f713809dea449815a501976935a6b8ef96ba3921c91989994865ab1ee6c4726f

General

Target

f713809dea449815a501976935a6b8ef96ba3921c91989994865ab1ee6c4726f.exe
Size

184KB
MD5

23200d05e67026e395f5508e81a6f261
SHA1

84c0011593696bc6cb3fcfe57edf5eb4fbf8b4a5
SHA256

f713809dea449815a501976935a6b8ef96ba3921c91989994865ab1ee6c4726f
SHA512

92ca46a53238d28c98c6b16ac075d1c81534408e0f10a04de8195c6e26ee735e5af2d78b05357fac0d58c9b452e0d670ed60d3040fd29fb95a40cea56e47e5d6
SSDEEP

1536:Eq37dumBoEHkqWke1C4kqUDA2n6J8U6FjSHyI9Ng3Xmx:n35PBoEW1TBUP6n6FWlXi

Score

10^/10

evasion upx

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

f713809dea449815a501976935a6b8ef96ba3921c91989994865ab1ee6c4726f.exestartup.bat

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	f713809dea449815a501976935a6b8ef96ba3921c91989994865ab1ee6c4726f.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	startup.bat

Executes dropped EXE 2 IoCs

Processes:

startup.batstartup.bat

pid process

1624 startup.bat
2628 startup.bat

pid	process
1624	startup.bat
2628	startup.bat

Loads dropped DLL 3 IoCs

Processes:

f713809dea449815a501976935a6b8ef96ba3921c91989994865ab1ee6c4726f.exestartup.bat

pid	process
2872	f713809dea449815a501976935a6b8ef96ba3921c91989994865ab1ee6c4726f.exe
2872	f713809dea449815a501976935a6b8ef96ba3921c91989994865ab1ee6c4726f.exe
1624	startup.bat

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2872-0-0x0000000000400000-0x000000000042E000-memory.dmp	upx
\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\startup.bat	upx
behavioral1/memory/2872-7-0x00000000003C0000-0x00000000003EE000-memory.dmp	upx
behavioral1/memory/2872-16-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2628-22-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/1624-23-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 36 IoCs

Processes:

startup.bat

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	startup.bat
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	startup.bat
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	startup.bat
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	startup.bat
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 5c003100000000000000000010005374617274204d656e750000420008000400efbe00000000000000002a000000000000000000000000000000000000000000000000005300740061007200740020004d0065006e00750000001a000000	startup.bat
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	startup.bat
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	startup.bat
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	startup.bat
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 520031000000000000000000100057696e646f7773003c0008000400efbe00000000000000002a00000000000000000000000000000000000000000000000000570069006e0064006f0077007300000016000000	startup.bat
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	startup.bat
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	startup.bat
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	startup.bat
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 560031000000000000000000100050726f6772616d7300003e0008000400efbe00000000000000002a00000000000000000000000000000000000000000000000000500072006f006700720061006d007300000018000000	startup.bat
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0	startup.bat
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	startup.bat
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 5e0031000000000000000000100050726f6772616d4461746100440008000400efbe00000000000000002a00000000000000000000000000000000000000000000000000500072006f006700720061006d00440061007400610000001a000000	startup.bat
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	startup.bat
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 = 520031000000000000000000120053746172747570003c0008000400efbe00000000000000002a000000000000000000000000000000000000000000000000005300740061007200740075007000000016000000	startup.bat
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0	startup.bat
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\MRUListEx = ffffffff	startup.bat
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 58003100000000000000000010004d6963726f736f667400400008000400efbe00000000000000002a000000000000000000000000000000000000000000000000004d006900630072006f0073006f0066007400000018000000	startup.bat
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	startup.bat
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	startup.bat
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	startup.bat
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	startup.bat
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	startup.bat
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	startup.bat
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	startup.bat
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	startup.bat
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_Classes\Local Settings	startup.bat
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	startup.bat
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	startup.bat
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	startup.bat
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\NodeSlot = "1"	startup.bat
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	startup.bat
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	startup.bat

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

f713809dea449815a501976935a6b8ef96ba3921c91989994865ab1ee6c4726f.exestartup.batstartup.bat

pid process

2872 f713809dea449815a501976935a6b8ef96ba3921c91989994865ab1ee6c4726f.exe
1624 startup.bat
2628 startup.bat

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

f713809dea449815a501976935a6b8ef96ba3921c91989994865ab1ee6c4726f.exestartup.bat

description	pid	process	target process
PID 2872 wrote to memory of 1624	2872	f713809dea449815a501976935a6b8ef96ba3921c91989994865ab1ee6c4726f.exe	startup.bat
PID 2872 wrote to memory of 1624	2872	f713809dea449815a501976935a6b8ef96ba3921c91989994865ab1ee6c4726f.exe	startup.bat
PID 2872 wrote to memory of 1624	2872	f713809dea449815a501976935a6b8ef96ba3921c91989994865ab1ee6c4726f.exe	startup.bat
PID 2872 wrote to memory of 1624	2872	f713809dea449815a501976935a6b8ef96ba3921c91989994865ab1ee6c4726f.exe	startup.bat
PID 1624 wrote to memory of 2628	1624	startup.bat	startup.bat
PID 1624 wrote to memory of 2628	1624	startup.bat	startup.bat
PID 1624 wrote to memory of 2628	1624	startup.bat	startup.bat
PID 1624 wrote to memory of 2628	1624	startup.bat	startup.bat

C:\Users\Admin\AppData\Local\Temp\f713809dea449815a501976935a6b8ef96ba3921c91989994865ab1ee6c4726f.exe
"C:\Users\Admin\AppData\Local\Temp\f713809dea449815a501976935a6b8ef96ba3921c91989994865ab1ee6c4726f.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\startup.bat
"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\startup.bat"
2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1624

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\startup.bat
"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\startup.bat"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2628

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\startup.bat
Filesize
184KB

MD5
23200d05e67026e395f5508e81a6f261

SHA1
84c0011593696bc6cb3fcfe57edf5eb4fbf8b4a5

SHA256
f713809dea449815a501976935a6b8ef96ba3921c91989994865ab1ee6c4726f

SHA512
92ca46a53238d28c98c6b16ac075d1c81534408e0f10a04de8195c6e26ee735e5af2d78b05357fac0d58c9b452e0d670ed60d3040fd29fb95a40cea56e47e5d6

Download Submit
memory/1624-23-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2628-22-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2872-0-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2872-7-0x00000000003C0000-0x00000000003EE000-memory.dmp

Filesize
184KB

Download
memory/2872-12-0x00000000003C0000-0x00000000003EE000-memory.dmp

Filesize
184KB

Download
memory/2872-16-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads