Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    298s
  • max time network
    305s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-ja
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-jalocale:ja-jpos:windows10-2004-x64systemwindows
  • submitted
    23/02/2024, 16:46

General

  • Target

    batexe.exe

  • Size

    9.4MB

  • MD5

    cdc9eacffc6d2bf43153815043064427

  • SHA1

    d05101f265f6ea87e18793ab0071f5c99edf363f

  • SHA256

    73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

  • SHA512

    fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6

  • SSDEEP

    196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv

Score
7/10
upx

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\batexe.exe
    "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:656
    • C:\Users\Admin\AppData\Local\Temp\8C52.tmp\b2e.exe
      "C:\Users\Admin\AppData\Local\Temp\8C52.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\8C52.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1596
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9BE2.tmp\batchfile.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1072
        • C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
          cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2124

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\8C52.tmp\b2e.exe

    Filesize

    9.1MB

    MD5

    b4bb3dbc7760dc304a726df1c20f54ab

    SHA1

    a9abc30f928d27fc96b091fd4d187aa26470f0ed

    SHA256

    bda420d773630c497c99cff9350b782093121029874b4b739091903f0b3e8e06

    SHA512

    102ae2cfdda1a7d2889dbdbfdc4f41cbc9690660401bb69a7f7a32fa714f15d12991152ee4052d105409712420bb2dddfd8f1594299af958872789f5a57986f2

  • C:\Users\Admin\AppData\Local\Temp\8C52.tmp\b2e.exe

    Filesize

    9.6MB

    MD5

    b040b616665ab19474313141578c5dbb

    SHA1

    c6a236d60457f620abccc75af2ea06e6ae0afffa

    SHA256

    859691b8507279e5caa04a02257391e49511fac78eeaff4cc4d110d66df2cc6e

    SHA512

    44e68b9c9d791ac70140ccf09718a372a25f5d0b973673defab1d9eb6cc83dde46f68f6653eeb5343e73484e6d042c3e56dab14ed000d321da289236cb3f8f65

  • C:\Users\Admin\AppData\Local\Temp\8C52.tmp\b2e.exe

    Filesize

    8.3MB

    MD5

    1905c6779b2bb6d8da53f81c4d2a601e

    SHA1

    817ab858ae7bcc70112e4ea3089b24e668c8b928

    SHA256

    580151b284a9d00086c1db7e15a4bd376b1bb78cd7b3169a18aab37d2368de68

    SHA512

    c511f032a3dd0c63c8cc223087edd6d0192206e4bdaf85acb0a135383ca96c5c6fa81528cebd62b815904b80edb58589c8b4dfca00d5bf1b2197ef7679f3dace

  • C:\Users\Admin\AppData\Local\Temp\9BE2.tmp\batchfile.bat

    Filesize

    136B

    MD5

    8ea7ac72a10251ecfb42ef4a88bd330a

    SHA1

    c30f6af73a42c0cc89bd20fe95f9159d6f0756c5

    SHA256

    65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9

    SHA512

    a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0

  • C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

    Filesize

    1.2MB

    MD5

    bfe3030f98fdd4c2d94b442a7e165e7b

    SHA1

    7f00d74889d4acf2506549e9f45efd40ba28aae2

    SHA256

    ca95bab59eec5a2f3e2683f71abe8207ab3efb434b13ce60ea42e8478f50e954

    SHA512

    d122ec615d304eab5e5bed42ac8246cd32af736db5aff115cc533ed646843b349bcd3a645b52870371c019730fcd7dab1a7c9aa501b0e312676b8b9d93ca0154

  • C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

    Filesize

    896KB

    MD5

    9f9a8fea08bacf3a1d155567fead5940

    SHA1

    9d9ba8746c585446f53f442b800e1eb28a0df86a

    SHA256

    a22f9d8fb953e4f6bc93cdcc8aa650a5a093f1dd400fdc501d5aa7b00bee0289

    SHA512

    d41a048619373832c616d48f919595ac50dfbbd68095aec008b30adde91ceeeb86326c7d412ab20d937bab7096fb8165d3da8b4fdc40a03cc32da9ee3e9dc2a2

  • C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

    Filesize

    576KB

    MD5

    bfba8ef054be5bee0da072ed080beac4

    SHA1

    090e6e60a6f0f1e351978e91b99e8dce8e63413f

    SHA256

    81f3865864af4f5ae909e3cb60ec0e0fd028e37909315b0e3de8663a34391be4

    SHA512

    85a8d0b74341c10b3563209566415727a1d1503433908c26c3e861592c397a66afe3cc25bcb31119ec64e15fa078db361bc308474de1ec3f1a8c367d37c622b6

  • C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

    Filesize

    320KB

    MD5

    c911df8bf8c66277e14360319b0b93b7

    SHA1

    598c59c0e7cbecb788ee676db218dc0faaa39bdc

    SHA256

    4c53941f04ddeae2179047a1c7f8c7f7f46af0f08c424ab66d61f2316f2ee77d

    SHA512

    13aeae87ee52f22d1c928c99c66e116254cde630c09f90b146962fa61276af13fef653b7a66184d00d614f0379750e641c2e62326ebb5588ca632e56c935d77c

  • C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

    Filesize

    320KB

    MD5

    e63bf5df87e2ea807dc353cc5aa9aab1

    SHA1

    69fc94bbebe878711cb133c3a1affb80c0bdecff

    SHA256

    2c9d6315f90367b959d3c32badd99bbc03eb808e4a46db72ccf2e81788b41533

    SHA512

    70f2b2a8a4c8ab23d81266cd23b75c27ced29a1eab8c80d95c57b595b10254b7229cc03b637716edbfad2a83827f2c557847b98d1de80256beec05c9512ee4bd

  • C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

    Filesize

    256KB

    MD5

    f8edb8dd2fb15f1887ace09587589dd4

    SHA1

    cbf7cbfefc0215d9500a98d9064deb9e86787152

    SHA256

    0465270288d69a0ec9beb7114707bed76756c14148293237d0d35423abdfc67b

    SHA512

    aa993112953225280c0bedb1ebd8288298b9c22a6a884a952ba60e48cbd21c4ce60724b7adc961a0528d7c569596e3420fec2670fc47c3eb6c00c691e0378abc

  • C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

    Filesize

    278KB

    MD5

    91b4397fd60958a7ac28a05ac52d1e0f

    SHA1

    9e5d3ff8a0e195660e12a85611e7579a7d12d609

    SHA256

    459fc416d21af8ea51afa01fd0871517d381a0d795721bb39093ed3e5793df23

    SHA512

    9855bc81be8f64ec6aa78bd74e3df5a49a6438f2ea6f412ee95592ecb840b30911d8bc70932a730b42e0e21d7bf66b1e810516c9d98716bff10b8369ec0512fd

  • C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

    Filesize

    192KB

    MD5

    62069650d62f76a4cdf0e81172d99993

    SHA1

    3b20ec5b4a4320ee15b0f7b9715a9ab90f68346e

    SHA256

    779a5590c667d9a704b79e159259c0646737394fd66a9c0b12d13f9445ca091c

    SHA512

    ae1954a84fb7543465e77a4cd5cc1bdeee0cf848592958633e6c51702b42131daae64c302d5c9537c59a9b3ba9498e5bf913d1f6f757ccdb8c4183b33224852b

  • C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

    Filesize

    128KB

    MD5

    9746d1ac79c8b499d8b2224394581fa7

    SHA1

    36b1985eabfd8131ad9f2b7f69c903a3fce67629

    SHA256

    77941fbe96e0c797e6cf5419ee32bd3fcee69629cba37750146656a660c37182

    SHA512

    61a6174e2aced5b85cd614ad2f9d3da24c6b91e1fc04e10ff818222c4323cd043a59708bd35af0de84b004bf492fbc157d72907cd1e7ddf7082fc2a3563ef183

  • C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

    Filesize

    320KB

    MD5

    1ae43cc09627ff82d15527ea2693fd76

    SHA1

    c39ffa1a4b80c29fa1f5caed3e7d091253266c66

    SHA256

    b63980c9d592a6d0d8521f74bd4c6f7cc4ae5f8c3320d2bd63764c56648ac45f

    SHA512

    21945e4e2fad3ee2b2a19d19bbbc1ada832c33a0d3bf499d6ac8f093b39021323ea0f7df3d54167a3456cbaf01ff126a6e6abbe17dd4eb8d5a24ca000888c271

  • C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

    Filesize

    256KB

    MD5

    eca0c37eee65c31b869788d5d0bf00cd

    SHA1

    33a5c0cd2f0a7296a5c0169699ed8e065b57e5e8

    SHA256

    1d2b7bd4ddd99d627d5111252baadf028dc9910cf414892867502e5951de962e

    SHA512

    5f302da7772fca0a6d03ffd8732850f526acf5fcc33e189d2d906a33101454d970d5cca2f829a006d15c4a857341d72c7876cb2e7af84ada4f158695aba5a4dc

  • memory/656-9-0x0000000000400000-0x000000000393A000-memory.dmp

    Filesize

    53.2MB

  • memory/1596-7-0x0000000000400000-0x0000000000405000-memory.dmp

    Filesize

    20KB

  • memory/1596-53-0x0000000000400000-0x0000000000405000-memory.dmp

    Filesize

    20KB

  • memory/2124-46-0x0000000061440000-0x000000006156B000-memory.dmp

    Filesize

    1.2MB

  • memory/2124-59-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/2124-44-0x0000000070800000-0x00000000708BC000-memory.dmp

    Filesize

    752KB

  • memory/2124-47-0x0000000000F40000-0x00000000027F5000-memory.dmp

    Filesize

    24.7MB

  • memory/2124-48-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/2124-43-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/2124-54-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/2124-45-0x0000000074830000-0x00000000748C8000-memory.dmp

    Filesize

    608KB

  • memory/2124-64-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/2124-69-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/2124-79-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/2124-84-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/2124-89-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/2124-94-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/2124-99-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/2124-104-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB