a22f393576c3c8fa3ade88102fa98dfc93097d15b4c453ef676f6daaefffa592

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 03:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AutoSettings/Disable_NumLock.bat
Size

1KB
MD5

a89fe1724241c3e26f242c4f60a1cef6
SHA1

a350cc504eec2b7351d436c59ae7405a3b8e9785
SHA256

903408ca653d38c982459e46d80bc2ac0f9774c2ec6e6066218960854d1a7e37
SHA512

1757db7507600e04ee93f24155470c3cffedc5c0b08af196c3b38a8292865cd6435774ed71684f07fa0aa16e2b803a5ded9a271e5f028a50fb3a2e24f2602a96

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral4/memory/3088-0-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral4/memory/3088-1-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral4/memory/1588-2-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral4/memory/1460-3-0x0000000000400000-0x0000000000416000-memory.dmp	upx

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-20\Control Panel\Keyboard\InitialKeyboardIndicators = "2147483648"	reg.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Keyboard	reg.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Keyboard\InitialKeyboardIndicators = "2147483648"	reg.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Keyboard	reg.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Keyboard\InitialKeyboardIndicators = "2147483648"	reg.exe
Key created	\REGISTRY\USER\S-1-5-19\Control Panel\Keyboard	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\Control Panel\Keyboard\InitialKeyboardIndicators = "2147483648"	reg.exe
Key created	\REGISTRY\USER\S-1-5-20\Control Panel\Keyboard	reg.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 4740	1772	cmd.exe	14
PID 1772 wrote to memory of 4740	1772	cmd.exe	14
PID 1772 wrote to memory of 4952	1772	cmd.exe	15
PID 1772 wrote to memory of 4952	1772	cmd.exe	15
PID 1772 wrote to memory of 3088	1772	cmd.exe	17
PID 1772 wrote to memory of 3088	1772	cmd.exe	17
PID 1772 wrote to memory of 3088	1772	cmd.exe	17
PID 1772 wrote to memory of 1672	1772	cmd.exe	65
PID 1772 wrote to memory of 1672	1772	cmd.exe	65
PID 1772 wrote to memory of 748	1772	cmd.exe	72
PID 1772 wrote to memory of 748	1772	cmd.exe	72
PID 1772 wrote to memory of 4248	1772	cmd.exe	71
PID 1772 wrote to memory of 4248	1772	cmd.exe	71
PID 1772 wrote to memory of 2304	1772	cmd.exe	70
PID 1772 wrote to memory of 2304	1772	cmd.exe	70
PID 1772 wrote to memory of 4640	1772	cmd.exe	69
PID 1772 wrote to memory of 4640	1772	cmd.exe	69
PID 1772 wrote to memory of 1588	1772	cmd.exe	68
PID 1772 wrote to memory of 1588	1772	cmd.exe	68
PID 1772 wrote to memory of 1588	1772	cmd.exe	68
PID 1772 wrote to memory of 1460	1772	cmd.exe	67
PID 1772 wrote to memory of 1460	1772	cmd.exe	67
PID 1772 wrote to memory of 1460	1772	cmd.exe	67

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\AutoSettings\Disable_NumLock.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:4740
- C:\Windows\system32\reg.exe
  reg query "HKU\S-1-5-19\Environment"
  2⤵
  PID:4952
- C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\cecho.exe
  "C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\cecho.exe" {0b} --- Выключаем "NumLock" у всех, в том числе на Логин-Скрине (по умолчанию) --- {\n #}
  2⤵
  PID:3088
- C:\Windows\system32\reg.exe
  reg add "HKEY_USERS\.DEFAULT\Control Panel\Keyboard" /v "InitialKeyboardIndicators" /t REG_SZ /d 2147483648 /f
  2⤵
  - Modifies data under HKEY_USERS
  PID:1672
- C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\cecho.exe
  "C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\cecho.exe" {0a}Перезагрузите компьютер!!! {\n #}
  2⤵
  PID:1460
- C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\cecho.exe
  "C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\cecho.exe" {0a}Исправление выполнено {\n #}
  2⤵
  PID:1588
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Keyboard" /v "InitialKeyboardIndicators" /t REG_SZ /d 2147483648 /f
  2⤵
  PID:4640
- C:\Windows\system32\reg.exe
  reg add "HKEY_USERS\S-1-5-20\Control Panel\Keyboard" /v "InitialKeyboardIndicators" /t REG_SZ /d 2147483648 /f
  2⤵
  - Modifies data under HKEY_USERS
  PID:2304
- C:\Windows\system32\reg.exe
  reg add "HKEY_USERS\S-1-5-19\Control Panel\Keyboard" /v "InitialKeyboardIndicators" /t REG_SZ /d 2147483648 /f
  2⤵
  - Modifies data under HKEY_USERS
  PID:4248
- C:\Windows\system32\reg.exe
  reg add "HKEY_USERS\S-1-5-18\Control Panel\Keyboard" /v "InitialKeyboardIndicators" /t REG_SZ /d 2147483648 /f
  2⤵
  - Modifies data under HKEY_USERS
  PID:748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1460-3-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1588-2-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/3088-0-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/3088-1-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads