Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
293s -
max time network
301s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-ja -
resource tags
arch:x64arch:x86image:win10v2004-20231222-jalocale:ja-jpos:windows10-2004-x64systemwindows -
submitted
12/02/2024, 14:56
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20231215-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20231222-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation batexe.exe Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation b2e.exe -
Executes dropped EXE 2 IoCs
pid Process 3208 b2e.exe 724 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 724 cpuminer-sse2.exe 724 cpuminer-sse2.exe 724 cpuminer-sse2.exe 724 cpuminer-sse2.exe 724 cpuminer-sse2.exe -
resource yara_rule behavioral2/memory/1580-8-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1580 wrote to memory of 3208 1580 batexe.exe 84 PID 1580 wrote to memory of 3208 1580 batexe.exe 84 PID 1580 wrote to memory of 3208 1580 batexe.exe 84 PID 3208 wrote to memory of 5288 3208 b2e.exe 85 PID 3208 wrote to memory of 5288 3208 b2e.exe 85 PID 3208 wrote to memory of 5288 3208 b2e.exe 85 PID 5288 wrote to memory of 724 5288 cmd.exe 88 PID 5288 wrote to memory of 724 5288 cmd.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\954B.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\954B.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\954B.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9829.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:5288 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:724
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.8MB
MD57690724ed9db9b6111e647636ff7cf09
SHA1ec5302e56632935d0fec5a9ee8a5c009dd3e0b3b
SHA2566019a2e8b7fc776344678afeff1ae2540b3f17fd041d039457041c980dd9b277
SHA5125c6bc40288f135f46cd5684af0da310df3b06eba8b0179b1d43269482f8f18655871652b1bcae6048b6b60ff799d1037f68862f1b4f1c35e3ea03f3861e66660
-
Filesize
778KB
MD55af7556ed62ad46690d8a428ff6849b7
SHA1e315a22e7f0fa8bab644218de070e98093c9be3e
SHA256b215846f41d2875a31f90e078c8e7c08d06eff457242bc86bd74b77c2aefed01
SHA512340bf3a923c4eeb76a92a6a917e67cc48182f043379e5f18ada3b4eebd6b3155df094263cfd72804319c722d58360908f537f560ce3ec82678c080233ce63695
-
Filesize
619KB
MD5fbd25295eded37194b92ea9848b14a06
SHA1430170cd3cb3669744db9203fba36e39497a7be4
SHA256068d14906523471cf786a772a6cd2fb0f326a763519fce6882d542dc1b008919
SHA512794b370ce2f65fb69ef1d2c8d2ea7350f15175cbf8c45312ccb73dde0b5eb3535861c13a686fb4d3611f8b76399685ecfd9260eb4b6c17d9023b908c05e0e986
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
605KB
MD5bf574956b33b6308af82f82214a21854
SHA11eac39aba988bdf9e5df5f16f4315f114743bdfd
SHA2565ff179b4f9ea106e0f24244a8cb96edcf18333a8731bcfb40edfb117646d3032
SHA512ddcd7f01de7e2abe9457934c4ad708d3cb4b77e92033e25e45569d643809142ed8e23f3912e7b4db255145c1c338bb331e1c8483a2cbee5b00a987dd88669544
-
Filesize
947KB
MD50e5d8f6423ab622c697baa5d150f03cc
SHA19a083f0f050b90fb053327cea360c3df01cbf45e
SHA25680b0c7b38dc4d7b970fa18b1a71110c05f42fe96d509c71e5888877bcea885a2
SHA512890ffaa24d185268a37e8825a7952dbc3f03229ab2e5fa06e1b2f8228343d3c38a5d860b197457c873f2e47935483adc147e4cac5f7254d6beb6712de74e4375
-
Filesize
836KB
MD5aeab40ed9a8e627ea7cefc1f5cf9bf7a
SHA15e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8
SHA256218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9
SHA512c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8
-
Filesize
701KB
MD5445cdf56fab4829143f75195b523d00e
SHA111106492cb26d9a9c2f767bd4be73a212091db32
SHA2560064c7e4d8e85037a1e40ad634317ac416d23e2a9a3fcae6212c3afc87c1a91d
SHA512bf50afef5bcb19f33638a5e6795314fcb9b9d151c58651a1266f524502dd37ab73eea8302c65995a86f5301feed721fb529facbd073febec8d443bb1715c966e
-
Filesize
677KB
MD56978ad66728085ea7c66a9f22fac5995
SHA1e6a15e2546cb45fe92c2e9efd6be01b39b032ded
SHA2564cbc2c8eda001ce477bc52234df6768ffcafbab8a8f0a570857b661d42dff201
SHA512426b38a11241c1a7459711ed588167210f4442d9894ee9d753b7d3d8ef76c0df3e6f95b1b25fe3b209d4d3370f8425fbf7e705628dcb1d0476136fb86b7f092b
-
Filesize
665KB
MD52cc120d2cdc9b257f80b37bd2a3137d1
SHA19fe89e047ec3cc451e250b5960a9741732e7118b
SHA256806d13b83915014237eb57d38bec5ed0938d62afac0a924f73595131aa0b7df2
SHA512286021c707bd319764ef8ca8e1692902f1f4353d71eced67736ad56df67abc9154f9c5147c6be390c77678207651bb9ca06a54ddc338519265c3cb1cee052537
-
Filesize
583KB
MD54e3bcd7aee970244713db02499bb7bc5
SHA188cfa610e99856f03b224e274a0450fd0ed139a9
SHA256e64c4b22dfbd77e6dc9499ce346d71ba7ed1f5f745d9cf9a1d175927ac56971d
SHA51217276b4c63aeb76587f669d843a70043101407d78428aa48af5404c1a138a30ab60e7775aa356082180b8f6c81633011d286accea9941d24860139ff5cefcefa
-
Filesize
558KB
MD5c24bbdd7ff5d2d007bb501570acbc01c
SHA1c663aac0efeebc6632d63e8eed598aaedb3ba10d
SHA256bc1b51508af551225e1c631729868d5be779ea24b7c8e47e2a6ad9560725015e
SHA512a789b428e63341123e8215f554b8a3df731a2faa7d7b43fb5ae9bf8da68c29acaf889bec6889175fa5bbb10f7d3b91a24b17cc6fa201268eee33bc344d250cfd
-
Filesize
681KB
MD552d32883b7c5153ec782b716d8180c9b
SHA191974305cf3fbbdbe307b106d28c09321a331b8e
SHA25633001077babdb67c58ac8e09e6076e4a708c267462decfa5a58ce2580772ef0c
SHA5124e87f70239cb4eb2b3d123ec6850a5da47f9419e9b21e7dde221136fb7fd25eaf73033b02b6e37688c7ad1117ed1a7197dd9c686ee23373ba2d0c9bcb649296a
-
Filesize
571KB
MD5705e59bb63a602e6fe155edf030c11b9
SHA1e0c30a15dab8cb4a7f036396a8be61f23f348ce9
SHA256bb894140068edc5419144443067b99ca60864fcc779a5f35a3592f0f0ec91806
SHA51231c201f94634679646d364a64aba2c8bd119da84a2974d631d510ad5246ca6b5fc381ff4765de6eaa7677815f0e89901e053c1f3e2bda1c2c9e267156fa26b68
-
Filesize
606KB
MD5585efec1bc1d4d916a4402c9875dff75
SHA1d209613666ccac9d0ddab29a3bc59aa00a0968fa
SHA2562f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232
SHA512b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770