Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    293s
  • max time network
    297s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-ja
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-jalocale:ja-jpos:windows10-2004-x64systemwindows
  • submitted
    24/02/2024, 02:30

General

  • Target

    batexe.exe

  • Size

    9.4MB

  • MD5

    cdc9eacffc6d2bf43153815043064427

  • SHA1

    d05101f265f6ea87e18793ab0071f5c99edf363f

  • SHA256

    73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

  • SHA512

    fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6

  • SSDEEP

    196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv

Score
7/10
upx

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\batexe.exe
    "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1080
    • C:\Users\Admin\AppData\Local\Temp\60AE.tmp\b2e.exe
      "C:\Users\Admin\AppData\Local\Temp\60AE.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\60AE.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4584
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\64E4.tmp\batchfile.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2624
        • C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
          cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5104

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\60AE.tmp\b2e.exe

    Filesize

    20.8MB

    MD5

    3656cdd24fe8d858dbea6ad35ed1aa4d

    SHA1

    38e617f43eaa351fc3d6b6d9c5e2de64cf1c349c

    SHA256

    aaf591fe3cfb8a28f823823aa231110ed4cfe1148ff61bcc22b7bf1e447e1913

    SHA512

    6b7b83702fb2d20f29e67af653b988cb2d6c1246858ede6870c4ed99f8f623405760f419f336bd19d325286003a630dd5f87b954e2080ad68e485f899e9df21d

  • C:\Users\Admin\AppData\Local\Temp\60AE.tmp\b2e.exe

    Filesize

    6.2MB

    MD5

    cb3b91bd49e6c66264df58a457aee5b6

    SHA1

    49ac38634b6c37e933b4e4d2d5bb3a45d84f4831

    SHA256

    673765df4ba9aa93519966cbc6191951a7bf7a7222ee3fb2b52c9d2d968dcd3b

    SHA512

    c60398ed8d49b404a207f1033f5cee25107e8f4811ab7fc2569f0e4503013ad9683a2fb11844868281053e4d7036b5618926af81147d7678538969c9fabe7c7d

  • C:\Users\Admin\AppData\Local\Temp\60AE.tmp\b2e.exe

    Filesize

    1.5MB

    MD5

    7d14be94fb33362c9892d3916aff105a

    SHA1

    88cc3849f4ca89ca55ae3300fe8ea8fa572af333

    SHA256

    e50c5c90cf07bb03e60c2d419fce016ef106f8f2a585cd3ed97d3e21d29ddda2

    SHA512

    75a8bbedd44e83110d737af1e33cc2afdea3b59a024c2c164e3425b28525380abf2c9a33477476a84db14b57cd857d30ecec1fbedad481440c8ba7c30becc1ce

  • C:\Users\Admin\AppData\Local\Temp\64E4.tmp\batchfile.bat

    Filesize

    136B

    MD5

    8ea7ac72a10251ecfb42ef4a88bd330a

    SHA1

    c30f6af73a42c0cc89bd20fe95f9159d6f0756c5

    SHA256

    65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9

    SHA512

    a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0

  • C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

    Filesize

    1.9MB

    MD5

    8866074112321282ac5b2de1bb28aa94

    SHA1

    a365ace945abc5541060addaa6f606f140809ddc

    SHA256

    67ae918b9b137330f401f9f6c1fac00e5e9af2222922cc21c97a36b0f175b198

    SHA512

    96e1023f019efd97e5ce78046e2209ca327e260823f06e4a03cb18e6f56e12d6d3bac6d4cb32fa2d95d2153cd773ab689f02d0d4f4172e275c53eee5c59aae37

  • C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

    Filesize

    1.7MB

    MD5

    30fb8573aeb382e4a26d67d665524fd5

    SHA1

    0843e97a461319571ebeeb414779d9094f9dc3d5

    SHA256

    a7b4dc9035bd6e2d2c0a2c90edd3f9c14f8e833f443aa20d95d0589785f81102

    SHA512

    f16fee3b4167912e68d0c25e3cbde54004ba148ed968170e1611bc2cf41f33d128277cab391d990ea406f382d613e507527258459fe330234ebd0783d38ad3cc

  • C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

    Filesize

    836KB

    MD5

    aeab40ed9a8e627ea7cefc1f5cf9bf7a

    SHA1

    5e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8

    SHA256

    218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9

    SHA512

    c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8

  • C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

    Filesize

    1.2MB

    MD5

    7cf672bee2afba2dcd0c031ff985958e

    SHA1

    6b82a205db080ffdcb4a4470fce85a14413f3217

    SHA256

    c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05

    SHA512

    3e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5

  • C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

    Filesize

    2.1MB

    MD5

    e873971e7050b5726536cc219ad5cae9

    SHA1

    ad67cfc9d2dd208a72d6b636726c490887a5402d

    SHA256

    cd2702b120bcb8ffd5f592d06eaf6c2b01b9fca893f9f6b30b95b709e7aedc86

    SHA512

    0f83cc77408cd811eb7c91e0201ff67c3b392ed88c362c8d9b77aae9ea68119de9f6f0dd19b7ccaaf61c038622852b3bbbcdb202cc30beb440cd01bb0fff2b3f

  • C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

    Filesize

    2.0MB

    MD5

    101218d0f72a9f04c06f50a7a4ab79f6

    SHA1

    8a7264e3e299c55e87993379a5dd4c14a0b7deee

    SHA256

    77348c208c45cf6eb4aa8cf1d9f879d5d17c0ba6f67d1c2f7d384b61545bc4fb

    SHA512

    1b2cd49b7c98eeea30c2ce2a4f3416153fcf7d82b1d753d6ff9aa6819e7974d5729c086713bb808863e57769d5cb8194ed35ff218a529e37ab2e2c8fbd54ee98

  • C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

    Filesize

    2.0MB

    MD5

    abfc66ece62dfce3f0461eec130be752

    SHA1

    0f27111e07fec92a51a77b567bbeae873abeb1c3

    SHA256

    4ce37d384f5e5a8b8f14bd8c24fd2a37cd9223c0f1036ff73cc541ca1e6f2195

    SHA512

    68d4791dfd50de15de58d66527643005c0ebfb79d8ba43bf4371f267fd21c31a8c9231a4d2c0e107556d68482031a84938e046267e245a18a2d4f5a8c00bf1ee

  • C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

    Filesize

    606KB

    MD5

    585efec1bc1d4d916a4402c9875dff75

    SHA1

    d209613666ccac9d0ddab29a3bc59aa00a0968fa

    SHA256

    2f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232

    SHA512

    b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770

  • memory/1080-9-0x0000000000400000-0x000000000393A000-memory.dmp

    Filesize

    53.2MB

  • memory/4584-53-0x0000000000400000-0x0000000000405000-memory.dmp

    Filesize

    20KB

  • memory/4584-7-0x0000000000400000-0x0000000000405000-memory.dmp

    Filesize

    20KB

  • memory/5104-43-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/5104-45-0x0000000061440000-0x000000006156B000-memory.dmp

    Filesize

    1.2MB

  • memory/5104-46-0x0000000060AE0000-0x0000000060B78000-memory.dmp

    Filesize

    608KB

  • memory/5104-47-0x0000000000F40000-0x00000000027F5000-memory.dmp

    Filesize

    24.7MB

  • memory/5104-48-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/5104-44-0x0000000070800000-0x00000000708BC000-memory.dmp

    Filesize

    752KB

  • memory/5104-54-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/5104-59-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/5104-64-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/5104-74-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/5104-79-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/5104-84-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/5104-94-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/5104-104-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB