Malware

SHIPSHAPE

SHIPSHAPE is a Windows malware family identified in ATT&CK as S0028. It has been associated with persistence through Windows autostart mechanisms, including Registry Run keys and Startup-folder shortcut modification. Reported behavior includes creating a shortcut in the Startup folder so the malware executes at user logon, and using Registry-based boot or logon autostart execution to survive reboots. SHIPSHAPE has also been documented as replicating through removable media, indicating propagation via USB or similar devices. Based on the available facts, SHIPSHAPE is best characterized by its persistence and removable-media replication behavior on Windows systems; additional functionality, operator attribution, and sector targeting are not established with high confidence from the available information.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

4 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1091Replication Through Removable MediaEvidence1

Persistence

3 techniques

T1547Boot or Logon Autostart ExecutionEvidence1

C:\Users\[Username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

T1547.001Registry Run Keys / Startup FolderEvidence7

ADVSTORESHELL achieves persistence by adding itself to the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key... APT28 has deployed malware that has copied itself to the startup directory for persistence... FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.

T1547.009Shortcut ModificationEvidence2

Adversaries may create or modify shortcuts that can execute a program during system boot or user login. Adversaries may abuse shortcuts in the startup folder to execute their tools and achieve persistence.

Privilege Escalation

3 techniques

T1547Boot or Logon Autostart ExecutionEvidence1

T1547.001Registry Run Keys / Startup FolderEvidence7

T1547.009Shortcut ModificationEvidence2

Lateral Movement

1 technique

T1091Replication Through Removable MediaEvidence1

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

mitre attack websiteNews

Oct 21, 2021

Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Sub-technique T1547.001 - Enterprise | MITRE ATT&CK®

Malware that establishes persistence by creating a shortcut in the Startup folder.

mitre attack websiteNews

Jan 1, 2021

Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Sub-technique T1547.001 - Enterprise | MITRE ATT&CK®

Backdoor malware that persists by creating a Startup-folder shortcut.

mitre attack websiteNews

May 20, 2015

APT30, Group G0013 | MITRE ATT&CK®

Malware that establishes persistence through registry run keys and shortcut modification and can replicate via removable media.

mitre attack websiteNews

May 20, 2015

Boot or Logon Autostart Execution: Shortcut Modification, Sub-technique T1547.009 - Enterprise | MITRE ATT&CK®

Achieves persistence by creating a shortcut in the Startup folder.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping4

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

SHIPSHAPE