Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
294s -
max time network
290s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-ja -
resource tags
arch:x64arch:x86image:win10v2004-20240221-jalocale:ja-jpos:windows10-2004-x64systemwindows -
submitted
22/02/2024, 04:13
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20240221-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20240221-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1712835645-2080934712-2142796781-1000\Control Panel\International\Geo\Nation batexe.exe Key value queried \REGISTRY\USER\S-1-5-21-1712835645-2080934712-2142796781-1000\Control Panel\International\Geo\Nation b2e.exe -
Executes dropped EXE 2 IoCs
pid Process 904 b2e.exe 2424 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 2424 cpuminer-sse2.exe 2424 cpuminer-sse2.exe 2424 cpuminer-sse2.exe 2424 cpuminer-sse2.exe 2424 cpuminer-sse2.exe -
resource yara_rule behavioral2/memory/4436-9-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4436 wrote to memory of 904 4436 batexe.exe 89 PID 4436 wrote to memory of 904 4436 batexe.exe 89 PID 4436 wrote to memory of 904 4436 batexe.exe 89 PID 904 wrote to memory of 3768 904 b2e.exe 90 PID 904 wrote to memory of 3768 904 b2e.exe 90 PID 904 wrote to memory of 3768 904 b2e.exe 90 PID 3768 wrote to memory of 2424 3768 cmd.exe 93 PID 3768 wrote to memory of 2424 3768 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\57F3.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\57F3.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\57F3.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5BBC.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2424
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21.8MB
MD5f5a737ec55c364581207143630eee729
SHA1b27236dee6d89726426f9da3915dbd8897dc0459
SHA2568585057f2c1159809ee4ce396258babe51092b11534e9908f95d58c3dea01a2c
SHA512291c205d3d05fe1058f7c4e757d2b28cc6cd464252301453cf1dcd27a82cbf4887785a042772776b44bdda466d8ac25be2aa92c5a874a870fe1ba48acb8683e6
-
Filesize
7.7MB
MD55686510951dd6a21de967e4aae5cdc50
SHA1c085e1a4361e26919e8f82e04ba256e415396503
SHA25685df9f70fe4ba1d12a9d5c4de57597263555c0a4e2c41a7aabfe270c2042b03e
SHA512e0a1a86e1e11139fdc6e4366002ec1469d92f8cf52492ef9323d73d32011e6005b9b8c9e7d1824f5ebac39719cbb51169c5874f8dc223c1e08fce473b759d6df
-
Filesize
7.8MB
MD561372b339a2819a6b5f6eaf59168ea70
SHA1dc21c10ee8c401a017a84ea516015043ad5c7020
SHA2560ed93d677f96cde8eeb970d8ed3ac169976dd7b5aa03052d9a6d99edf22eaec7
SHA5127f461026d6a289ac1cf76c78d0ec6b9d861448b9918270f05f20929a9cc50a6a69a052e651d24a95266e12d0940765e3993a2a28aa61f08f72e7cea84ba73040
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
704KB
MD5ce5f200d2d48a057722a957d5acc6426
SHA1e7a8d4c0dc7b561dfa26e3fddaff015716187305
SHA256cb450c8c0a952560f35f4b93f14357fc3856ee0b016eabf8bb4d20e9504d82df
SHA512e7d3b203cc96d08b6d000f6845bbeb5777cd08babadbcb86266193ca68d8183973b3a92f5cf587df1f26bf04a182fa51001b7317c9a9e7ba868d1e26b897ee9b
-
Filesize
832KB
MD543dd8ab1a0fd7f177db516faa81a9635
SHA166a8b6940797f3396a4f1a6deafca1fda5bffcdd
SHA256d4b58fa7e09511b58f312b57e2067823a7f31ff5cd6369cbf5ef3667c27b60ea
SHA512064753e38fb6e2d64a8ce067a52c24b55eb11cf714a534f3557a0e2bd2f5fba16030d8496c7787f4b272ae6a696f4b017d99771488832d12711a7158c927f772
-
Filesize
576KB
MD5bfba8ef054be5bee0da072ed080beac4
SHA1090e6e60a6f0f1e351978e91b99e8dce8e63413f
SHA25681f3865864af4f5ae909e3cb60ec0e0fd028e37909315b0e3de8663a34391be4
SHA51285a8d0b74341c10b3563209566415727a1d1503433908c26c3e861592c397a66afe3cc25bcb31119ec64e15fa078db361bc308474de1ec3f1a8c367d37c622b6
-
Filesize
448KB
MD519a61444b6e2d01755ede80960bca19c
SHA1e0c7222784d3e2b3329ec3280648b17fd60ef209
SHA25613fd488b38f3b75438e9ad0a033df005cd397f3c92f43275714a0a7eb3fb4db8
SHA512bc02c82bdac19f10f3e3a93d3f507bb7838c9255b7cff5af6e3a7f3b471dae9c45c52728c3c23857b3402dd1702cb51a20f225a4da992c26a997c26d86b6b1d9
-
Filesize
576KB
MD546e1c7531774dee6a7125727095ea354
SHA12248bc2bd821aded068d2e5e55f5e7271b50ab91
SHA256cecc229ea9e416207638b67d03bc6846fa188a14fe1c9e75028afb48ff4e2081
SHA512fa9dc86df3e0a8f7b2579785c03717a43eec14beab8ca3176f73d4ecb0716d047241ab30cd53518e7acd645e9f8282a20552a6fa33824c34afc5c5210cc69f2c
-
Filesize
512KB
MD56162b21c54b88c5c990e82aee951ebb4
SHA1477384ab8ebe5f5a5d5a91603736d9ef53c12fd4
SHA256462eb68967c7205145d0b92e4f3b69297f616187b07a189178f35f288063aff4
SHA5126264ee49c4b8a6eaa69241e10ff9ab39445f85a57b756b8bc0530b45d77827d05e669dc06b689d4693db34e4161ef11b2cfe6f1954b0b90bcd434e81a938a40d
-
Filesize
768KB
MD5613807ad6d525aded318b643c33bc17e
SHA12c9a4180140838c69c20bc4047c3d2d777d3bee4
SHA256896775bd33edafb0d219d1ae3e973e71aa29a4937d0252bd3a4cad074c004971
SHA512d688b0f2570944898097dcc6acb56b3a4c901073f0ce22b5ea260b05a37fe2840d84b44e7aa74c7d73078b0e5a45c24994852f5c03f049982b6ddca6ead89539
-
Filesize
448KB
MD5ca123cec7f705c0af114e462349dc686
SHA175f90b4d95f6774b2f66e4ba790755ef118ab222
SHA2567f141cdc0be9c965e21310bcfb0484b20d31ffd8a6a970f8b5a53c0e8974798a
SHA512650125faa9ae6733f1118caf3101ca6850473f78f9bfc3a87e908eac1c69935e3bc269ffb5de4dd6e867429c1af35c7f3b9e62eb698fa7c9695d68e7115f3f1c
-
Filesize
384KB
MD54cb3a8d3af58faf78da4dd33a03029db
SHA15356e4fb04a7047f6fc82a4e071e4803f97a0f3d
SHA25686df790940bd442466ea58a434a31aaaadd1d23a9e9bf5e6fe625ff49049d620
SHA512244237f4a13a7666e9f9592451dbb8bb18ca1f828d66f97e2890fa8f6be690d8890848102a8be253542c9f4b154d9f0e1aeeee5a867c866b78b64f9949f48c89
-
Filesize
512KB
MD55fd46a66845c804b88dcd97ffcd66652
SHA19556ce5607bdd245c8e4d6a24b8217def653f57b
SHA256b7fd85a2268a4d62fa15fde3d9e51d6fa3bc865cb4d8e5fdca309be7b027f193
SHA5120896697d588401a6d29c30e77574ece4f0ba699b082b1bad93964748313a5903eb4994ec81c61bfcbd75f2be3f5200dadda3fd1454381cc5874a9c8952ebeedc
-
Filesize
448KB
MD59d1a04f05f75671a5a3ffeb995176c52
SHA1a45018bb6a5dd52b310c1eb77262354365925a76
SHA256c777e9d786f5d1d13f78a925453804bf53ee430a38f893f115c2d1ac0f2f07ff
SHA512d19ea63c26c1d41edd5947d0c5ae70e2461c876563c2baeb1fd4a3986254f7919f8d4c32a9d6b9f4c51c4d5a23ffa90a2011d293a106a0a8813295b2bee06e1f