Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    296s
  • max time network
    301s
  • platform
    windows10-1703_x64
  • resource
    win10-20240214-ja
  • resource tags

    arch:x64arch:x86image:win10-20240214-jalocale:ja-jpos:windows10-1703-x64systemwindows
  • submitted
    18/02/2024, 14:36

General

  • Target

    batexe.exe

  • Size

    9.4MB

  • MD5

    cdc9eacffc6d2bf43153815043064427

  • SHA1

    d05101f265f6ea87e18793ab0071f5c99edf363f

  • SHA256

    73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

  • SHA512

    fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6

  • SSDEEP

    196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv

Score
7/10
upx

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\batexe.exe
    "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1596
    • C:\Users\Admin\AppData\Local\Temp\27C7.tmp\b2e.exe
      "C:\Users\Admin\AppData\Local\Temp\27C7.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\27C7.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4492
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2EEB.tmp\batchfile.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4268
        • C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
          cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4800

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\27C7.tmp\b2e.exe

    Filesize

    2.9MB

    MD5

    9317cafb85becd9011ca213e7be3a2bc

    SHA1

    1c84c389734da0532809700191b96dc61527e382

    SHA256

    644eb7fd5f540a11f942d00b2233e715a40b8548294924fc054db1e08b293090

    SHA512

    65120a9f1410f4b9350788c5898557be3d3b195f03b3425895748764fc052048f38998bb455cef4f25f748c696821a9a4622c8f09f6ae4603dcd6882be451684

  • C:\Users\Admin\AppData\Local\Temp\27C7.tmp\b2e.exe

    Filesize

    4.1MB

    MD5

    31615644f452e96494d7c79c237e2668

    SHA1

    a07f5b1c3621b3ba6bd25bee5a7a80b7336db2d0

    SHA256

    0f2fbc74450d43fd8ef9b25c256a81497a4ed67268dbbc4655469eda73445dc3

    SHA512

    8ba0613bb9c563a7e83b220571da712d290ed6088bb96b7ced84c51fea5f03c6ce68e0e7802a3a4da5cda3047f3a51c18db060a4e64af8b4a3607a308567db54

  • C:\Users\Admin\AppData\Local\Temp\2EEB.tmp\batchfile.bat

    Filesize

    136B

    MD5

    8ea7ac72a10251ecfb42ef4a88bd330a

    SHA1

    c30f6af73a42c0cc89bd20fe95f9159d6f0756c5

    SHA256

    65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9

    SHA512

    a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0

  • C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

    Filesize

    325KB

    MD5

    9480baeb189c7baaedb971738bf06b51

    SHA1

    b44ed448e152026ae7a6bc7a32f83d4165db2285

    SHA256

    12d811f05a353116e3f8899759a501f5447a792160879afd53c65304fa84a95c

    SHA512

    bf486f450a961e750285edd7456674181e1a7113b1454f296445f74a164ca25dbf9b5f8191ce9f57ce88f9419ab4df705d07f4f31e099a23df268b464d7faea6

  • C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

    Filesize

    334KB

    MD5

    c5de434c1086be7e0aed41eb042a9079

    SHA1

    b546fc9d51befbf851299c30ec21584faa76b01c

    SHA256

    a72d6f8b464179e33cfc1e034d1858e233f3dc69592768bfd61b71af97813aa3

    SHA512

    4a4b5acd5327d6fba485f29a894f146d10e16b1586b2513212bb45e898db8c143c6de8ba845cb4ee70a43a9ca5e7e27a4da402efdd4d07c249da591aa15a9e93

  • C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

    Filesize

    201KB

    MD5

    a381a58fd542464ec5aaaae771e3e376

    SHA1

    0b827a9639ca5c4c90652da10bd37f0db37172bf

    SHA256

    12159489ebd30e47af82797c3718d1e4acb1b21b4ad89fbd8d3b1f04843c7504

    SHA512

    70726c3c69eda42dbcb67298739c52ba474fa7d77c6ffb69573622bab7f80f2b983236c275611e03d835560409fe647d100dfa5a268c52309ba0c2272c23aad0

  • C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

    Filesize

    167KB

    MD5

    7701aead253c3cf436bc0f93802cc7d0

    SHA1

    eb39739bb7e88e8f8bbefbae8299d4d7dd76c6fb

    SHA256

    18fa7272876bc7d9ee5857f99fad1b7530ce764e115ac3722ad4d4cf910799e5

    SHA512

    b9dfcf1c4d8af4922d09a2a1a4e8208ee31a82c0d3de4ce2a89a7da688792027d6922388805deeaf7c409d8ac7867f7a59f60d1b4c7aeea76f512c2e00b5398b

  • C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

    Filesize

    153KB

    MD5

    0c75e238ae076f996f0d7c44fb2d70e3

    SHA1

    d717e6cf7b8be52183cb7f6b5443930da557b0a7

    SHA256

    04fdb1d8a44332e9f683f236863d7836fb2d4547cbad78d3781c77d7d709dbea

    SHA512

    cfec00882fffd5a90b7eaec53973c54af8f70c59391b7cf4f5d51d934c469bbc340df31a203c09ed7d2399fcf5a4fe1f231c02f1361a02cea8e5e048e6022df1

  • C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

    Filesize

    236KB

    MD5

    96276d6479d77133f42fdbe419c25f24

    SHA1

    24a6cdae197eed8fbf55959fb9125399e084f1e2

    SHA256

    dbc24e816e98a7461665cacf2bf4eb47425e43bfb65704491db221b8dbb39fc9

    SHA512

    874d0121e4d89d8ac823e70b5f69dd78ff7d351cf7c3cf2f4a0c8117d7f55e9beb4838e9dc47d7ba133495cb72ce520f2aac3bdbd0113ec6d880b59d9c8ef659

  • \Users\Admin\AppData\Local\Temp\libcurl-4.dll

    Filesize

    137KB

    MD5

    ce47701fe7ecfe1b82caeb3c36bc3d29

    SHA1

    cfddbee9eb2727ab2e153564b711b288b1a14295

    SHA256

    3adce3c7f0b389c32d18191f48d1b81e557ff558edefa42cb5eb9408465a2214

    SHA512

    0d68389903153996c54c807cbecbe84a01d1c97f66eafc67ecf2cb5ef981754a54e86e0365c08057e88f6d7202036ff462f4c5ab23fbdccfdff0a6ea7a2494a3

  • \Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

    Filesize

    128KB

    MD5

    2437b0b7704445e4826153cd47ae7da2

    SHA1

    da58ff819438d0d1602ec3da04d651495e0bfa59

    SHA256

    186b2280e7bb0b7a7c91ed2631fee8ae7891fda40df5c15cca8b123a590aafa8

    SHA512

    bffb6ac6404d1488422d6113c0398e04b1452f3df041d0e0c4e1fe45e57efee7d040e1c8da166c73ec743c6c5d1a660fa23b43b765c14a4deaf53f8fd5c19a50

  • \Users\Admin\AppData\Local\Temp\libstdc++-6.dll

    Filesize

    245KB

    MD5

    e9a5c5cab45f639c1aaf78c713e0f8da

    SHA1

    54990f01462c449485bf6100f46f7220c2ac1ae9

    SHA256

    105ae7881b2d63502e194ec68e3c6e2de443c325175f6c37ae0674cf3f44c8c4

    SHA512

    3f3a08093a37f218845b089b1f96be68459a23b485a3a9f1141c20752cb927716aaaa39c7ffe28e2a3a9fc273972299e99e18613a52d6a08565ec810b0e47c8d

  • \Users\Admin\AppData\Local\Temp\libstdc++-6.dll

    Filesize

    298KB

    MD5

    e56bef975e55a9a7019c660e20705fc4

    SHA1

    4f5e8f8a8117c0ee565d15a7a5d7674bf4cef8e9

    SHA256

    a9ebc6540f6e9f67aa532a07f2849a542404153c3d9ace234a1eb85852dee724

    SHA512

    91129655452350937d6cd5a8089d939817c1a507e154f460420afc48b3eed020c495fe51c1feb32f129f96158771ed5173e3931167e1f33a6df920209131d101

  • \Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

    Filesize

    163KB

    MD5

    2f7c17de1500f6a59da8b597b08c503e

    SHA1

    4486753b2194b25f1a1084e564be8edaf384708a

    SHA256

    aaf33dad9f60fd2de9c6e525a007a410f9195f04b8c7d47197aa70ad5157ce43

    SHA512

    5122ef128daaed26ea418072290fd3b1f629c4ac8ebc88167e201a6d1e1f827c7d0eb81c0e76e97858f41e597bd9298b1a60ebe679d2a9e351e028050320b142

  • memory/1596-5-0x0000000000400000-0x000000000393A000-memory.dmp

    Filesize

    53.2MB

  • memory/4492-50-0x0000000000400000-0x0000000000405000-memory.dmp

    Filesize

    20KB

  • memory/4492-6-0x0000000000400000-0x0000000000405000-memory.dmp

    Filesize

    20KB

  • memory/4800-40-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/4800-42-0x000000005D8A0000-0x000000005D938000-memory.dmp

    Filesize

    608KB

  • memory/4800-43-0x0000000061440000-0x000000006156B000-memory.dmp

    Filesize

    1.2MB

  • memory/4800-44-0x00000000010E0000-0x0000000002995000-memory.dmp

    Filesize

    24.7MB

  • memory/4800-45-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/4800-41-0x0000000070800000-0x00000000708BC000-memory.dmp

    Filesize

    752KB

  • memory/4800-51-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/4800-56-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/4800-61-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/4800-66-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/4800-71-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/4800-76-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/4800-86-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/4800-91-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/4800-101-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB