Analysis
-
max time kernel
151s -
max time network
138s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
05-05-2021 13:02
Static task
static1
Behavioral task
behavioral1
Sample
notepad.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
notepad.exe
Resource
win10v20210408
General
-
Target
notepad.exe
-
Size
2.8MB
-
MD5
4930920087503d221d8bb13e1514620b
-
SHA1
07e2d9be6cce22e6b1b44992acf2d536c3675e07
-
SHA256
5cf202837c24442de4f09ee9a152c77f911b405541fd30567bcc370ef61f5f75
-
SHA512
9204d17902fb794600e5efb538f0269340393a84cf3c72ceb27884ab1f5f215a46c42a9f5de457167953d9bcdf7148d9a3b12d22812347af20e5e073a2802f0f
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/3980-118-0x0000000000400000-0x0000000000A16000-memory.dmp upx behavioral2/memory/3980-119-0x0000000000400000-0x0000000000A16000-memory.dmp upx -
Drops startup file 1 IoCs
Processes:
wscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\viTRMUuKeV.url wscript.exe -
Suspicious use of SetThreadContext 17 IoCs
Processes:
notepad.exenotepad.exedescription pid process target process PID 796 set thread context of 3008 796 notepad.exe notepad.exe PID 3008 set thread context of 3980 3008 notepad.exe notepad.exe PID 3008 set thread context of 3460 3008 notepad.exe notepad.exe PID 3008 set thread context of 3284 3008 notepad.exe notepad.exe PID 3008 set thread context of 3996 3008 notepad.exe notepad.exe PID 3008 set thread context of 3780 3008 notepad.exe notepad.exe PID 3008 set thread context of 2264 3008 notepad.exe notepad.exe PID 3008 set thread context of 1236 3008 notepad.exe notepad.exe PID 3008 set thread context of 964 3008 notepad.exe notepad.exe PID 3008 set thread context of 3904 3008 notepad.exe notepad.exe PID 3008 set thread context of 4052 3008 notepad.exe notepad.exe PID 3008 set thread context of 1168 3008 notepad.exe notepad.exe PID 3008 set thread context of 1556 3008 notepad.exe notepad.exe PID 3008 set thread context of 3136 3008 notepad.exe notepad.exe PID 3008 set thread context of 3476 3008 notepad.exe notepad.exe PID 3008 set thread context of 424 3008 notepad.exe notepad.exe PID 3008 set thread context of 3232 3008 notepad.exe notepad.exe -
Program crash 16 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 496 3980 WerFault.exe notepad.exe 1352 3460 WerFault.exe notepad.exe 1152 3284 WerFault.exe notepad.exe 2240 3996 WerFault.exe notepad.exe 3884 3780 WerFault.exe notepad.exe 504 2264 WerFault.exe notepad.exe 4024 1236 WerFault.exe notepad.exe 928 964 WerFault.exe notepad.exe 4048 3904 WerFault.exe notepad.exe 1020 4052 WerFault.exe notepad.exe 1636 1168 WerFault.exe notepad.exe 2132 1556 WerFault.exe notepad.exe 1044 3136 WerFault.exe notepad.exe 2292 3476 WerFault.exe notepad.exe 3520 424 WerFault.exe notepad.exe 2336 3232 WerFault.exe notepad.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
notepad.exepid process 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe 3008 notepad.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
Processes:
notepad.exedescription pid process Token: SeDebugPrivilege 3008 notepad.exe Token: SeDebugPrivilege 3008 notepad.exe Token: SeDebugPrivilege 3008 notepad.exe Token: SeDebugPrivilege 3008 notepad.exe Token: SeDebugPrivilege 3008 notepad.exe Token: SeDebugPrivilege 3008 notepad.exe Token: SeDebugPrivilege 3008 notepad.exe Token: SeDebugPrivilege 3008 notepad.exe Token: SeDebugPrivilege 3008 notepad.exe Token: SeDebugPrivilege 3008 notepad.exe Token: SeDebugPrivilege 3008 notepad.exe Token: SeDebugPrivilege 3008 notepad.exe Token: SeDebugPrivilege 3008 notepad.exe Token: SeDebugPrivilege 3008 notepad.exe Token: SeDebugPrivilege 3008 notepad.exe Token: SeDebugPrivilege 3008 notepad.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
notepad.exepid process 796 notepad.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
notepad.exenotepad.execmd.exedescription pid process target process PID 796 wrote to memory of 3008 796 notepad.exe notepad.exe PID 796 wrote to memory of 3008 796 notepad.exe notepad.exe PID 796 wrote to memory of 3008 796 notepad.exe notepad.exe PID 796 wrote to memory of 3008 796 notepad.exe notepad.exe PID 796 wrote to memory of 3008 796 notepad.exe notepad.exe PID 796 wrote to memory of 3008 796 notepad.exe notepad.exe PID 796 wrote to memory of 3008 796 notepad.exe notepad.exe PID 796 wrote to memory of 3008 796 notepad.exe notepad.exe PID 796 wrote to memory of 3008 796 notepad.exe notepad.exe PID 3008 wrote to memory of 3980 3008 notepad.exe notepad.exe PID 3008 wrote to memory of 3980 3008 notepad.exe notepad.exe PID 3008 wrote to memory of 3980 3008 notepad.exe notepad.exe PID 3008 wrote to memory of 3980 3008 notepad.exe notepad.exe PID 3008 wrote to memory of 3980 3008 notepad.exe notepad.exe PID 3008 wrote to memory of 3980 3008 notepad.exe notepad.exe PID 3008 wrote to memory of 3980 3008 notepad.exe notepad.exe PID 3008 wrote to memory of 3980 3008 notepad.exe notepad.exe PID 3008 wrote to memory of 3460 3008 notepad.exe notepad.exe PID 3008 wrote to memory of 3460 3008 notepad.exe notepad.exe PID 3008 wrote to memory of 3460 3008 notepad.exe notepad.exe PID 3008 wrote to memory of 3460 3008 notepad.exe notepad.exe PID 3008 wrote to memory of 3460 3008 notepad.exe notepad.exe PID 3008 wrote to memory of 3460 3008 notepad.exe notepad.exe PID 3008 wrote to memory of 3460 3008 notepad.exe notepad.exe PID 3008 wrote to memory of 3460 3008 notepad.exe notepad.exe PID 3008 wrote to memory of 3284 3008 notepad.exe notepad.exe PID 3008 wrote to memory of 3284 3008 notepad.exe notepad.exe PID 3008 wrote to memory of 3284 3008 notepad.exe notepad.exe PID 3008 wrote to memory of 3284 3008 notepad.exe notepad.exe PID 3008 wrote to memory of 3284 3008 notepad.exe notepad.exe PID 3008 wrote to memory of 3284 3008 notepad.exe notepad.exe PID 3008 wrote to memory of 3284 3008 notepad.exe notepad.exe PID 3008 wrote to memory of 3284 3008 notepad.exe notepad.exe PID 3008 wrote to memory of 836 3008 notepad.exe cmd.exe PID 3008 wrote to memory of 836 3008 notepad.exe cmd.exe PID 3008 wrote to memory of 836 3008 notepad.exe cmd.exe PID 836 wrote to memory of 3868 836 cmd.exe wscript.exe PID 836 wrote to memory of 3868 836 cmd.exe wscript.exe PID 836 wrote to memory of 3868 836 cmd.exe wscript.exe PID 3008 wrote to memory of 836 3008 notepad.exe cmd.exe PID 3008 wrote to memory of 836 3008 notepad.exe cmd.exe PID 3008 wrote to memory of 3996 3008 notepad.exe notepad.exe PID 3008 wrote to memory of 3996 3008 notepad.exe notepad.exe PID 3008 wrote to memory of 3996 3008 notepad.exe notepad.exe PID 3008 wrote to memory of 3996 3008 notepad.exe notepad.exe PID 3008 wrote to memory of 3996 3008 notepad.exe notepad.exe PID 3008 wrote to memory of 3996 3008 notepad.exe notepad.exe PID 3008 wrote to memory of 3996 3008 notepad.exe notepad.exe PID 3008 wrote to memory of 3996 3008 notepad.exe notepad.exe PID 3008 wrote to memory of 3780 3008 notepad.exe notepad.exe PID 3008 wrote to memory of 3780 3008 notepad.exe notepad.exe PID 3008 wrote to memory of 3780 3008 notepad.exe notepad.exe PID 3008 wrote to memory of 3780 3008 notepad.exe notepad.exe PID 3008 wrote to memory of 3780 3008 notepad.exe notepad.exe PID 3008 wrote to memory of 3780 3008 notepad.exe notepad.exe PID 3008 wrote to memory of 3780 3008 notepad.exe notepad.exe PID 3008 wrote to memory of 3780 3008 notepad.exe notepad.exe PID 3008 wrote to memory of 2264 3008 notepad.exe notepad.exe PID 3008 wrote to memory of 2264 3008 notepad.exe notepad.exe PID 3008 wrote to memory of 2264 3008 notepad.exe notepad.exe PID 3008 wrote to memory of 2264 3008 notepad.exe notepad.exe PID 3008 wrote to memory of 2264 3008 notepad.exe notepad.exe PID 3008 wrote to memory of 2264 3008 notepad.exe notepad.exe PID 3008 wrote to memory of 2264 3008 notepad.exe notepad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\notepad.exe"C:\Users\Admin\AppData\Local\Temp\notepad.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\notepad.exe"C:\Users\Admin\AppData\Local\Temp\notepad.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\LKBNMTFJgl\cfgi"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3980 -s 1164⤵
- Program crash
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\LKBNMTFJgl\cfgi"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3460 -s 1804⤵
- Program crash
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\LKBNMTFJgl\cfgi"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3284 -s 1804⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.execmd.exe /C WScript "C:\ProgramData\LKBNMTFJgl\r.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exeWScript "C:\ProgramData\LKBNMTFJgl\r.vbs"4⤵
- Drops startup file
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\LKBNMTFJgl\cfgi"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3996 -s 1804⤵
- Program crash
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\LKBNMTFJgl\cfgi"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3780 -s 1804⤵
- Program crash
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\LKBNMTFJgl\cfgi"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2264 -s 1804⤵
- Program crash
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\LKBNMTFJgl\cfgi"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1236 -s 1804⤵
- Program crash
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\LKBNMTFJgl\cfgi"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 964 -s 1804⤵
- Program crash
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\LKBNMTFJgl\cfgi"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3904 -s 1804⤵
- Program crash
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\LKBNMTFJgl\cfgi"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4052 -s 1124⤵
- Program crash
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\LKBNMTFJgl\cfgi"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1168 -s 1804⤵
- Program crash
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\LKBNMTFJgl\cfgi"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1556 -s 1804⤵
- Program crash
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\LKBNMTFJgl\cfgi"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3136 -s 1804⤵
- Program crash
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\LKBNMTFJgl\cfgi"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3476 -s 1804⤵
- Program crash
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\LKBNMTFJgl\cfgi"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 424 -s 1804⤵
- Program crash
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\LKBNMTFJgl\cfgi"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3232 -s 1804⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\LKBNMTFJgl\r.vbsMD5
19b2d791962e01151e4b6a40a90e8cd8
SHA1a1ee500267dd1d457b3f840f8a00ba808bb46eb3
SHA25667824e30ec5d2b61ffb266e8a37e9b929e82d507d09d21961b8293c99816c664
SHA5124d39fd8f11e86490041190f1419273c702ccd85dcc603e5d7acc9d55cc60031ef1f7cc901a2c09b46d6bdc560a4c81d464c8495e7f9e8707ec7cd999f49c49fe
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\viTRMUuKeV.urlMD5
e03e6937ba1878ace3d849b233adecfe
SHA1affbb4f8b53af6cf35660b775a0a8f70fb95f8b5
SHA2569846a8975f8e2dbc96cd18d5015c03b4d8226fddf69bcb99a0610c855b0a9e6d
SHA51299ea03b8635d89409c6e65dc1dd1e995eac8c02e373f3b01faa7d715f347722075cc0d5d629914399505a2ca8ffb80bfa8cafa9d99a2e702d1fcd94fb0baeca9
-
memory/424-196-0x0000000000A14AA0-mapping.dmp
-
memory/836-134-0x0000000000000000-mapping.dmp
-
memory/836-137-0x0000000003C90000-0x0000000003E64000-memory.dmpFilesize
1.8MB
-
memory/964-161-0x0000000000A14AA0-mapping.dmp
-
memory/1168-176-0x0000000000A14AA0-mapping.dmp
-
memory/1236-156-0x0000000000A14AA0-mapping.dmp
-
memory/1556-181-0x0000000000A14AA0-mapping.dmp
-
memory/2264-151-0x0000000000A14AA0-mapping.dmp
-
memory/3008-123-0x0000000000400000-0x00000000005D4000-memory.dmpFilesize
1.8MB
-
memory/3008-116-0x0000000000400000-0x00000000005D4000-memory.dmpFilesize
1.8MB
-
memory/3008-117-0x0000000000404470-mapping.dmp
-
memory/3136-186-0x0000000000A14AA0-mapping.dmp
-
memory/3232-200-0x0000000000A14AA0-mapping.dmp
-
memory/3284-131-0x0000000000A14AA0-mapping.dmp
-
memory/3460-126-0x0000000000A14AA0-mapping.dmp
-
memory/3476-191-0x0000000000A14AA0-mapping.dmp
-
memory/3780-146-0x0000000000A14AA0-mapping.dmp
-
memory/3868-135-0x0000000000000000-mapping.dmp
-
memory/3904-166-0x0000000000A14AA0-mapping.dmp
-
memory/3980-120-0x0000000000A14AA0-mapping.dmp
-
memory/3980-119-0x0000000000400000-0x0000000000A16000-memory.dmpFilesize
6.1MB
-
memory/3980-118-0x0000000000400000-0x0000000000A16000-memory.dmpFilesize
6.1MB
-
memory/3996-141-0x0000000000A14AA0-mapping.dmp
-
memory/4052-171-0x0000000000A14AA0-mapping.dmp