Analysis
-
max time kernel
13s -
max time network
69s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12/11/2024, 11:50
Static task
static1
Behavioral task
behavioral1
Sample
BatSD.exe
Resource
win10v2004-20241007-en
General
-
Target
BatSD.exe
-
Size
169KB
-
MD5
e625c07f89ae4fc9184ea7af37f7311e
-
SHA1
b1269be3072402fd9f8b7025e02345c54928f3d0
-
SHA256
71f419149200ada26a7497d8e8ce53d4e3e98bbf45fdaf6a962cdddfbbf368b7
-
SHA512
0f982fb5561d42984d325dbfd3f788cb702af0f5c72ca06c1d3cb640b7ff8d153e55c9a502532496ea9fe6db0b4e3053a4d90effee768cede9524a46c0c58f00
-
SSDEEP
3072:MaObYrSD4kjua2DH4xW+5GWp1icKAArDZz4N9GhbkrNEkQfH7YyIb:MaKMSD4YuaeEp0yN90QEff
Malware Config
Signatures
-
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Modifies system executable filetype association 2 TTPs 34 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\DefaultIcon reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\{8895b1c6-b41f-4c1c-a562-0d564250836f} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shellex\DropHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\DefaultIcon reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\Compatibility reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers\Compatibility reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shellex reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\DropHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\DropHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\PintoStartScreen reg.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" BatSD.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2608 timeout.exe -
Modifies registry class 64 IoCs
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0095-ABCDEFFEDCBA} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBC} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0365-ABCDEFFEDCBB} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0190-ABCDEFFEDCBA} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-DEC7-0000-0001-ABCDEFFEDCBA} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.hxh reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBB} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0040-ABCDEFFEDCBA}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0355-ABCDEFFEDCBC}\InprocServer32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DCA0ED3C-B95D-490f-9C60-0FF3726C789A} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7A213AA7-866F-414A-8C1A-275C7283A395} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2E3074F-6C3D-11D3-B653-00C04F79498E}\Instance reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0267-ABCDEFFEDCBA}\InprocServer32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0002088A-0000-0000-C000-000000000046} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000209DC-0000-0000-C000-000000000046} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.docm\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0174-ABCDEFFEDCBB}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0356-ABCDEFFEDCBC}\InprocServer32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00020879-0000-0000-C000-000000000046}\TypeLib reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0002449C-0000-0000-C000-000000000046}\TypeLib reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{03FB032F-31E3-4E6E-AA60-6EA9C726902C} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000244BF-0000-0000-C000-000000000046} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000C0367-0000-0000-C000-000000000046}\ProxyStubClsid32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{048EB43E-2059-422F-95E0-557DA96038AF}\ProgID reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A571F412-E3D2-4A32-BF42-1D3B2203FF17} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0184-ABCDEFFEDCBA}\InprocServer32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EAE50EB0-4A62-11CE-BED6-00AA00611080}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Extensions\ContractId\Windows.ComponentUI\PackageId\Microsoft.MicrosoftEdge_44.19041.1266.0_neutral__8wekyb3d8bbwe reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.xfdf\AcroExch.XFDFDoc reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0207-ABCDEFFEDCBC} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBA} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0182-ABCDEFFEDCBC} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0136-ABCDEFFEDCBC} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0361-ABCDEFFEDCBA} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FA6C507D-A9AF-4385-86C0-80115F0AE20B} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0323648F-FF62-48CC-A9DE-ABBDA1550CAA}\ProxyStubClsid32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.m3u\PersistentHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.thmx\ShellEx reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0017-ABCDEFFEDCBA}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0313-ABCDEFFEDCBA} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0348-ABCDEFFEDCBA} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\IE.AssocFile.SVG\DefaultIcon reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c04b329e-5823-4415-9c93-ba44688947b0}\InProcServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0363-ABCDEFFEDCBA}\InprocServer32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0002095D-0000-0000-C000-000000000046}\TypeLib reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0002098E-0000-0000-C000-000000000046}\ProxyStubClsid32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000209F7-0000-0000-C000-000000000046}\TypeLib reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{73720013-33A0-11E4-9B9A-00155D152105} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000244F1-0000-0000-C000-000000000046}\ProxyStubClsid32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0061-ABCDEFFEDCBC}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0113-ABCDEFFEDCBB} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0219-ABCDEFFEDCBC}\InprocServer32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\ExplorerCLSIDFlags\{2DCB8486-6A84-411A-98ED-7BC308A027A7} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00020922-0000-0000-C000-000000000046}\ProxyStubClsid32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0002094E-0000-0000-C000-000000000046}\TypeLib reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBB}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0032-ABCDEFFEDCBB}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0231-ABCDEFFEDCBC}\InprocServer32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C\SourceList\Media reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.jar reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.mlp reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.zoo reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0063-ABCDEFFEDCBC} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000C0314-0000-0000-C000-000000000046} reg.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1660 wrote to memory of 960 1660 BatSD.exe 84 PID 1660 wrote to memory of 960 1660 BatSD.exe 84 PID 960 wrote to memory of 2608 960 cmd.exe 93 PID 960 wrote to memory of 2608 960 cmd.exe 93 PID 960 wrote to memory of 4952 960 cmd.exe 95 PID 960 wrote to memory of 4952 960 cmd.exe 95 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\BatSD.exe"C:\Users\Admin\AppData\Local\Temp\BatSD.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\SYSTEM32\cmd.execmd /c BatSD.bat2⤵
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Windows\system32\timeout.exetimeout 1 /nobreak3⤵
- Delays execution with timeout.exe
PID:2608
-
-
C:\Windows\system32\reg.exereg delete HKEY_CLASSES_ROOT /f3⤵
- Modifies system executable filetype association
- Modifies registry class
PID:4952
-
-
C:\Windows\system32\reg.exereg delete HKEY_CURRENT_USER /f3⤵PID:1132
-
-
C:\Windows\system32\reg.exereg delete HKEY_LOCAL_MACHINE /f3⤵PID:3732
-
-
C:\Windows\system32\reg.exereg delete HKEY_USERS /f3⤵PID:4064
-
-
C:\Windows\system32\reg.exereg delete HKEY_CURRENT_CONFIG /f3⤵PID:4568
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
584B
MD51fb41ca3337bd87c7a613fb7e6737f3a
SHA1a2eae147407bc601b496678e331cca9f687f5a6c
SHA2564d6989bba0c7380e1afa92097485a32e629e996e660a2a7c565d6a062433c329
SHA512989dd073d8bcc3fda21ef9c24263a936505a531e2a944160b945aa1441b94695d6ed4da86b30406937fd37135284369ec096c57521d544a76912e6364c47f3dc