a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d

General

Target

MEMZ.exe
Size

14KB
MD5

19dbec50735b5f2a72d4199c4e184960
SHA1

6fed7732f7cb6f59743795b2ab154a3676f4c822
SHA256

a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
SHA512

aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d

Score

6^/10

bootkit google persistence phishing

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

MEMZ.exe

description ioc process

File opened for modification \??\PhysicalDrive0 MEMZ.exe
Detected potential entity reuse from brand google.
phishing google
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000358f16e0538341458b70f68dad1eafd4000000000200000000001066000000010000200000003c0dd905f498fe060e4e38c3f288ec42b515497dcb561095c01ce12a8912bf3d000000000e8000000002000020000000a1367d7026beadca224cc0d2e840bebc2cb5188cc52124a55ea734855c14baf19000000004423c3775564e5eb82b701db9cbcb8a026b4f071aa23c1688e1a669d8ad5575e0935a9fe7fede21b808eae36485080e37d06f5029b9a0ef803eb20f9b6b076958d243a561a80dcb99968d5018b9da307decbbff691dd16f999d378b468b7b8c8b186468ab63cb626a7b646332e02bc85774620616db44976cfe8537e3672e407037cd7394d6b25edc131f111b8f281040000000a2645d7f48be17c85584ec98a4262f06d37c5c24972b476f86cf60cffe54f22ad59a568712d4e1b00acc3e28edce2ab05434e9fc2e9c81b9d401b83df43b20df	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "359072945"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5A3FEE71-D179-11EC-BABF-F6DB027C05B2} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 201623458665d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000358f16e0538341458b70f68dad1eafd40000000002000000000010660000000100002000000054966ee5466255377614e1496e6c16d85fa9c99b21ee2f48afc01a05a94d9924000000000e8000000002000020000000f2da90df7ef6ce0257c9af53667e9297e43b0bdd2ef79773d893b78f75ccd532200000009741e452876d9f95566c41f7c4ccd70d390957c17714c318478458584803661940000000f50652e34670ef4a2723e4fa488d9a5a447b1e1dabbd027c01b89599101f027125b07ecef96f9b2674f01aab781f954ed57bcc30f5bd59d99fdfc52767805b7c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

MEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exe

pid	process
616	MEMZ.exe
1808	MEMZ.exe
1056	MEMZ.exe
940	MEMZ.exe
880	MEMZ.exe
616	MEMZ.exe
1808	MEMZ.exe
1056	MEMZ.exe
940	MEMZ.exe
880	MEMZ.exe
616	MEMZ.exe
1808	MEMZ.exe
1056	MEMZ.exe
940	MEMZ.exe
880	MEMZ.exe
616	MEMZ.exe
1808	MEMZ.exe
1056	MEMZ.exe
940	MEMZ.exe
880	MEMZ.exe
616	MEMZ.exe
1808	MEMZ.exe
1056	MEMZ.exe
940	MEMZ.exe
880	MEMZ.exe
616	MEMZ.exe
1808	MEMZ.exe
1056	MEMZ.exe
880	MEMZ.exe
940	MEMZ.exe
616	MEMZ.exe
1808	MEMZ.exe
1056	MEMZ.exe
880	MEMZ.exe
940	MEMZ.exe
616	MEMZ.exe
1808	MEMZ.exe
1056	MEMZ.exe
880	MEMZ.exe
940	MEMZ.exe
616	MEMZ.exe
1808	MEMZ.exe
1056	MEMZ.exe
880	MEMZ.exe
940	MEMZ.exe
616	MEMZ.exe
1808	MEMZ.exe
1056	MEMZ.exe
880	MEMZ.exe
940	MEMZ.exe
616	MEMZ.exe
1808	MEMZ.exe
1056	MEMZ.exe
880	MEMZ.exe
940	MEMZ.exe
616	MEMZ.exe
1808	MEMZ.exe
1056	MEMZ.exe
880	MEMZ.exe
940	MEMZ.exe
616	MEMZ.exe
1808	MEMZ.exe
1056	MEMZ.exe
880	MEMZ.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1092 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1092 iexplore.exe
1092 iexplore.exe
688 IEXPLORE.EXE
688 IEXPLORE.EXE
688 IEXPLORE.EXE
688 IEXPLORE.EXE

pid	process
1092	iexplore.exe

pid	process
1092	iexplore.exe
1092	iexplore.exe
688	IEXPLORE.EXE
688	IEXPLORE.EXE
688	IEXPLORE.EXE
688	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

MEMZ.exeMEMZ.exeiexplore.exe

description	pid	process	target process
PID 1256 wrote to memory of 616	1256	MEMZ.exe	MEMZ.exe
PID 1256 wrote to memory of 616	1256	MEMZ.exe	MEMZ.exe
PID 1256 wrote to memory of 616	1256	MEMZ.exe	MEMZ.exe
PID 1256 wrote to memory of 616	1256	MEMZ.exe	MEMZ.exe
PID 1256 wrote to memory of 1808	1256	MEMZ.exe	MEMZ.exe
PID 1256 wrote to memory of 1808	1256	MEMZ.exe	MEMZ.exe
PID 1256 wrote to memory of 1808	1256	MEMZ.exe	MEMZ.exe
PID 1256 wrote to memory of 1808	1256	MEMZ.exe	MEMZ.exe
PID 1256 wrote to memory of 1056	1256	MEMZ.exe	MEMZ.exe
PID 1256 wrote to memory of 1056	1256	MEMZ.exe	MEMZ.exe
PID 1256 wrote to memory of 1056	1256	MEMZ.exe	MEMZ.exe
PID 1256 wrote to memory of 1056	1256	MEMZ.exe	MEMZ.exe
PID 1256 wrote to memory of 940	1256	MEMZ.exe	MEMZ.exe
PID 1256 wrote to memory of 940	1256	MEMZ.exe	MEMZ.exe
PID 1256 wrote to memory of 940	1256	MEMZ.exe	MEMZ.exe
PID 1256 wrote to memory of 940	1256	MEMZ.exe	MEMZ.exe
PID 1256 wrote to memory of 880	1256	MEMZ.exe	MEMZ.exe
PID 1256 wrote to memory of 880	1256	MEMZ.exe	MEMZ.exe
PID 1256 wrote to memory of 880	1256	MEMZ.exe	MEMZ.exe
PID 1256 wrote to memory of 880	1256	MEMZ.exe	MEMZ.exe
PID 1256 wrote to memory of 1244	1256	MEMZ.exe	MEMZ.exe
PID 1256 wrote to memory of 1244	1256	MEMZ.exe	MEMZ.exe
PID 1256 wrote to memory of 1244	1256	MEMZ.exe	MEMZ.exe
PID 1256 wrote to memory of 1244	1256	MEMZ.exe	MEMZ.exe
PID 1244 wrote to memory of 524	1244	MEMZ.exe	notepad.exe
PID 1244 wrote to memory of 524	1244	MEMZ.exe	notepad.exe
PID 1244 wrote to memory of 524	1244	MEMZ.exe	notepad.exe
PID 1244 wrote to memory of 524	1244	MEMZ.exe	notepad.exe
PID 1244 wrote to memory of 1092	1244	MEMZ.exe	iexplore.exe
PID 1244 wrote to memory of 1092	1244	MEMZ.exe	iexplore.exe
PID 1244 wrote to memory of 1092	1244	MEMZ.exe	iexplore.exe
PID 1244 wrote to memory of 1092	1244	MEMZ.exe	iexplore.exe
PID 1092 wrote to memory of 688	1092	iexplore.exe	IEXPLORE.EXE
PID 1092 wrote to memory of 688	1092	iexplore.exe	IEXPLORE.EXE
PID 1092 wrote to memory of 688	1092	iexplore.exe	IEXPLORE.EXE
PID 1092 wrote to memory of 688	1092	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1256

C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:616

C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1808

C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1056

C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:940

C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:880

C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /main
2⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:1244

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\System32\notepad.exe" \note.txt
3⤵
PID:524

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://google.co.ck/search?q=how+2+buy+weed
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1092

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1092 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:688

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
1e350c7a82120bd21a556e1268f13842

SHA1
e94ae45f7fd0d78c430661a8510df0ec21447a70

SHA256
01e25f6d3399db25232b4887a1c23cd20a4e1bc79fefd5842e61d977442de12a

SHA512
59c215aa8cac60c70b199193f9e54455011f17e2b5d2a92771e2ce8a355f16b335452d23fcb9271abdc5624a71d7172d5c828e465892d2a13db399d25af1070b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\k007hrg\imagestore.dat
Filesize
9KB

MD5
7fa8ea4341408f61b48da48fa07ed318

SHA1
518f42304785ff38c91a90b91ddbde6a16375d5b

SHA256
3fad5d57407402fb2529d4295d16e0233730c3474f4f3530869d728bbfa527e7

SHA512
70d9e09835c0a585cf9b89cea785049805805ef1d2f948ca604738448070e412ce03ec2907b3a990601803b5b6e125f03100109195a912a1816d14b8fe6d643d

Download Submit
C:\note.txt
Filesize
218B

MD5
afa6955439b8d516721231029fb9ca1b

SHA1
087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

SHA256
8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

SHA512
5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

Download Submit
memory/524-67-0x0000000000000000-mapping.dmp

Download
memory/616-55-0x0000000000000000-mapping.dmp

Download
memory/880-62-0x0000000000000000-mapping.dmp

Download
memory/940-61-0x0000000000000000-mapping.dmp

Download
memory/1056-59-0x0000000000000000-mapping.dmp

Download
memory/1244-65-0x0000000000000000-mapping.dmp

Download
memory/1256-54-0x0000000075951000-0x0000000075953000-memory.dmp

Filesize
8KB

Download
memory/1808-57-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads