Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
298s -
max time network
305s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-ja -
resource tags
arch:x64arch:x86image:win10v2004-20240221-jalocale:ja-jpos:windows10-2004-x64systemwindows -
submitted
23/02/2024, 16:46
Behavioral task
behavioral1
Sample
batexe.exe
Resource
win10-20240221-ja
Behavioral task
behavioral2
Sample
batexe.exe
Resource
win10v2004-20240221-ja
General
-
Target
batexe.exe
-
Size
9.4MB
-
MD5
cdc9eacffc6d2bf43153815043064427
-
SHA1
d05101f265f6ea87e18793ab0071f5c99edf363f
-
SHA256
73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72
-
SHA512
fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6
-
SSDEEP
196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000\Control Panel\International\Geo\Nation batexe.exe Key value queried \REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000\Control Panel\International\Geo\Nation b2e.exe -
Executes dropped EXE 2 IoCs
pid Process 1596 b2e.exe 2124 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 2124 cpuminer-sse2.exe 2124 cpuminer-sse2.exe 2124 cpuminer-sse2.exe 2124 cpuminer-sse2.exe 2124 cpuminer-sse2.exe -
resource yara_rule behavioral2/memory/656-9-0x0000000000400000-0x000000000393A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 656 wrote to memory of 1596 656 batexe.exe 88 PID 656 wrote to memory of 1596 656 batexe.exe 88 PID 656 wrote to memory of 1596 656 batexe.exe 88 PID 1596 wrote to memory of 1072 1596 b2e.exe 89 PID 1596 wrote to memory of 1072 1596 b2e.exe 89 PID 1596 wrote to memory of 1072 1596 b2e.exe 89 PID 1072 wrote to memory of 2124 1072 cmd.exe 92 PID 1072 wrote to memory of 2124 1072 cmd.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\batexe.exe"C:\Users\Admin\AppData\Local\Temp\batexe.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Users\Admin\AppData\Local\Temp\8C52.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\8C52.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\8C52.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9BE2.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2124
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.1MB
MD5b4bb3dbc7760dc304a726df1c20f54ab
SHA1a9abc30f928d27fc96b091fd4d187aa26470f0ed
SHA256bda420d773630c497c99cff9350b782093121029874b4b739091903f0b3e8e06
SHA512102ae2cfdda1a7d2889dbdbfdc4f41cbc9690660401bb69a7f7a32fa714f15d12991152ee4052d105409712420bb2dddfd8f1594299af958872789f5a57986f2
-
Filesize
9.6MB
MD5b040b616665ab19474313141578c5dbb
SHA1c6a236d60457f620abccc75af2ea06e6ae0afffa
SHA256859691b8507279e5caa04a02257391e49511fac78eeaff4cc4d110d66df2cc6e
SHA51244e68b9c9d791ac70140ccf09718a372a25f5d0b973673defab1d9eb6cc83dde46f68f6653eeb5343e73484e6d042c3e56dab14ed000d321da289236cb3f8f65
-
Filesize
8.3MB
MD51905c6779b2bb6d8da53f81c4d2a601e
SHA1817ab858ae7bcc70112e4ea3089b24e668c8b928
SHA256580151b284a9d00086c1db7e15a4bd376b1bb78cd7b3169a18aab37d2368de68
SHA512c511f032a3dd0c63c8cc223087edd6d0192206e4bdaf85acb0a135383ca96c5c6fa81528cebd62b815904b80edb58589c8b4dfca00d5bf1b2197ef7679f3dace
-
Filesize
136B
MD58ea7ac72a10251ecfb42ef4a88bd330a
SHA1c30f6af73a42c0cc89bd20fe95f9159d6f0756c5
SHA25665e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9
SHA512a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0
-
Filesize
1.2MB
MD5bfe3030f98fdd4c2d94b442a7e165e7b
SHA17f00d74889d4acf2506549e9f45efd40ba28aae2
SHA256ca95bab59eec5a2f3e2683f71abe8207ab3efb434b13ce60ea42e8478f50e954
SHA512d122ec615d304eab5e5bed42ac8246cd32af736db5aff115cc533ed646843b349bcd3a645b52870371c019730fcd7dab1a7c9aa501b0e312676b8b9d93ca0154
-
Filesize
896KB
MD59f9a8fea08bacf3a1d155567fead5940
SHA19d9ba8746c585446f53f442b800e1eb28a0df86a
SHA256a22f9d8fb953e4f6bc93cdcc8aa650a5a093f1dd400fdc501d5aa7b00bee0289
SHA512d41a048619373832c616d48f919595ac50dfbbd68095aec008b30adde91ceeeb86326c7d412ab20d937bab7096fb8165d3da8b4fdc40a03cc32da9ee3e9dc2a2
-
Filesize
576KB
MD5bfba8ef054be5bee0da072ed080beac4
SHA1090e6e60a6f0f1e351978e91b99e8dce8e63413f
SHA25681f3865864af4f5ae909e3cb60ec0e0fd028e37909315b0e3de8663a34391be4
SHA51285a8d0b74341c10b3563209566415727a1d1503433908c26c3e861592c397a66afe3cc25bcb31119ec64e15fa078db361bc308474de1ec3f1a8c367d37c622b6
-
Filesize
320KB
MD5c911df8bf8c66277e14360319b0b93b7
SHA1598c59c0e7cbecb788ee676db218dc0faaa39bdc
SHA2564c53941f04ddeae2179047a1c7f8c7f7f46af0f08c424ab66d61f2316f2ee77d
SHA51213aeae87ee52f22d1c928c99c66e116254cde630c09f90b146962fa61276af13fef653b7a66184d00d614f0379750e641c2e62326ebb5588ca632e56c935d77c
-
Filesize
320KB
MD5e63bf5df87e2ea807dc353cc5aa9aab1
SHA169fc94bbebe878711cb133c3a1affb80c0bdecff
SHA2562c9d6315f90367b959d3c32badd99bbc03eb808e4a46db72ccf2e81788b41533
SHA51270f2b2a8a4c8ab23d81266cd23b75c27ced29a1eab8c80d95c57b595b10254b7229cc03b637716edbfad2a83827f2c557847b98d1de80256beec05c9512ee4bd
-
Filesize
256KB
MD5f8edb8dd2fb15f1887ace09587589dd4
SHA1cbf7cbfefc0215d9500a98d9064deb9e86787152
SHA2560465270288d69a0ec9beb7114707bed76756c14148293237d0d35423abdfc67b
SHA512aa993112953225280c0bedb1ebd8288298b9c22a6a884a952ba60e48cbd21c4ce60724b7adc961a0528d7c569596e3420fec2670fc47c3eb6c00c691e0378abc
-
Filesize
278KB
MD591b4397fd60958a7ac28a05ac52d1e0f
SHA19e5d3ff8a0e195660e12a85611e7579a7d12d609
SHA256459fc416d21af8ea51afa01fd0871517d381a0d795721bb39093ed3e5793df23
SHA5129855bc81be8f64ec6aa78bd74e3df5a49a6438f2ea6f412ee95592ecb840b30911d8bc70932a730b42e0e21d7bf66b1e810516c9d98716bff10b8369ec0512fd
-
Filesize
192KB
MD562069650d62f76a4cdf0e81172d99993
SHA13b20ec5b4a4320ee15b0f7b9715a9ab90f68346e
SHA256779a5590c667d9a704b79e159259c0646737394fd66a9c0b12d13f9445ca091c
SHA512ae1954a84fb7543465e77a4cd5cc1bdeee0cf848592958633e6c51702b42131daae64c302d5c9537c59a9b3ba9498e5bf913d1f6f757ccdb8c4183b33224852b
-
Filesize
128KB
MD59746d1ac79c8b499d8b2224394581fa7
SHA136b1985eabfd8131ad9f2b7f69c903a3fce67629
SHA25677941fbe96e0c797e6cf5419ee32bd3fcee69629cba37750146656a660c37182
SHA51261a6174e2aced5b85cd614ad2f9d3da24c6b91e1fc04e10ff818222c4323cd043a59708bd35af0de84b004bf492fbc157d72907cd1e7ddf7082fc2a3563ef183
-
Filesize
320KB
MD51ae43cc09627ff82d15527ea2693fd76
SHA1c39ffa1a4b80c29fa1f5caed3e7d091253266c66
SHA256b63980c9d592a6d0d8521f74bd4c6f7cc4ae5f8c3320d2bd63764c56648ac45f
SHA51221945e4e2fad3ee2b2a19d19bbbc1ada832c33a0d3bf499d6ac8f093b39021323ea0f7df3d54167a3456cbaf01ff126a6e6abbe17dd4eb8d5a24ca000888c271
-
Filesize
256KB
MD5eca0c37eee65c31b869788d5d0bf00cd
SHA133a5c0cd2f0a7296a5c0169699ed8e065b57e5e8
SHA2561d2b7bd4ddd99d627d5111252baadf028dc9910cf414892867502e5951de962e
SHA5125f302da7772fca0a6d03ffd8732850f526acf5fcc33e189d2d906a33101454d970d5cca2f829a006d15c4a857341d72c7876cb2e7af84ada4f158695aba5a4dc