Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
300s -
max time network
305s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-ja -
resource tags
arch:x64arch:x86image:win10v2004-20231215-jalocale:ja-jpos:windows10-2004-x64systemwindows -
submitted
17/02/2024, 15:44
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20240214-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20231215-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation batexe.exe Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation b2e.exe -
Executes dropped EXE 2 IoCs
pid Process 1228 b2e.exe 2524 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 2524 cpuminer-sse2.exe 2524 cpuminer-sse2.exe 2524 cpuminer-sse2.exe 2524 cpuminer-sse2.exe 2524 cpuminer-sse2.exe -
resource yara_rule behavioral2/memory/4116-9-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4116 wrote to memory of 1228 4116 batexe.exe 81 PID 4116 wrote to memory of 1228 4116 batexe.exe 81 PID 4116 wrote to memory of 1228 4116 batexe.exe 81 PID 1228 wrote to memory of 5132 1228 b2e.exe 82 PID 1228 wrote to memory of 5132 1228 b2e.exe 82 PID 1228 wrote to memory of 5132 1228 b2e.exe 82 PID 5132 wrote to memory of 2524 5132 cmd.exe 85 PID 5132 wrote to memory of 2524 5132 cmd.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\F695.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\F695.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\F695.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\308.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:5132 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2524
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
2.5MB
MD503b2b6e4195e4d01d0db82fafc6a4682
SHA1b574982ec7cdf86bcc876694f7011dba8b4c0b9a
SHA2564dea500b67d5dd7b6d88517233345654159b2a68d185be0f0219513e1e4010ca
SHA5120be3df585ee41e522d3decc412727c697d638fb400caab8dfbe749eb2d17fb65e4bc1e19602dab7c34ba2baf0637c254569d69d38c5ab1ccd3f6e65dac71a54c
-
Filesize
4.1MB
MD59f077eda9d04322a61da14693403af0d
SHA1d5fa88d41f92d793574e51e33f022742b0315eff
SHA25696cf48d25f7d4851823b01c4addaf8d9aa6300b250c8e066dd398f58c235bd93
SHA51284319aa643c88f944aff56399e9138b8eb9dbfa325be9697de64f8b9679da5156e3112bf385f3b7494c03676a628c225d2f24c927fac81afe033bfa2c72d9d3c
-
Filesize
4.8MB
MD54f6e914dbe72d8821035c6b69c2db7c8
SHA181462fecf1dc6e79bd57509a53633af5673e2a8a
SHA256973792e8152336ab7a5a0383d1550e1fdacefc137c13adc29030fba581fa72bc
SHA512f658598159e8d327bf66ed984a251fa223564e92233f3bc6083bdb386f2849bbf6a57d6cef2c23a56d9b1c0e59dd572eb1a4b046f0d1aeabd311adb0ec499489
-
Filesize
2.0MB
MD59421b4ecfc173e0c632f6fabe66d820d
SHA1acc5a8af11a112e45a9bb818f46b26bc0534cb03
SHA2562d264c15b68af91d87fa6960d4136d5e0b41b2ae4c32e661ac026bfd1799517f
SHA5127e850b8a49b000e76e7fe9a6cdcdef4f0cb239c05b29b4f9c3e9bc4d2a926f47317fa6bb900591d94a86dc00bbe40e4333c0ddf9b29b720054d6272664c73df8
-
Filesize
2.3MB
MD54c04147c386ba8792ac6a03069572a8a
SHA1dda67789fc1d0f2469ca95f01a5c81034853ca6a
SHA256c7739a1e940a282703d06eccda7110426d306f390e97fdbbd9df18472fd132cd
SHA512a8b5a0b878a9a7d30cb38feff814e1f4dce24d000158edc10a43ee9a89920bedf7adc92eb7e3913098b6aab7fbd0531f56fc09f508b5c2769992a94e55d153db
-
Filesize
836KB
MD5aeab40ed9a8e627ea7cefc1f5cf9bf7a
SHA15e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8
SHA256218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9
SHA512c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8
-
Filesize
1.2MB
MD57cf672bee2afba2dcd0c031ff985958e
SHA16b82a205db080ffdcb4a4470fce85a14413f3217
SHA256c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05
SHA5123e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5
-
Filesize
1.8MB
MD51debb9d862df614cba695bd387457f49
SHA18e9eeb38c293e61df804d04e671b9df6af41bf07
SHA2567b27afa6e4e165134a82decb4e3fccd539fae69901a479a75f4659553ea80334
SHA512ee9ecc82fdabf6efe72cf513c3e77e3df1db7afccff841a78d7c146d9dc4799ac660941a66e62bb34aec0e0bce93ca9f670ac57b52379daeca5ed198c4c5aa26
-
Filesize
1.4MB
MD5121eb6cf7e3110ec80d1ebe7339f0924
SHA1a1810d79ede78d49764b25c3adf05613d6b102d3
SHA25604c38dca30c24ef1db46bc39f6048ecade1d488e9ed087aa6195c44abd77e282
SHA512278c97e8f7184bb667b31a87ec0e631b88100c02ff0982bb07ebd498a67b04e02da4548588dea26ed4d0a626a1abb74759b8c4c202ecb8f4a92e9efe62a1492c
-
Filesize
1.3MB
MD5e0277c5473059c8f37d930ce1f1dec28
SHA1b7c4746f38554cac23363b187f8b3dfc4eec86dc
SHA256318d3bb93700decf8019a6d4f22c2e92e96033ac23dbf84eec5b7fedfc0576ee
SHA5122c700a604e33958c06b67980ab99510063b66979f9ddb7faad61728ed3572436ceb962de764b157fd9c4a6800ee2d44bc469c742cce34ee890e789cc9d16d1ce
-
Filesize
606KB
MD5585efec1bc1d4d916a4402c9875dff75
SHA1d209613666ccac9d0ddab29a3bc59aa00a0968fa
SHA2562f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232
SHA512b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770