a80c25d09bfc8bc4affb8e394a7254574b7e7e39404404775382f005e6a067c6

General

Target

bat2exe.exe
Size

966KB
MD5

7a56c8b9ffdd23e6f7a2d0ee422e0eb7
SHA1

ada737e537318f5fb900865b6ecd5de9b8ae58f6
SHA256

a80c25d09bfc8bc4affb8e394a7254574b7e7e39404404775382f005e6a067c6
SHA512

ba4fc80b151e4a6b22a1601817f5a6bc2caa80ebb0762e8b8c6af571064bafc54d6d3029ca3f3d7d2e5a4aa1b5dd3bbcf5009bc95110680dcfd351f6bcf4cb20
SSDEEP

24576:MddFMz0EHPf4R9urwd1Hj+2mZ1j6wF320ujMw91SnA4eOm4Bd7x:Mdd6z0sau41D+xr3O4wiA424Bj

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1712835645-2080934712-2142796781-1000\Control Panel\International\Geo\Nation	bat2exe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	cscript.exe
Key created	\REGISTRY\USER\S-1-5-21-1712835645-2080934712-2142796781-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1712835645-2080934712-2142796781-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1712835645-2080934712-2142796781-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1712835645-2080934712-2142796781-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1712835645-2080934712-2142796781-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1712835645-2080934712-2142796781-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1712835645-2080934712-2142796781-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	cscript.exe
Key created	\REGISTRY\USER\S-1-5-21-1712835645-2080934712-2142796781-1000_Classes\Local Settings	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1712835645-2080934712-2142796781-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1712835645-2080934712-2142796781-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1712835645-2080934712-2142796781-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1712835645-2080934712-2142796781-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1712835645-2080934712-2142796781-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	cscript.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1712835645-2080934712-2142796781-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1712835645-2080934712-2142796781-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1712835645-2080934712-2142796781-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1712835645-2080934712-2142796781-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1712835645-2080934712-2142796781-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	cscript.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1712835645-2080934712-2142796781-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1712835645-2080934712-2142796781-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1712835645-2080934712-2142796781-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	NOTEPAD.EXE

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3932	NOTEPAD.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3932	NOTEPAD.EXE
3932	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 64 wrote to memory of 2020	64	bat2exe.exe	90
PID 64 wrote to memory of 2020	64	bat2exe.exe	90
PID 64 wrote to memory of 2020	64	bat2exe.exe	90
PID 2020 wrote to memory of 4064	2020	cmd.exe	94
PID 2020 wrote to memory of 4064	2020	cmd.exe	94
PID 2020 wrote to memory of 4064	2020	cmd.exe	94
PID 2020 wrote to memory of 1880	2020	cmd.exe	97
PID 2020 wrote to memory of 1880	2020	cmd.exe	97
PID 2020 wrote to memory of 1880	2020	cmd.exe	97
PID 1880 wrote to memory of 2404	1880	cmd.exe	96
PID 1880 wrote to memory of 2404	1880	cmd.exe	96
PID 1880 wrote to memory of 2404	1880	cmd.exe	96
PID 2020 wrote to memory of 3720	2020	cmd.exe	100
PID 2020 wrote to memory of 3720	2020	cmd.exe	100
PID 2020 wrote to memory of 3720	2020	cmd.exe	100
PID 2020 wrote to memory of 1800	2020	cmd.exe	101
PID 2020 wrote to memory of 1800	2020	cmd.exe	101
PID 2020 wrote to memory of 1800	2020	cmd.exe	101
PID 2020 wrote to memory of 4012	2020	cmd.exe	103
PID 2020 wrote to memory of 4012	2020	cmd.exe	103
PID 2020 wrote to memory of 4012	2020	cmd.exe	103
PID 4012 wrote to memory of 2360	4012	cmd.exe	102
PID 4012 wrote to memory of 2360	4012	cmd.exe	102
PID 4012 wrote to memory of 2360	4012	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\bat2exe.exe
"C:\Users\Admin\AppData\Local\Temp\bat2exe.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:64
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7zS3DC4.tmp\bat2exe.cmd" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Windows\SysWOW64\mode.com
    MODE 90,50
    3⤵
    PID:4064
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript //nologo bin\browse.vbs
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1880
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c dir /b /OD "C:\Users\Admin\Desktop\*.bat" "C:\Users\Admin\Desktop\*.cmd"
    3⤵
    PID:3720
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c dir /b /OD "C:\Users\Admin\Desktop\*.ico"
    3⤵
    PID:1800
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript //nologo bin\browse.vbs
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4012

C:\Windows\SysWOW64\cscript.exe
cscript //nologo bin\browse.vbs
1⤵
- Modifies registry class
PID:2404

C:\Windows\SysWOW64\cscript.exe
cscript //nologo bin\browse.vbs
1⤵
- Modifies registry class
PID:2360

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\g.txt
1⤵
- Modifies registry class
- Opens file in notepad (likely ransom note)
- Suspicious use of SetWindowsHookEx
PID:3932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS3DC4.tmp\bat2exe.cmd

Filesize
9KB

MD5
de17828363c64b86228226d8dd6b125c

SHA1
ac63e42e54a2bc36d0a1e3b8dcbb3a3d65dde8dd

SHA256
3d86572d4a0f14634dfb2b1ec7caed5a55d053c25b32d840bc2de0130cdbc3c7

SHA512
78a1b06ba57921abea492bd7de00d3285a8e04f38883cfa08cbad708344192f43b902d580d4856c7cf4ead0e982f1f0b12e95229925672f88581ebcf5fe7ca82

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3DC4.tmp\bin\browse.vbs

Filesize
928B

MD5
8580d8cab38506f200f4d935edcc19be

SHA1
02866d139fd8addedaef72521e245f713c5187b4

SHA256
cbaf396ff11d723e0fff497c6b7afedabe6975bcb32b7512058732911111ab15

SHA512
6875831af53a0dd9de1de23fd30703fc851f129078699cb0b2331c41d2fd66a98fe0eb09cff208890563bc627533b8de793bb06e44746588109d0156857887a1

Download Submit

Resubmissions

Analysis

Sharing