Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    295s
  • max time network
    304s
  • platform
    windows10-1703_x64
  • resource
    win10-20231215-ja
  • resource tags

    arch:x64arch:x86image:win10-20231215-jalocale:ja-jpos:windows10-1703-x64systemwindows
  • submitted
    14/02/2024, 16:26

General

  • Target

    batexe.exe

  • Size

    9.4MB

  • MD5

    cdc9eacffc6d2bf43153815043064427

  • SHA1

    d05101f265f6ea87e18793ab0071f5c99edf363f

  • SHA256

    73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

  • SHA512

    fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6

  • SSDEEP

    196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv

Score
7/10
upx

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\batexe.exe
    "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1588
    • C:\Users\Admin\AppData\Local\Temp\A9CD.tmp\b2e.exe
      "C:\Users\Admin\AppData\Local\Temp\A9CD.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\A9CD.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3052
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ADD4.tmp\batchfile.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1592
        • C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
          cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4296

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\A9CD.tmp\b2e.exe

    Filesize

    500KB

    MD5

    58e41dd16b624c4dd0189a5ded94d9fb

    SHA1

    8f7e7e747a40cf06800f72e37a47f8ed41b4c382

    SHA256

    528a28b61bdb9637a58b7593f10fc58deee0ba4c420c330bc91851d069e9a9d2

    SHA512

    d627930b619d3610ab8a73a948fe56cc9914b9ff6533a59e79e8d0320f057d7dfc62d1b7ceefac85ed7d43a6ce3ebf789f7f0c6db86b917e5ae68ebc5de3c57f

  • C:\Users\Admin\AppData\Local\Temp\A9CD.tmp\b2e.exe

    Filesize

    1024KB

    MD5

    55d3fcf113506e85b6cf485f08b11290

    SHA1

    539d601fdd7e37fe22412d8c73023e21293ac62c

    SHA256

    519083ea4de496637895b9c3dd7fa5d9fc1140325272570f09aa0d2bad46f2d3

    SHA512

    62c0dc6a36ef819eede73c8b041fbdf579ec0ae399654a73a4628555bb84c4e1fdcf314deb659f41986204e2d92acd886dd8735a24a150a309d4035b58a33ee4

  • C:\Users\Admin\AppData\Local\Temp\ADD4.tmp\batchfile.bat

    Filesize

    136B

    MD5

    8ea7ac72a10251ecfb42ef4a88bd330a

    SHA1

    c30f6af73a42c0cc89bd20fe95f9159d6f0756c5

    SHA256

    65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9

    SHA512

    a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0

  • C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

    Filesize

    367KB

    MD5

    32e8c5dc88bcad74fe435a6d9effe266

    SHA1

    3790cf238d247de3aa619ce22e4bc9108b547695

    SHA256

    4fe8b825971cbf4a9a0fe500788896f91cf81bc29c02efbeed4d3495558b6441

    SHA512

    407d2359d2868f6b1f18d08f1a58fa0140e2f59580b1fe3d546386b80049443a011a7dca523d35f490d32e78730827f43b69a391df271f7855cb6f73f4c4ab83

  • C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

    Filesize

    500KB

    MD5

    dc4f2651bc8b1801415ebcaaf236546a

    SHA1

    ba76c0098dc22d46710364f960c047a2fded9d00

    SHA256

    52b73f3f1cab59701f6676c27fa6de168c6ba4fda444805dd80a9f4848e4d668

    SHA512

    1658e5da5d7bba40eb017741d76380d44fdd83296ce59557eeb941609ccd8c007c11281dd54882b8d788dfdf359a7dff2553c5f2a2eb3ab81ac7a57f82535fb8

  • C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

    Filesize

    291KB

    MD5

    3dd0596d0d5900a3688a7900148198d1

    SHA1

    16245a3d5bc9013017346ba6a4efd4f9f5e24783

    SHA256

    475b71c62622cf5cde63e5c8d03aff8eb27ad75ff7c5565080c749a73c7c988e

    SHA512

    16c589023967375d6d6ab30d1dbd1fee84262890dd6dda58223c5868138003d756658ba492ff0b0235e174b529d7d88e0cf3fa1628003994d281f3298c86dfe2

  • C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

    Filesize

    613KB

    MD5

    01a872e599ef1852a79058234635a47b

    SHA1

    de96a29b9ea16e359c3b5f70132fd1d743d9fe1b

    SHA256

    58e21bf23e6f725c3f1b9d09e5ddbabbe2a5cd24f9ff2f1294595f8864098476

    SHA512

    984f633b3a0f2cae6c9d51888988bff4ddb07bc275580d261fda9bff8f06d4bb7d938ecd098972e5e5dbc1f77d14568288a8171e156cae2cbcc1c60a96b7496f

  • C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

    Filesize

    411KB

    MD5

    332581596c7f70482ff8b35feff0f474

    SHA1

    2d3ec11426cc761df57a6a1d05e05b8d37a59988

    SHA256

    ee52ef2744deaf6358b0bb3e979747aa4bc636adc0eda210b9a4effa21c797c6

    SHA512

    bff241f820167f133ef0b171910dc4b5278e7909bf28e22f16d877a48bc8036cafdeccc9f6be6a4b9afca9d2d86e02563b490cbab92fe8c98812df34b1855b33

  • C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

    Filesize

    311KB

    MD5

    87d486006cf612a54c0d0f3e5e92c11e

    SHA1

    fdfae4d44dd889880567631bcf64aab7000d74b9

    SHA256

    27e46c5fa3db5184ace8ab03a2ab92fbdf6046bfea265838a22a362edabddce8

    SHA512

    0e155b64e6a43a1713ecc212bc5e00bf4bfd5f618bfb1e73f64b3ddb434d60a29bf46b32358e53ed8c63abd3649fae6dca2962d194f26af019beb4650c211d3c

  • \Users\Admin\AppData\Local\Temp\libcurl-4.dll

    Filesize

    397KB

    MD5

    561ba001e04193f4c77eefda8475b930

    SHA1

    89f61e0cdef26a6ee7a1688ac7d78ae341d481df

    SHA256

    68306d21f9060c6b7b9c7ff6c5e561d86d49c6af8eebe94078b9da7cabd0d9b3

    SHA512

    d5b899442e7ca09f3cfcc4a7a73ee4643f21d0f5de7459b0b1322a18baa20f29019acdf9c1f3f3ecb4ea83e944be5106e9da0625f39071ffa5974738cf84141d

  • \Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

    Filesize

    419KB

    MD5

    ced76636ec6b122f743e2a72b139d85d

    SHA1

    1b4a688082ebde831e60451742716078b8476c67

    SHA256

    e6b876538e82d3909d87ab00428e670249a2c9dcecb4da29a7f4a9576151f179

    SHA512

    d26a1ac9c68b23206fb282985ddac9bd83d946904203756935eeeca51433d2c20f70eba7b83cbc91a938e6eb8d78f204a21c3d035ca9437690d6728a7eecbd25

  • \Users\Admin\AppData\Local\Temp\libstdc++-6.dll

    Filesize

    366KB

    MD5

    0dfaf234aa2b1d86c8cf6675be3d8f48

    SHA1

    ca6dcf8ce5e4ec954c3e513eef85ff79c285b5ec

    SHA256

    cc3d5afee5f5c7478b9dd54384d6cbff061b4bcc252f696d666cdad129ab46fa

    SHA512

    5bf7b02a7beba0f19b7c18db99f85061508a20a60cebb7792032294a3413b8ff28db973480704c0821b4156c5e426c0f6a5c63d2950631a9dcdcbfd7f2217d5d

  • \Users\Admin\AppData\Local\Temp\libstdc++-6.dll

    Filesize

    444KB

    MD5

    aed1a1e3329bc2b286318eff5206965c

    SHA1

    af7b3de949eaaa32b14b2959c60a6fb6bc890ce4

    SHA256

    2927f33ef83a417ed434affc3662dfd44595cf69c127dbae0234d01bb8f876c3

    SHA512

    d12f4a606ec78e8f36d2be0b9b38100029246db02f81a281c4dbeb50be652fbcb34fb8c829e4d168328efdee3dcbcfe7434561f3dbdbd686dad6bc275936421d

  • \Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

    Filesize

    338KB

    MD5

    1c34fb94253f81ce9b0d2fb82ed70fdd

    SHA1

    8b2c51cdaa29c256770c47c9e850e692a1b7c1e9

    SHA256

    5e446b9ca6971310fe10d3f3396cc040dd92346322ffab6680068a600f84faba

    SHA512

    3a8486c7f7d2982caef1ccb7cea641085749837a71ab8d8d0a8e42344eb7467fa28615d062f7e761f85dd0e22a4c7a9c4207a143db44822706403c6d93e174bd

  • memory/1588-5-0x0000000000400000-0x000000000393A000-memory.dmp

    Filesize

    53.2MB

  • memory/3052-50-0x0000000000400000-0x0000000000405000-memory.dmp

    Filesize

    20KB

  • memory/3052-4-0x0000000000400000-0x0000000000405000-memory.dmp

    Filesize

    20KB

  • memory/4296-40-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/4296-42-0x00000000765D0000-0x0000000076668000-memory.dmp

    Filesize

    608KB

  • memory/4296-43-0x0000000061440000-0x000000006156B000-memory.dmp

    Filesize

    1.2MB

  • memory/4296-44-0x0000000000D40000-0x00000000025F5000-memory.dmp

    Filesize

    24.7MB

  • memory/4296-41-0x0000000070800000-0x00000000708BC000-memory.dmp

    Filesize

    752KB

  • memory/4296-51-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/4296-56-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/4296-61-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/4296-66-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/4296-71-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/4296-76-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/4296-81-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/4296-86-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/4296-91-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/4296-96-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB