Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
298s -
max time network
305s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-ja -
resource tags
arch:x64arch:x86image:win10v2004-20231215-jalocale:ja-jpos:windows10-2004-x64systemwindows -
submitted
13/02/2024, 15:56
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20231215-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20231215-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation b2e.exe Key value queried \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation batexe.exe -
Executes dropped EXE 2 IoCs
pid Process 5112 b2e.exe 4804 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 4804 cpuminer-sse2.exe 4804 cpuminer-sse2.exe 4804 cpuminer-sse2.exe 4804 cpuminer-sse2.exe 4804 cpuminer-sse2.exe -
resource yara_rule behavioral2/memory/2292-8-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2292 wrote to memory of 5112 2292 batexe.exe 83 PID 2292 wrote to memory of 5112 2292 batexe.exe 83 PID 2292 wrote to memory of 5112 2292 batexe.exe 83 PID 5112 wrote to memory of 1740 5112 b2e.exe 84 PID 5112 wrote to memory of 1740 5112 b2e.exe 84 PID 5112 wrote to memory of 1740 5112 b2e.exe 84 PID 1740 wrote to memory of 4804 1740 cmd.exe 87 PID 1740 wrote to memory of 4804 1740 cmd.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\C459.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\C459.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\C459.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\D040.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4804
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14.9MB
MD523ae93b737572b7a3f77fa3e1fe6e089
SHA12adfe683db7e24c084fc629593bd90bec1c86b3d
SHA2567bc4e8256bbbb19ade790be9696c0033a040f10410ccbf50106eb485dba9d06c
SHA5121ca03ea738ef15acd2a5047ba91d9c850ffc5a92a9d32e6013045016804f273af8b04c75985716b79db76791620bde657131f6cb351143a77077b9f33e6e3e3c
-
Filesize
2.0MB
MD5fdeff16ca964a2e9a2203979adac8aef
SHA163fd594b64440d14c8bbb531f900073ca93d6f24
SHA256ec3b54b18cd56dc7a31df8ba96620e24f6ba98f305481e310b7f159ce544f7c7
SHA512e892709e7c3ff823345cdbde2b4be9f51b3769456baed5ab824bda5ae849dbcff8c2a5750c7db79baa9636eda2542df5df5421b6e8629c827fa4db1abc188e92
-
Filesize
1.6MB
MD54b3e3a3f84660472fb9714cd8feaba1b
SHA18561afb6ae0a1ab8a4d8364928811b66fcaf9da9
SHA256006513b9e4310066d4cb66a1ea11b6619c10e428f5a1ccc39eab92e1d487f442
SHA512a4ccf4de38da8d27dd065ef09b81a4bca708188c6102211faaa186ddd8f68b87381611da54cb6098758733c799e2a3450cb5cae66b58c29a4264d93f93a1edc2
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
960KB
MD55f088febb9167d9fa27631de416c40d9
SHA10e7cfc61e5cd1bb82c846c939d71388e2f9d5086
SHA256869740b99a3d66f9e9decc133d9c3c4a2c14c3e7c62c512248da76f002387fce
SHA51265e4cd0d550b852f50e426e53ff47bf1419a5cc1aaf07010b10b96f392148525950fd11dd3b1e8acda0916d288414629cde845cdc959ed7092e565ccb8ffa920
-
Filesize
832KB
MD543dd8ab1a0fd7f177db516faa81a9635
SHA166a8b6940797f3396a4f1a6deafca1fda5bffcdd
SHA256d4b58fa7e09511b58f312b57e2067823a7f31ff5cd6369cbf5ef3667c27b60ea
SHA512064753e38fb6e2d64a8ce067a52c24b55eb11cf714a534f3557a0e2bd2f5fba16030d8496c7787f4b272ae6a696f4b017d99771488832d12711a7158c927f772
-
Filesize
704KB
MD5903e2cfee96d720dd5200a922b637d07
SHA1f6d639d7b6bb586abcb5f97b1b212252ed6c85b2
SHA256443ef0fe0e5e9cff04e267b1bbbbc98b547e5bd38a853eb79d06a43a8e7d17f2
SHA512c9c357be28d1d97bd5255d88bc64255f452867407c3aa4c99b286913286780da1204691a0344514f070b8bad391980a88b165eb1e8e9ee97f77ef02eb85071c2
-
Filesize
576KB
MD5bfba8ef054be5bee0da072ed080beac4
SHA1090e6e60a6f0f1e351978e91b99e8dce8e63413f
SHA25681f3865864af4f5ae909e3cb60ec0e0fd028e37909315b0e3de8663a34391be4
SHA51285a8d0b74341c10b3563209566415727a1d1503433908c26c3e861592c397a66afe3cc25bcb31119ec64e15fa078db361bc308474de1ec3f1a8c367d37c622b6
-
Filesize
768KB
MD5fe316f2b417e142dffa0e03efb65e1a4
SHA1907805b2c3bc0a0791086cb5fc8e3a950bc78e6d
SHA256aca06866767d9e0bbe1e9bef7efce1152d34243e1acefc5f7ac4f6a245456671
SHA5128ebfa0700b00c4064d1ded11fc1b4001f01238ee0c4cf88a873e0ccf38c30a574d600649bfdef85f2e3aec5c279a43680f7a66604bc6f27bbda0219e3786774d
-
Filesize
640KB
MD51bff0defeeb9f4bc5cf01e916a8d1379
SHA1bdb668928be0a339e01e3aeeac813fd26b44b950
SHA256d7f49e1dd346940049b753b856759608013f611624432c7ea57b0872239d35c0
SHA512edb3e22bb4d6f3376d73ccd538a61292c5a086fc8ef9b8038b663c93d9ec991bdca297e3c6febb9d18fd16f5304e4fa532d603c68739598f4b65af320ffb3878
-
Filesize
576KB
MD513746f79a51eb8ce3107de99ffc6b56a
SHA164a00c99a805f8775f08cda4e4d06e1150195347
SHA2562c04d5960f13e859d49c78a8858bdcb0c53914306eba52746105a76d98f5d205
SHA512d0e69c6cf0078c858e8258a4038098e644d611b544b6588b2b1c9d2d2937ade0472edc96257545f5935514bfa18970f5762eb393def612c5a7027727397ca8d7
-
Filesize
384KB
MD54cb3a8d3af58faf78da4dd33a03029db
SHA15356e4fb04a7047f6fc82a4e071e4803f97a0f3d
SHA25686df790940bd442466ea58a434a31aaaadd1d23a9e9bf5e6fe625ff49049d620
SHA512244237f4a13a7666e9f9592451dbb8bb18ca1f828d66f97e2890fa8f6be690d8890848102a8be253542c9f4b154d9f0e1aeeee5a867c866b78b64f9949f48c89
-
Filesize
2.2MB
MD55c143111f4aa8ab93bd224c6dc2bf818
SHA1bf4df051203044db805306760b709be9eb52c141
SHA256276be8230c72f166e606dad066917929ed6808fc2a7672b915cdfdf75e3f7f28
SHA512258d0519e2a5db729401f3c1eac10fe96dfa8543504cabbfc2555db16bbfdce1965be976c6604cb023820bc47cf41050fbccd3d9eedd2c0943a42fd91d3874f8
-
Filesize
467KB
MD500b707012fdb7009cee1d2eb7ef6627f
SHA1e838a149593cd68f4950b19f48b5052cf960ddf0
SHA25616461b441389a3ed254c8048abe29feadf042d82425c55070219954ffbc54ff8
SHA5127f78a00d88cddcda25b16ad9a72298be95d336807773cca34fa1a97ee02e0379b405aa699496049c77a40bfc587a0a5cb86d1f7a5dafc8c969c3583e3cdc6a57
-
Filesize
448KB
MD59d1a04f05f75671a5a3ffeb995176c52
SHA1a45018bb6a5dd52b310c1eb77262354365925a76
SHA256c777e9d786f5d1d13f78a925453804bf53ee430a38f893f115c2d1ac0f2f07ff
SHA512d19ea63c26c1d41edd5947d0c5ae70e2461c876563c2baeb1fd4a3986254f7919f8d4c32a9d6b9f4c51c4d5a23ffa90a2011d293a106a0a8813295b2bee06e1f