Analysis
-
max time kernel
62s -
max time network
49s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
08-07-2020 18:30
Static task
static1
Behavioral task
behavioral1
Sample
TvwMA57y.bat
Resource
win7
Behavioral task
behavioral2
Sample
TvwMA57y.bat
Resource
win10v200430
General
-
Target
TvwMA57y.bat
-
Size
13KB
-
MD5
44fbd58c401a7786da2e8b6a6291379e
-
SHA1
9dbfd08fa557d9dce79911eb4bbddb2008d4f53f
-
SHA256
d8b47727ea05305ad396977b336c3bfc86ae122cdde01976fa9b0c3a7c2d3f24
-
SHA512
c369f749ba3ef4e463524b3483c4250311c2a19414a49dc86c052cac9c9d0a3b05dbdbf71b854ccf6f46abc46e439f9264c7672e22a0c3004b7d679e26a56de3
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
Processes:
MEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exepid process 940 MEMZ.exe 2600 MEMZ.exe 2764 MEMZ.exe 2892 MEMZ.exe 3712 MEMZ.exe 3016 MEMZ.exe 3976 MEMZ.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
MEMZ.exedescription ioc process File opened for modification \??\PhysicalDrive0 MEMZ.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 20524 IoCs
Processes:
MEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exepid process 2600 MEMZ.exe 2600 MEMZ.exe 2600 MEMZ.exe 2600 MEMZ.exe 2600 MEMZ.exe 2600 MEMZ.exe 2764 MEMZ.exe 2600 MEMZ.exe 2600 MEMZ.exe 2764 MEMZ.exe 2600 MEMZ.exe 2764 MEMZ.exe 2764 MEMZ.exe 2600 MEMZ.exe 2892 MEMZ.exe 2892 MEMZ.exe 3016 MEMZ.exe 3016 MEMZ.exe 3712 MEMZ.exe 3712 MEMZ.exe 2600 MEMZ.exe 2600 MEMZ.exe 2892 MEMZ.exe 2892 MEMZ.exe 2764 MEMZ.exe 2764 MEMZ.exe 2892 MEMZ.exe 2892 MEMZ.exe 2600 MEMZ.exe 2600 MEMZ.exe 3712 MEMZ.exe 3712 MEMZ.exe 3016 MEMZ.exe 3016 MEMZ.exe 2764 MEMZ.exe 2764 MEMZ.exe 2764 MEMZ.exe 2764 MEMZ.exe 3016 MEMZ.exe 3016 MEMZ.exe 3712 MEMZ.exe 3712 MEMZ.exe 2600 MEMZ.exe 2600 MEMZ.exe 2892 MEMZ.exe 2892 MEMZ.exe 2764 MEMZ.exe 2764 MEMZ.exe 2892 MEMZ.exe 2892 MEMZ.exe 2600 MEMZ.exe 2600 MEMZ.exe 3712 MEMZ.exe 3712 MEMZ.exe 3016 MEMZ.exe 3016 MEMZ.exe 2892 MEMZ.exe 2600 MEMZ.exe 2892 MEMZ.exe 2600 MEMZ.exe 2764 MEMZ.exe 2764 MEMZ.exe 3016 MEMZ.exe 3712 MEMZ.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
taskmgr.exedescription pid process Token: SeDebugPrivilege 60 taskmgr.exe Token: SeSystemProfilePrivilege 60 taskmgr.exe Token: SeCreateGlobalPrivilege 60 taskmgr.exe -
Suspicious use of FindShellTrayWindow 32 IoCs
Processes:
taskmgr.exepid process 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe -
Suspicious use of SendNotifyMessage 32 IoCs
Processes:
taskmgr.exepid process 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe 60 taskmgr.exe -
Suspicious use of SetWindowsHookEx 31 IoCs
Processes:
MEMZ.exewordpad.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exepid process 3976 MEMZ.exe 724 wordpad.exe 724 wordpad.exe 724 wordpad.exe 724 wordpad.exe 724 wordpad.exe 724 wordpad.exe 3712 MEMZ.exe 2764 MEMZ.exe 2892 MEMZ.exe 2600 MEMZ.exe 2892 MEMZ.exe 2764 MEMZ.exe 3712 MEMZ.exe 2600 MEMZ.exe 2764 MEMZ.exe 2892 MEMZ.exe 3712 MEMZ.exe 2600 MEMZ.exe 3712 MEMZ.exe 2892 MEMZ.exe 2764 MEMZ.exe 2600 MEMZ.exe 2764 MEMZ.exe 2600 MEMZ.exe 3712 MEMZ.exe 2892 MEMZ.exe 2764 MEMZ.exe 3712 MEMZ.exe 2600 MEMZ.exe 2892 MEMZ.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
cmd.exeMEMZ.exeMEMZ.exedescription pid process target process PID 2804 wrote to memory of 996 2804 cmd.exe cscript.exe PID 2804 wrote to memory of 996 2804 cmd.exe cscript.exe PID 2804 wrote to memory of 940 2804 cmd.exe MEMZ.exe PID 2804 wrote to memory of 940 2804 cmd.exe MEMZ.exe PID 2804 wrote to memory of 940 2804 cmd.exe MEMZ.exe PID 940 wrote to memory of 2600 940 MEMZ.exe MEMZ.exe PID 940 wrote to memory of 2600 940 MEMZ.exe MEMZ.exe PID 940 wrote to memory of 2600 940 MEMZ.exe MEMZ.exe PID 940 wrote to memory of 2764 940 MEMZ.exe MEMZ.exe PID 940 wrote to memory of 2764 940 MEMZ.exe MEMZ.exe PID 940 wrote to memory of 2764 940 MEMZ.exe MEMZ.exe PID 940 wrote to memory of 2892 940 MEMZ.exe MEMZ.exe PID 940 wrote to memory of 2892 940 MEMZ.exe MEMZ.exe PID 940 wrote to memory of 2892 940 MEMZ.exe MEMZ.exe PID 940 wrote to memory of 3712 940 MEMZ.exe MEMZ.exe PID 940 wrote to memory of 3712 940 MEMZ.exe MEMZ.exe PID 940 wrote to memory of 3712 940 MEMZ.exe MEMZ.exe PID 940 wrote to memory of 3016 940 MEMZ.exe MEMZ.exe PID 940 wrote to memory of 3016 940 MEMZ.exe MEMZ.exe PID 940 wrote to memory of 3016 940 MEMZ.exe MEMZ.exe PID 940 wrote to memory of 3976 940 MEMZ.exe MEMZ.exe PID 940 wrote to memory of 3976 940 MEMZ.exe MEMZ.exe PID 940 wrote to memory of 3976 940 MEMZ.exe MEMZ.exe PID 3976 wrote to memory of 1736 3976 MEMZ.exe notepad.exe PID 3976 wrote to memory of 1736 3976 MEMZ.exe notepad.exe PID 3976 wrote to memory of 1736 3976 MEMZ.exe notepad.exe PID 3976 wrote to memory of 724 3976 MEMZ.exe wordpad.exe PID 3976 wrote to memory of 724 3976 MEMZ.exe wordpad.exe PID 3976 wrote to memory of 724 3976 MEMZ.exe wordpad.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\TvwMA57y.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript x.js2⤵
-
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /main3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe" \note.txt4⤵
-
C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\xMD5
1882f3dd051e401349f1af58d55b0a37
SHA16b0875f9e3164f3a9f21c1ec36748a7243515b47
SHA2563c8cea1a86f07b018e637a1ea2649d907573f78c7e4025ef7e514362d09ff6c0
SHA512fec96d873997b5c6c82a94f8796c88fc2dd38739277c517b8129277dcbda02576851f1e27bdb2fbb7255281077d5b9ba867f6dfe66bedfc859c59fdd3bbffacf
-
C:\Users\Admin\AppData\Local\Temp\x.jsMD5
8eec8704d2a7bc80b95b7460c06f4854
SHA11b34585c1fa7ec0bd0505478ac9dbb8b8d19f326
SHA256aa01b8864b43e92077a106ed3d4656a511f3ba1910fba40c78a32ee6a621d596
SHA512e274b92810e9a30627a65f87448d784967a2fcfbf49858cbe6ccb841f09e0f53fde253ecc1ea0c7de491d8cc56a6cf8c79d1b7c657e72928cfb0479d11035210
-
C:\Users\Admin\AppData\Local\Temp\z.zipMD5
63ee4412b95d7ad64c54b4ba673470a7
SHA11cf423c6c2c6299e68e1927305a3057af9b3ce06
SHA25644c1857b1c4894b3dfbaccbe04905652e634283dcf6b06c25a74b17021e2a268
SHA5127ff153826bd5fed0a410f6d15a54787b79eba927d5b573c8a7f23f4ecef7bb223d79fd29fe8c2754fbf5b4c77ab7c41598f2989b6f4c7b2aa2f579ef4af06ee7
-
C:\Users\Admin\AppData\Roaming\MEMZ.exeMD5
19dbec50735b5f2a72d4199c4e184960
SHA16fed7732f7cb6f59743795b2ab154a3676f4c822
SHA256a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
SHA512aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
-
C:\Users\Admin\AppData\Roaming\MEMZ.exeMD5
19dbec50735b5f2a72d4199c4e184960
SHA16fed7732f7cb6f59743795b2ab154a3676f4c822
SHA256a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
SHA512aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
-
C:\Users\Admin\AppData\Roaming\MEMZ.exeMD5
19dbec50735b5f2a72d4199c4e184960
SHA16fed7732f7cb6f59743795b2ab154a3676f4c822
SHA256a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
SHA512aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
-
C:\Users\Admin\AppData\Roaming\MEMZ.exeMD5
19dbec50735b5f2a72d4199c4e184960
SHA16fed7732f7cb6f59743795b2ab154a3676f4c822
SHA256a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
SHA512aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
-
C:\Users\Admin\AppData\Roaming\MEMZ.exeMD5
19dbec50735b5f2a72d4199c4e184960
SHA16fed7732f7cb6f59743795b2ab154a3676f4c822
SHA256a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
SHA512aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
-
C:\Users\Admin\AppData\Roaming\MEMZ.exeMD5
19dbec50735b5f2a72d4199c4e184960
SHA16fed7732f7cb6f59743795b2ab154a3676f4c822
SHA256a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
SHA512aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
-
C:\Users\Admin\AppData\Roaming\MEMZ.exeMD5
19dbec50735b5f2a72d4199c4e184960
SHA16fed7732f7cb6f59743795b2ab154a3676f4c822
SHA256a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
SHA512aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
-
C:\Users\Admin\AppData\Roaming\MEMZ.exeMD5
19dbec50735b5f2a72d4199c4e184960
SHA16fed7732f7cb6f59743795b2ab154a3676f4c822
SHA256a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
SHA512aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
-
C:\note.txtMD5
afa6955439b8d516721231029fb9ca1b
SHA1087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA2568e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
SHA5125da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
-
memory/724-23-0x0000000000000000-mapping.dmp
-
memory/940-6-0x0000000000000000-mapping.dmp
-
memory/940-5-0x0000000000000000-mapping.dmp
-
memory/996-2-0x0000021F62350000-0x0000021F62354000-memory.dmpFilesize
16KB
-
memory/996-0-0x0000000000000000-mapping.dmp
-
memory/1736-21-0x0000000000000000-mapping.dmp
-
memory/2600-9-0x0000000000000000-mapping.dmp
-
memory/2764-11-0x0000000000000000-mapping.dmp
-
memory/2892-13-0x0000000000000000-mapping.dmp
-
memory/3016-17-0x0000000000000000-mapping.dmp
-
memory/3712-15-0x0000000000000000-mapping.dmp
-
memory/3976-19-0x0000000000000000-mapping.dmp