Analysis
-
max time kernel
150s -
max time network
131s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
05-05-2021 12:50
Static task
static1
Behavioral task
behavioral1
Sample
notepad.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
notepad.exe
Resource
win10v20210410
General
-
Target
notepad.exe
-
Size
2.8MB
-
MD5
4930920087503d221d8bb13e1514620b
-
SHA1
07e2d9be6cce22e6b1b44992acf2d536c3675e07
-
SHA256
5cf202837c24442de4f09ee9a152c77f911b405541fd30567bcc370ef61f5f75
-
SHA512
9204d17902fb794600e5efb538f0269340393a84cf3c72ceb27884ab1f5f215a46c42a9f5de457167953d9bcdf7148d9a3b12d22812347af20e5e073a2802f0f
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/4036-119-0x0000000000400000-0x0000000000A16000-memory.dmp upx behavioral2/memory/4036-120-0x0000000000400000-0x0000000000A16000-memory.dmp upx -
Drops startup file 1 IoCs
Processes:
wscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\viTRMUuKeV.url wscript.exe -
Suspicious use of SetThreadContext 17 IoCs
Processes:
notepad.exenotepad.exedescription pid process target process PID 4084 set thread context of 1484 4084 notepad.exe notepad.exe PID 1484 set thread context of 4036 1484 notepad.exe notepad.exe PID 1484 set thread context of 2792 1484 notepad.exe notepad.exe PID 1484 set thread context of 3880 1484 notepad.exe notepad.exe PID 1484 set thread context of 2440 1484 notepad.exe notepad.exe PID 1484 set thread context of 4088 1484 notepad.exe notepad.exe PID 1484 set thread context of 1192 1484 notepad.exe notepad.exe PID 1484 set thread context of 784 1484 notepad.exe notepad.exe PID 1484 set thread context of 3856 1484 notepad.exe notepad.exe PID 1484 set thread context of 2192 1484 notepad.exe notepad.exe PID 1484 set thread context of 184 1484 notepad.exe notepad.exe PID 1484 set thread context of 636 1484 notepad.exe notepad.exe PID 1484 set thread context of 4020 1484 notepad.exe notepad.exe PID 1484 set thread context of 1556 1484 notepad.exe notepad.exe PID 1484 set thread context of 4088 1484 notepad.exe notepad.exe PID 1484 set thread context of 3692 1484 notepad.exe notepad.exe PID 1484 set thread context of 2740 1484 notepad.exe notepad.exe -
Program crash 16 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2724 4036 WerFault.exe notepad.exe 1136 2792 WerFault.exe notepad.exe 4084 3880 WerFault.exe notepad.exe 1000 2440 WerFault.exe notepad.exe 1548 4088 WerFault.exe notepad.exe 3944 1192 WerFault.exe notepad.exe 2220 784 WerFault.exe notepad.exe 1004 3856 WerFault.exe notepad.exe 2652 2192 WerFault.exe notepad.exe 4008 184 WerFault.exe notepad.exe 4012 636 WerFault.exe notepad.exe 2156 4020 WerFault.exe notepad.exe 3052 1556 WerFault.exe notepad.exe 3944 4088 WerFault.exe notepad.exe 2932 3692 WerFault.exe notepad.exe 3860 2740 WerFault.exe notepad.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
notepad.exepid process 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe 1484 notepad.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
Processes:
notepad.exedescription pid process Token: SeDebugPrivilege 1484 notepad.exe Token: SeDebugPrivilege 1484 notepad.exe Token: SeDebugPrivilege 1484 notepad.exe Token: SeDebugPrivilege 1484 notepad.exe Token: SeDebugPrivilege 1484 notepad.exe Token: SeDebugPrivilege 1484 notepad.exe Token: SeDebugPrivilege 1484 notepad.exe Token: SeDebugPrivilege 1484 notepad.exe Token: SeDebugPrivilege 1484 notepad.exe Token: SeDebugPrivilege 1484 notepad.exe Token: SeDebugPrivilege 1484 notepad.exe Token: SeDebugPrivilege 1484 notepad.exe Token: SeDebugPrivilege 1484 notepad.exe Token: SeDebugPrivilege 1484 notepad.exe Token: SeDebugPrivilege 1484 notepad.exe Token: SeDebugPrivilege 1484 notepad.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
notepad.exepid process 4084 notepad.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
notepad.exenotepad.execmd.exedescription pid process target process PID 4084 wrote to memory of 1484 4084 notepad.exe notepad.exe PID 4084 wrote to memory of 1484 4084 notepad.exe notepad.exe PID 4084 wrote to memory of 1484 4084 notepad.exe notepad.exe PID 4084 wrote to memory of 1484 4084 notepad.exe notepad.exe PID 4084 wrote to memory of 1484 4084 notepad.exe notepad.exe PID 4084 wrote to memory of 1484 4084 notepad.exe notepad.exe PID 4084 wrote to memory of 1484 4084 notepad.exe notepad.exe PID 4084 wrote to memory of 1484 4084 notepad.exe notepad.exe PID 4084 wrote to memory of 1484 4084 notepad.exe notepad.exe PID 1484 wrote to memory of 4036 1484 notepad.exe notepad.exe PID 1484 wrote to memory of 4036 1484 notepad.exe notepad.exe PID 1484 wrote to memory of 4036 1484 notepad.exe notepad.exe PID 1484 wrote to memory of 4036 1484 notepad.exe notepad.exe PID 1484 wrote to memory of 4036 1484 notepad.exe notepad.exe PID 1484 wrote to memory of 4036 1484 notepad.exe notepad.exe PID 1484 wrote to memory of 4036 1484 notepad.exe notepad.exe PID 1484 wrote to memory of 4036 1484 notepad.exe notepad.exe PID 1484 wrote to memory of 2792 1484 notepad.exe notepad.exe PID 1484 wrote to memory of 2792 1484 notepad.exe notepad.exe PID 1484 wrote to memory of 2792 1484 notepad.exe notepad.exe PID 1484 wrote to memory of 2792 1484 notepad.exe notepad.exe PID 1484 wrote to memory of 2792 1484 notepad.exe notepad.exe PID 1484 wrote to memory of 2792 1484 notepad.exe notepad.exe PID 1484 wrote to memory of 2792 1484 notepad.exe notepad.exe PID 1484 wrote to memory of 2792 1484 notepad.exe notepad.exe PID 1484 wrote to memory of 3880 1484 notepad.exe notepad.exe PID 1484 wrote to memory of 3880 1484 notepad.exe notepad.exe PID 1484 wrote to memory of 3880 1484 notepad.exe notepad.exe PID 1484 wrote to memory of 3880 1484 notepad.exe notepad.exe PID 1484 wrote to memory of 3880 1484 notepad.exe notepad.exe PID 1484 wrote to memory of 3880 1484 notepad.exe notepad.exe PID 1484 wrote to memory of 3880 1484 notepad.exe notepad.exe PID 1484 wrote to memory of 3880 1484 notepad.exe notepad.exe PID 1484 wrote to memory of 1576 1484 notepad.exe cmd.exe PID 1484 wrote to memory of 1576 1484 notepad.exe cmd.exe PID 1484 wrote to memory of 1576 1484 notepad.exe cmd.exe PID 1576 wrote to memory of 3024 1576 cmd.exe wscript.exe PID 1576 wrote to memory of 3024 1576 cmd.exe wscript.exe PID 1576 wrote to memory of 3024 1576 cmd.exe wscript.exe PID 1484 wrote to memory of 1576 1484 notepad.exe cmd.exe PID 1484 wrote to memory of 1576 1484 notepad.exe cmd.exe PID 1484 wrote to memory of 2440 1484 notepad.exe notepad.exe PID 1484 wrote to memory of 2440 1484 notepad.exe notepad.exe PID 1484 wrote to memory of 2440 1484 notepad.exe notepad.exe PID 1484 wrote to memory of 2440 1484 notepad.exe notepad.exe PID 1484 wrote to memory of 2440 1484 notepad.exe notepad.exe PID 1484 wrote to memory of 2440 1484 notepad.exe notepad.exe PID 1484 wrote to memory of 2440 1484 notepad.exe notepad.exe PID 1484 wrote to memory of 2440 1484 notepad.exe notepad.exe PID 1484 wrote to memory of 4088 1484 notepad.exe notepad.exe PID 1484 wrote to memory of 4088 1484 notepad.exe notepad.exe PID 1484 wrote to memory of 4088 1484 notepad.exe notepad.exe PID 1484 wrote to memory of 4088 1484 notepad.exe notepad.exe PID 1484 wrote to memory of 4088 1484 notepad.exe notepad.exe PID 1484 wrote to memory of 4088 1484 notepad.exe notepad.exe PID 1484 wrote to memory of 4088 1484 notepad.exe notepad.exe PID 1484 wrote to memory of 4088 1484 notepad.exe notepad.exe PID 1484 wrote to memory of 1192 1484 notepad.exe notepad.exe PID 1484 wrote to memory of 1192 1484 notepad.exe notepad.exe PID 1484 wrote to memory of 1192 1484 notepad.exe notepad.exe PID 1484 wrote to memory of 1192 1484 notepad.exe notepad.exe PID 1484 wrote to memory of 1192 1484 notepad.exe notepad.exe PID 1484 wrote to memory of 1192 1484 notepad.exe notepad.exe PID 1484 wrote to memory of 1192 1484 notepad.exe notepad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\notepad.exe"C:\Users\Admin\AppData\Local\Temp\notepad.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\notepad.exe"C:\Users\Admin\AppData\Local\Temp\notepad.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\LKBNMTFJgl\cfgi"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4036 -s 1804⤵
- Program crash
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\LKBNMTFJgl\cfgi"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2792 -s 1804⤵
- Program crash
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\LKBNMTFJgl\cfgi"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3880 -s 1804⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.execmd.exe /C WScript "C:\ProgramData\LKBNMTFJgl\r.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exeWScript "C:\ProgramData\LKBNMTFJgl\r.vbs"4⤵
- Drops startup file
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\LKBNMTFJgl\cfgi"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2440 -s 1804⤵
- Program crash
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\LKBNMTFJgl\cfgi"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4088 -s 1804⤵
- Program crash
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\LKBNMTFJgl\cfgi"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1192 -s 1804⤵
- Program crash
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\LKBNMTFJgl\cfgi"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 784 -s 1804⤵
- Program crash
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\LKBNMTFJgl\cfgi"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3856 -s 1884⤵
- Program crash
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\LKBNMTFJgl\cfgi"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2192 -s 1804⤵
- Program crash
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\LKBNMTFJgl\cfgi"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 184 -s 1924⤵
- Program crash
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\LKBNMTFJgl\cfgi"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 636 -s 1804⤵
- Program crash
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\LKBNMTFJgl\cfgi"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4020 -s 1804⤵
- Program crash
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\LKBNMTFJgl\cfgi"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1556 -s 1804⤵
- Program crash
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\LKBNMTFJgl\cfgi"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4088 -s 1804⤵
- Program crash
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\LKBNMTFJgl\cfgi"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3692 -s 1804⤵
- Program crash
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\LKBNMTFJgl\cfgi"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2740 -s 1884⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\LKBNMTFJgl\r.vbsMD5
19b2d791962e01151e4b6a40a90e8cd8
SHA1a1ee500267dd1d457b3f840f8a00ba808bb46eb3
SHA25667824e30ec5d2b61ffb266e8a37e9b929e82d507d09d21961b8293c99816c664
SHA5124d39fd8f11e86490041190f1419273c702ccd85dcc603e5d7acc9d55cc60031ef1f7cc901a2c09b46d6bdc560a4c81d464c8495e7f9e8707ec7cd999f49c49fe
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\viTRMUuKeV.urlMD5
e03e6937ba1878ace3d849b233adecfe
SHA1affbb4f8b53af6cf35660b775a0a8f70fb95f8b5
SHA2569846a8975f8e2dbc96cd18d5015c03b4d8226fddf69bcb99a0610c855b0a9e6d
SHA51299ea03b8635d89409c6e65dc1dd1e995eac8c02e373f3b01faa7d715f347722075cc0d5d629914399505a2ca8ffb80bfa8cafa9d99a2e702d1fcd94fb0baeca9
-
memory/184-171-0x0000000000A14AA0-mapping.dmp
-
memory/636-176-0x0000000000A14AA0-mapping.dmp
-
memory/784-156-0x0000000000A14AA0-mapping.dmp
-
memory/1192-151-0x0000000000A14AA0-mapping.dmp
-
memory/1484-116-0x0000000000400000-0x00000000005D4000-memory.dmpFilesize
1.8MB
-
memory/1484-118-0x0000000000400000-0x00000000005D4000-memory.dmpFilesize
1.8MB
-
memory/1484-117-0x0000000000404470-mapping.dmp
-
memory/1556-186-0x0000000000A14AA0-mapping.dmp
-
memory/1576-134-0x0000000000000000-mapping.dmp
-
memory/1576-137-0x00000000036E0000-0x00000000038B4000-memory.dmpFilesize
1.8MB
-
memory/2192-166-0x0000000000A14AA0-mapping.dmp
-
memory/2440-141-0x0000000000A14AA0-mapping.dmp
-
memory/2740-200-0x0000000000A14AA0-mapping.dmp
-
memory/2792-126-0x0000000000A14AA0-mapping.dmp
-
memory/3024-135-0x0000000000000000-mapping.dmp
-
memory/3692-196-0x0000000000A14AA0-mapping.dmp
-
memory/3856-161-0x0000000000A14AA0-mapping.dmp
-
memory/3880-131-0x0000000000A14AA0-mapping.dmp
-
memory/4020-181-0x0000000000A14AA0-mapping.dmp
-
memory/4036-121-0x0000000000A14AA0-mapping.dmp
-
memory/4036-119-0x0000000000400000-0x0000000000A16000-memory.dmpFilesize
6.1MB
-
memory/4036-120-0x0000000000400000-0x0000000000A16000-memory.dmpFilesize
6.1MB
-
memory/4088-189-0x0000000000400000-0x0000000000400138-memory.dmpFilesize
312B
-
memory/4088-191-0x0000000000A14AA0-mapping.dmp
-
memory/4088-146-0x0000000000A14AA0-mapping.dmp