aba57939399528d8c4b3078bc6e
-
Filesize
606KB
MD5585efec1bc1d4d916a4402c9875dff75
SHA1d209613666ccac9d0ddab29a3bc59aa00a0968fa
SHA2562f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232
SHA512b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770