{
  "family": "startp",
  "sample_count": 1,
  "category": "trojan",
  "description": "<h3>Executive Summary</h3>\nStartp is a specialized Trojan component primarily designed to manipulate the Windows boot process and startup configuration. Its singular goal is to establish deep, resilient persistence for itself or a secondary malware payload, ensuring that malicious code is executed automatically every time the operating system initializes or a user logs in.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nStartp is rarely a standalone threat; it is usually dropped by an initial access broker, a downloader, or as part of a larger malware framework (like a botnet client) to guarantee survival across reboots.\n\nUpon execution, Startp employs multiple techniques to anchor itself to the system:\n<ul>\n<li><strong>Registry Manipulation:</strong> The most common method involves adding values to the standard Windows Autostart Extension Points (ASEPs), specifically `HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run` or the `RunOnce` keys.</li>\n<li><strong>Startup Folder Abuse:</strong> It may copy a malicious executable or a VBScript shortcut directly into the user's or the system's `Startup` folder (`shell:startup`).</li>\n<li><strong>Service Creation:</strong> More advanced variants of Startp will install themselves as a hidden Windows Service, allowing the malware to execute with `SYSTEM` privileges before any user even logs into the machine.</li>\n<li><strong>Winlogon Hijacking:</strong> It may modify the `Winlogon\\Userinit` or `Shell` registry keys to force the execution of its payload alongside the legitimate `explorer.exe` process.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe presence of Startp indicates that a threat actor has successfully escalated privileges (to modify `HKLM` or create services) and established a permanent foothold. The persistence mechanism must be completely eradicated; otherwise, the primary malware payload will simply regenerate upon the next reboot.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Identify the Payload:</strong> The Startp component itself is just the anchor. Responders must trace the persistence mechanism (the registry key or scheduled task) to identify the actual malicious executable it is launching.</li>\n<li><strong>Break the Chain of Persistence:</strong> Boot the system into Safe Mode or use offline registry editing tools. Delete the malicious entries in the `Run` keys, remove unauthorized Scheduled Tasks, and disable any rogue Windows Services.</li>\n<li><strong>Endpoint Eradication:</strong> Once the persistence mechanisms are severed, utilize EDR or anti-malware tools to quarantine the core malware executables and perform a full system sweep.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Trojan.StartPage",
    "Trojan.Startp",
    "Win32/Startp"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1547.001",
    "T1543.003",
    "T1547.004"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T17:38:56Z",
  "type": "Trojan (Persistence Component)",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}