Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
299s -
max time network
305s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-ja -
resource tags
arch:x64arch:x86image:win10v2004-20231215-jalocale:ja-jpos:windows10-2004-x64systemwindows -
submitted
20/02/2024, 03:04
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20240214-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20231215-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation batexe.exe Key value queried \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation b2e.exe -
Executes dropped EXE 2 IoCs
pid Process 1936 b2e.exe 2104 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 2104 cpuminer-sse2.exe 2104 cpuminer-sse2.exe 2104 cpuminer-sse2.exe 2104 cpuminer-sse2.exe 2104 cpuminer-sse2.exe -
resource yara_rule behavioral2/memory/344-8-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 344 wrote to memory of 1936 344 batexe.exe 84 PID 344 wrote to memory of 1936 344 batexe.exe 84 PID 344 wrote to memory of 1936 344 batexe.exe 84 PID 1936 wrote to memory of 4996 1936 b2e.exe 85 PID 1936 wrote to memory of 4996 1936 b2e.exe 85 PID 1936 wrote to memory of 4996 1936 b2e.exe 85 PID 4996 wrote to memory of 2104 4996 cmd.exe 90 PID 4996 wrote to memory of 2104 4996 cmd.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:344 -
C:\Users\Admin\AppData\Local\Temp\9097.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\9097.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\9097.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9E05.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2104
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20.6MB
MD53de79ec8fed3c4c88010cabe062cf511
SHA15c6e148b9ba79469bb9c48e7172625daa0d26bea
SHA256659ac6e0c13e003dc7f36e08bb4d8a94fa6e8bfecf5eef0f238c7d46742a1f66
SHA5129bc83dc225fa266c4d7aba618cdf8884701091f08e6754801b679685f6067b7d12167ab7e9b94a150b5e26e1af641cf96f558fcefaf53944fa8e3bf089865c6c
-
Filesize
3.6MB
MD5a202c43df284047b4026052f2015b382
SHA1531129cc3cff7410080574b0fd1f8404c8c343d6
SHA25622e0189ee48633fcbb780d8ce081c027adcfd289ce6b90e0dddf506b78a59a66
SHA51203192f196ccd2100255c1fad56bd14019876f87509f7215f1af469e93a9e4a8686d7bd18a1273d46e05711d1017a87948b4299a6d4597fa66001b29ee310cea2
-
Filesize
5.2MB
MD5b6b770012cdc15d7d0e66c1998e13af6
SHA11ad19f8778ae9dfd4b961f361eb7f475c5bf6e2b
SHA256adb463226c20ca6d6cdd52e88f3c7b856d2405986a9712aad09cef0e50ac4851
SHA5120757eb991c65834e6592c536130acdb2d05bd40c9612c4091a03565b90190643c26ec4def70ba091121b9eb1f52a3d46901aef957309ba87a9d056d0ce169e92
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
2.3MB
MD54c04147c386ba8792ac6a03069572a8a
SHA1dda67789fc1d0f2469ca95f01a5c81034853ca6a
SHA256c7739a1e940a282703d06eccda7110426d306f390e97fdbbd9df18472fd132cd
SHA512a8b5a0b878a9a7d30cb38feff814e1f4dce24d000158edc10a43ee9a89920bedf7adc92eb7e3913098b6aab7fbd0531f56fc09f508b5c2769992a94e55d153db
-
Filesize
836KB
MD5aeab40ed9a8e627ea7cefc1f5cf9bf7a
SHA15e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8
SHA256218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9
SHA512c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8
-
Filesize
1.2MB
MD57cf672bee2afba2dcd0c031ff985958e
SHA16b82a205db080ffdcb4a4470fce85a14413f3217
SHA256c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05
SHA5123e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5
-
Filesize
9.7MB
MD55bd5e269eb0962b7b791ebbb8f2cd8f7
SHA14b41ba239775af722e444646a3d10d6330eecb85
SHA2564bcd33fda40e1707c420d57a93dead9f99c2eba283c74424a75ba52221e0bc3e
SHA512dfd4dda39dca1580084e8b3e34b15da1b89d349b7a6d23d596a39833d7141d4e266d1749e345050dbc1835c6e5837d8aab37286eb7dd785ec2b872abcddc4a1c
-
Filesize
4.4MB
MD539710041293b204f41d33118078131b2
SHA1283af7d0c3c59bdea29787b3a91c9cae8930afe1
SHA25605c973d37615e361148c9998e6163ed3675d702945a69634ad319277e7e71d95
SHA512e2682d4ff164a49b863aecb74691b6057db146733834fe5dcf53abb9c2946f6b75c9d323fceaa2ce2fa0d149676329ef326e9a744603b3b03f356d63cd3b325f
-
Filesize
6.8MB
MD566fcf40e86654f41cad36f479a6844e3
SHA167c105d7cc6234acb7827a146004574bc172f796
SHA25688fce32ee91efaa9368b398581dc3a7138a878c6a105a1377c2ebf70d2cbe9dd
SHA512ab3d52c322c1ab2eb041b28b8ad55f0a7884bee7c2312510754ce164beacd6a979e1842498abe4afabb50ea8369df9f7023f08ffd86bbdd1bb9eb963293e193a
-
Filesize
606KB
MD5585efec1bc1d4d916a4402c9875dff75
SHA1d209613666ccac9d0ddab29a3bc59aa00a0968fa
SHA2562f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232
SHA512b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770