Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    288s
  • max time network
    298s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-ja
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-jalocale:ja-jpos:windows10-2004-x64systemwindows
  • submitted
    24/02/2024, 13:05

General

  • Target

    batexe.exe

  • Size

    9.4MB

  • MD5

    cdc9eacffc6d2bf43153815043064427

  • SHA1

    d05101f265f6ea87e18793ab0071f5c99edf363f

  • SHA256

    73cc2881ef511788661955a624db9baf40ac16bc63266c5c3bb3fe62b4856d72

  • SHA512

    fc6945957e160bf7059c936c329aae438e6c1521e5e43a8434f58058230d89e818eb6ff80331a4b952dbb600b8cc134ecba54e5641bf549723c98f85e993fde6

  • SSDEEP

    196608:ERAefrn9wcsTRAJgwusnWpV3h9XxSeEGaT+TKkGzySdUkI56kBIyky:E5Tn9YVwdnWLXxkvLlzkuv

Score
7/10
upx

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\batexe.exe
    "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2796
    • C:\Users\Admin\AppData\Local\Temp\8F4F.tmp\b2e.exe
      "C:\Users\Admin\AppData\Local\Temp\8F4F.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\8F4F.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\batexe.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4932
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9923.tmp\batchfile.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:388
        • C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe
          cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.sea.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 3
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3708

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\8F4F.tmp\b2e.exe

    Filesize

    32.3MB

    MD5

    815a883bcb34c1016d80990f97c19602

    SHA1

    104de740a60af54c93f52a2a9364becef046ca83

    SHA256

    19b76c71a211b8eb61fa4cf183fa63d2deebe1a44096c171fad8e45b238c74e3

    SHA512

    74fc09a8a12d7f458d73fbca734c6366665d0b15a54f20c89d405f11585e168ff43c47e52cc77059c4aad33fd7b6aef394a4c7e974555d2a87428aaf2dcf0dab

  • C:\Users\Admin\AppData\Local\Temp\8F4F.tmp\b2e.exe

    Filesize

    3.8MB

    MD5

    8782954c8b6aac082ecc8b96cb0fa380

    SHA1

    2fe2dfb712df083d04ef662151f7a323078cdbaf

    SHA256

    472a521487323090d233b2931089d485be932bb7b1df7cc096c8b498ff04a73b

    SHA512

    d8a809cff6a7fa2b0762724eabda592db73e20311c184937574671be8cdff033ed4b9886992aa225aa923449c5a5a7949bcd5194ac26972001b95349506beb31

  • C:\Users\Admin\AppData\Local\Temp\8F4F.tmp\b2e.exe

    Filesize

    4.5MB

    MD5

    15fe3b622166db04c27b3fcb5ceffb24

    SHA1

    a794100da106418811d553ba4bf0827f5db2a1ad

    SHA256

    5607b3451e0f482583e6ecab18a8220ca3adda2ae9cf33d4de26b2ad52702343

    SHA512

    a1568593ceba6c60da1fda21ae76e2c154db826f85163663a2aa02cd70ffd4dc1577060fe320bf0cf07bdf83945cd52a57f417fed60a730b7c2a38569404f2c4

  • C:\Users\Admin\AppData\Local\Temp\9923.tmp\batchfile.bat

    Filesize

    136B

    MD5

    8ea7ac72a10251ecfb42ef4a88bd330a

    SHA1

    c30f6af73a42c0cc89bd20fe95f9159d6f0756c5

    SHA256

    65e2674fc9b921a76deaf3740603359794c04e059e8937ab36eb931d65f40ec9

    SHA512

    a908979d588625aa24eb81238d07d88a56be5388e1265ebd2fe09889ed807aa9a4af77107e72a843c31acadbe06db0d7f6f6a3c95fb481a71e549e8eb74c2ff0

  • C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

    Filesize

    1.8MB

    MD5

    6a119a1a3238dd3b96b0ca27529e1cb2

    SHA1

    d3ecdcfa3c3f70a0ce249e8210a4588b7a984d61

    SHA256

    679770ac6b8817004acfacd8eaa3db50ce3fbd34f039d45872f588f0182c021b

    SHA512

    0b4b49312889f2795399eb93f662a1af2a479890a2abc4f6279107b205f9fb674005d0c5280eac0a00c797eafda1b11f19b98f84c6edd385d6102e49e5496357

  • C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.exe

    Filesize

    384KB

    MD5

    eb8ea4d2595402528f73410e2c8651ed

    SHA1

    23abb385032a9317d00c826eb21e0fe6fc802c50

    SHA256

    fc3c5c1787c58c465ea47ab132afc59d209b1f7d319ae80a7913ed5c39157017

    SHA512

    7f4485a662859bdec898bb4f9675c8a834ab570ae7f4df2b6e95a9f5ab45f8fba612d04f0edfe22dc4bdcd3011af0536ed200731262056cd7bec332ce4b18573

  • C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

    Filesize

    192KB

    MD5

    8c933a591c8d0c1fec1da393587d09c9

    SHA1

    65f4672c0e0a6a20436fbaba57dac8c1a5fc5e51

    SHA256

    c22ca427c0e65a0bb3e011afeba5244dd5a6e9c0327cfc7d15c4875083206b10

    SHA512

    96b84267fd9b7c5587c74e30d5f647acabbf6b09feac19784de4e046619fcae78f2e6aa98eb7f06fe13197bfd9207b9044b09d5248480421ceb23cb01d511881

  • C:\Users\Admin\AppData\Local\Temp\libcurl-4.dll

    Filesize

    320KB

    MD5

    c911df8bf8c66277e14360319b0b93b7

    SHA1

    598c59c0e7cbecb788ee676db218dc0faaa39bdc

    SHA256

    4c53941f04ddeae2179047a1c7f8c7f7f46af0f08c424ab66d61f2316f2ee77d

    SHA512

    13aeae87ee52f22d1c928c99c66e116254cde630c09f90b146962fa61276af13fef653b7a66184d00d614f0379750e641c2e62326ebb5588ca632e56c935d77c

  • C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll

    Filesize

    192KB

    MD5

    d73b46cd072058efc54c4b3885f47e13

    SHA1

    84771c2c4f5736ac08497737cba2a8634d9e9178

    SHA256

    3f62bb203bdcca4e489401897e0558cf33ad6fe890a9987f90f5c3894b965b34

    SHA512

    519c91b5b5a82c5a755d7d4295c040cfb6b0f029eb088a6bfc428db11e30d7f954ea6fd6de9b083d1781e1142737ea39572866ab5f669848dff7ef0ce34c79c7

  • C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

    Filesize

    192KB

    MD5

    62069650d62f76a4cdf0e81172d99993

    SHA1

    3b20ec5b4a4320ee15b0f7b9715a9ab90f68346e

    SHA256

    779a5590c667d9a704b79e159259c0646737394fd66a9c0b12d13f9445ca091c

    SHA512

    ae1954a84fb7543465e77a4cd5cc1bdeee0cf848592958633e6c51702b42131daae64c302d5c9537c59a9b3ba9498e5bf913d1f6f757ccdb8c4183b33224852b

  • C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll

    Filesize

    128KB

    MD5

    9746d1ac79c8b499d8b2224394581fa7

    SHA1

    36b1985eabfd8131ad9f2b7f69c903a3fce67629

    SHA256

    77941fbe96e0c797e6cf5419ee32bd3fcee69629cba37750146656a660c37182

    SHA512

    61a6174e2aced5b85cd614ad2f9d3da24c6b91e1fc04e10ff818222c4323cd043a59708bd35af0de84b004bf492fbc157d72907cd1e7ddf7082fc2a3563ef183

  • C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

    Filesize

    384KB

    MD5

    eec15153c344f43f1919cb379b9ee2f9

    SHA1

    3e4a09390ac885ea2797209603bcfa1ec6ff0cc6

    SHA256

    4e4d7ecae87e8e656c61af89ef17146baf33fbf09ffbde6ae971d04e8e8f9222

    SHA512

    7cdf3552341d14979838f8fedf9ac63482152f193ab8f7e0af281ec50b2a43312d78c0e22e79989818c5041538fa69769350e1e6cf0789a165be1eb11ee29908

  • C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll

    Filesize

    115KB

    MD5

    e2e508b572df413734d3e9a7bb65ccd5

    SHA1

    d41f207b7da438e5f9838318761e584b80f44e50

    SHA256

    6a0d67e46881de18a7b01b0102f66aa7c7a1433888da350f2e4bf217e8b8cf0d

    SHA512

    7f1858c386be4a26946451640654457d71bf12d6bf65031c5b8cf0dba4ddb75dd1afe4282a63300659628684f7a4b171d2e8b808189d865eec97a716d8261b2d

  • memory/2796-8-0x0000000000400000-0x000000000393A000-memory.dmp

    Filesize

    53.2MB

  • memory/3708-48-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/3708-69-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/3708-44-0x0000000070800000-0x00000000708BC000-memory.dmp

    Filesize

    752KB

  • memory/3708-45-0x0000000061440000-0x000000006156B000-memory.dmp

    Filesize

    1.2MB

  • memory/3708-46-0x00000000609A0000-0x0000000060A38000-memory.dmp

    Filesize

    608KB

  • memory/3708-47-0x0000000001010000-0x00000000028C5000-memory.dmp

    Filesize

    24.7MB

  • memory/3708-99-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/3708-89-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/3708-59-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/3708-64-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/3708-43-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/3708-79-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/3708-84-0x0000000000400000-0x0000000000667000-memory.dmp

    Filesize

    2.4MB

  • memory/4932-53-0x0000000000400000-0x0000000000405000-memory.dmp

    Filesize

    20KB

  • memory/4932-9-0x0000000000400000-0x0000000000405000-memory.dmp

    Filesize

    20KB