Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    300s
  • max time network
    302s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-ja
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-jalocale:ja-jpos:windows10-2004-x64systemwindows
  • submitted
    23/02/2024, 19:12

General

  • Target

    batexe.exe

  • Size

    9.4MB

  • MD5

    cdc9eacffc6d2bf43153815043064427

  • SHA1

    d05101f265f6ea87e18793ab0071f5c99edf363f

  • SHA256

    73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

  • SHA512

    fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6

  • SSDEEP

    196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv

Score
7/10
upx

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\batexe.exe
    "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:5588
    • C:\Users\Admin\AppData\Local\Temp\540B.tmp\b2e.exe
      "C:\Users\Admin\AppData\Local\Temp\540B.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\540B.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:5732
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\569C.tmp\batchfile.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4672
        • C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
          cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4844

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\540B.tmp\b2e.exe

    Filesize

    1.7MB

    MD5

    4b0993a8402d203d54b8b8f303c43222

    SHA1

    cc8468848fc30befadd653684906bee50520f974

    SHA256

    036e3fbc807c9330130c0683f7327aca646c2c3d53c50d1123992314980bcf2e

    SHA512

    e606c52967da89c194ef854da22d98277949d071a178a87c3948375d05c090dc3ece27239fb8d429582fcd4d0c60913d052caf3c885065828f81506df0b4477e

  • C:\Users\Admin\AppData\Local\Temp\540B.tmp\b2e.exe

    Filesize

    1.1MB

    MD5

    f5ecee5947c07d97f6389751b91926b2

    SHA1

    b7b421b8b5fc64675c896bb554ebeec2a528b099

    SHA256

    8d81b43fba36fd00d7dd8d9a6813b258509f5f58234ba4eb6763ad8d8d5e0218

    SHA512

    f08baef426951a00d288ba86ba5e68d8c9b2d37768841ee137858a050b7d2e0d533d31152ca6953dc4dc1e403149aa1fa528d876cf8f760c4ec6e84e4261c0fa

  • C:\Users\Admin\AppData\Local\Temp\540B.tmp\b2e.exe

    Filesize

    1.1MB

    MD5

    4f304b41d278002b12d18ff7b5d12908

    SHA1

    a5d311f567bac410002690a7e0991b4a38631d69

    SHA256

    7328c0c78663764f893ef864042b8e1408fa311cd9d70fdb8986ccd3bf4a83dc

    SHA512

    71dd32fb655930cdc7d48bfd107abe28c30c7df3dd66d9643861a7470cb72d00bd2b8dfe16de53343802c5c1d53a97f97bab41e9f2b460fb9fc86ab3d8ac51e5

  • C:\Users\Admin\AppData\Local\Temp\569C.tmp\batchfile.bat

    Filesize

    136B

    MD5

    8ea7ac72a10251ecfb42ef4a88bd330a

    SHA1

    c30f6af73a42c0cc89bd20fe95f9159d6f0756c5

    SHA256

    65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9

    SHA512

    a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0

  • C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

    Filesize

    1.8MB

    MD5

    138f771fae40171991ac047969e8c65a

    SHA1

    ac2ff6705eb922dc48c5a4f7e9bbce82923865fd

    SHA256

    e46603ab6665d419695c51c844febddff82a17f950137cd44a0289252950e9c2

    SHA512

    1f436b1694e31b590ced707685a205a69093915e2b41c2309a6dde325d8c442dbdfbfff077a6c017b52cec68ab5dbd7c3e585da31357bf5d2ce97805fd6bc891

  • C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

    Filesize

    1.4MB

    MD5

    6386552e7078588fdab3dcbb123c1dbe

    SHA1

    7ebcea87a42a52cf623c106a9992433fb7fae04c

    SHA256

    5c63b678310279ed4dad2b1f8b89cbb8a413c163b23145ee8ca3451877b54f95

    SHA512

    15a8a31dce0c0cec41a1c8778697bed82e0930060b476b0d1f3290ada166ecd10a60bfb0d1c72c234496cbd68477ee9ae2402403293d1c4e9a742804a26fdad1

  • C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

    Filesize

    836KB

    MD5

    aeab40ed9a8e627ea7cefc1f5cf9bf7a

    SHA1

    5e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8

    SHA256

    218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9

    SHA512

    c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8

  • C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

    Filesize

    1.2MB

    MD5

    7cf672bee2afba2dcd0c031ff985958e

    SHA1

    6b82a205db080ffdcb4a4470fce85a14413f3217

    SHA256

    c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05

    SHA512

    3e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5

  • C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

    Filesize

    2.1MB

    MD5

    589f2b8655969f4a090cd0c42b7ad18d

    SHA1

    fefe8f339ea849dab6a652527f6e2a5371847f2b

    SHA256

    a0f6686ab42e088b8968e0e4671854d693b2f30d896dad5d225e694b80ff2595

    SHA512

    eb1bf309b842500484383a10f359a1a2268c04947cf16bc0bba8e793ddc20e698f55f544fffa461883cffd9b7e58dda044c39523e95fae8074509d6ed6c11d98

  • C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

    Filesize

    1.5MB

    MD5

    1c9a7ab6d494667442e6ebab7ee86a91

    SHA1

    56e3f89dd5d8d2fe7489b8764a070004da5ab29e

    SHA256

    85aaec64130145900c7951a3a602767dbd54d66301ca0b816d82744a0d4a1bf2

    SHA512

    9e1d1c4c8f1ce2e2124af48e1062ab5506e981218649c00f935a4fbc8a5e43dd73547237bcc6fb40d325337107f7e79a8088b9f289d4d8f8d4271d337bc0d2fa

  • C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

    Filesize

    1.5MB

    MD5

    195f3050d87cadbdf8947539d1a82682

    SHA1

    152900aa1c7ea4caf1fc0908b9148d906259e675

    SHA256

    12c61d12e062afa70c82d4105c2d5e383c3f43b555051f0445f9db37b148e58c

    SHA512

    77330745f20ceb9cbee4d24224ce3fca62a09615b27443bcff87247e3a15045b28878b9a002bfca0d9e6b1daa1c9322b8363a2df0aea93a63ab29b44bdb9bb77

  • C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

    Filesize

    606KB

    MD5

    585efec1bc1d4d916a4402c9875dff75

    SHA1

    d209613666ccac9d0ddab29a3bc59aa00a0968fa

    SHA256

    2f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232

    SHA512

    b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770

  • memory/4844-43-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/4844-54-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/4844-104-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/4844-45-0x0000000070800000-0x00000000708BC000-memory.dmp

    Filesize

    752KB

  • memory/4844-44-0x0000000061440000-0x000000006156B000-memory.dmp

    Filesize

    1.2MB

  • memory/4844-46-0x000000006D560000-0x000000006D5F8000-memory.dmp

    Filesize

    608KB

  • memory/4844-47-0x0000000000F40000-0x00000000027F5000-memory.dmp

    Filesize

    24.7MB

  • memory/4844-48-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/4844-99-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/4844-84-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/4844-59-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/4844-64-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/4844-69-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/4844-74-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/4844-79-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/5588-8-0x0000000000400000-0x000000000393A000-memory.dmp

    Filesize

    53.2MB

  • memory/5732-53-0x0000000000400000-0x0000000000405000-memory.dmp

    Filesize

    20KB

  • memory/5732-9-0x0000000000400000-0x0000000000405000-memory.dmp

    Filesize

    20KB