hxxps://github[.]com/Endermanch/MalwareDatabase/blob/master/trojans/MEMZ[.]zip

Resubmissions

01-04-2023 06:48

230401-hladeshh3w 6

01-04-2023 06:45

230401-hjjt3sge34 6

Analysis

max time kernel
48s
max time network
76s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
01-04-2023 06:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Endermanch/MalwareDatabase/blob/master/trojans/MEMZ.zip

Score

6^/10

bootkit persistence

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

Endermanch@MEMZ.exe

description ioc process

File opened for modification \??\PhysicalDrive0 Endermanch@MEMZ.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	Endermanch@MEMZ.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133248125585018199"	chrome.exe

Modifies registry class 1 IoCs

Processes:

chrome.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

chrome.exeEndermanch@MEMZ.exeEndermanch@MEMZ.exeEndermanch@MEMZ.exeEndermanch@MEMZ.exeEndermanch@MEMZ.exe

pid	process
4796	chrome.exe
4796	chrome.exe
3904	Endermanch@MEMZ.exe
3792	Endermanch@MEMZ.exe
3904	Endermanch@MEMZ.exe
3792	Endermanch@MEMZ.exe
2076	Endermanch@MEMZ.exe
2076	Endermanch@MEMZ.exe
464	Endermanch@MEMZ.exe
3904	Endermanch@MEMZ.exe
464	Endermanch@MEMZ.exe
3904	Endermanch@MEMZ.exe
3792	Endermanch@MEMZ.exe
3792	Endermanch@MEMZ.exe
1448	Endermanch@MEMZ.exe
1448	Endermanch@MEMZ.exe
3792	Endermanch@MEMZ.exe
3792	Endermanch@MEMZ.exe
464	Endermanch@MEMZ.exe
464	Endermanch@MEMZ.exe
2076	Endermanch@MEMZ.exe
2076	Endermanch@MEMZ.exe
3904	Endermanch@MEMZ.exe
3904	Endermanch@MEMZ.exe
1448	Endermanch@MEMZ.exe
1448	Endermanch@MEMZ.exe
3904	Endermanch@MEMZ.exe
3904	Endermanch@MEMZ.exe
2076	Endermanch@MEMZ.exe
2076	Endermanch@MEMZ.exe
464	Endermanch@MEMZ.exe
464	Endermanch@MEMZ.exe
3792	Endermanch@MEMZ.exe
3792	Endermanch@MEMZ.exe
1448	Endermanch@MEMZ.exe
1448	Endermanch@MEMZ.exe
464	Endermanch@MEMZ.exe
2076	Endermanch@MEMZ.exe
464	Endermanch@MEMZ.exe
2076	Endermanch@MEMZ.exe
3904	Endermanch@MEMZ.exe
3904	Endermanch@MEMZ.exe
1448	Endermanch@MEMZ.exe
1448	Endermanch@MEMZ.exe
3792	Endermanch@MEMZ.exe
3792	Endermanch@MEMZ.exe
2076	Endermanch@MEMZ.exe
2076	Endermanch@MEMZ.exe
464	Endermanch@MEMZ.exe
464	Endermanch@MEMZ.exe
3904	Endermanch@MEMZ.exe
3904	Endermanch@MEMZ.exe
3904	Endermanch@MEMZ.exe
3904	Endermanch@MEMZ.exe
464	Endermanch@MEMZ.exe
2076	Endermanch@MEMZ.exe
464	Endermanch@MEMZ.exe
2076	Endermanch@MEMZ.exe
3792	Endermanch@MEMZ.exe
3792	Endermanch@MEMZ.exe
1448	Endermanch@MEMZ.exe
1448	Endermanch@MEMZ.exe
1448	Endermanch@MEMZ.exe
1448	Endermanch@MEMZ.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

chrome.exe

pid process

4796 chrome.exe
4796 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe

Suspicious use of FindShellTrayWindow 59 IoCs

Processes:

chrome.exetaskmgr.exe

pid	process
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4712	taskmgr.exe
4712	taskmgr.exe
4712	taskmgr.exe
4712	taskmgr.exe
4712	taskmgr.exe
4712	taskmgr.exe
4712	taskmgr.exe
4712	taskmgr.exe
4712	taskmgr.exe
4712	taskmgr.exe
4712	taskmgr.exe
4712	taskmgr.exe
4712	taskmgr.exe
4712	taskmgr.exe
4712	taskmgr.exe
4712	taskmgr.exe
4712	taskmgr.exe
4712	taskmgr.exe
4712	taskmgr.exe
4712	taskmgr.exe
4712	taskmgr.exe
4712	taskmgr.exe
4712	taskmgr.exe
4712	taskmgr.exe
4712	taskmgr.exe
4712	taskmgr.exe

Suspicious use of SendNotifyMessage 50 IoCs

Processes:

chrome.exetaskmgr.exe

pid	process
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4712	taskmgr.exe
4712	taskmgr.exe
4712	taskmgr.exe
4712	taskmgr.exe
4712	taskmgr.exe
4712	taskmgr.exe
4712	taskmgr.exe
4712	taskmgr.exe
4712	taskmgr.exe
4712	taskmgr.exe
4712	taskmgr.exe
4712	taskmgr.exe
4712	taskmgr.exe
4712	taskmgr.exe
4712	taskmgr.exe
4712	taskmgr.exe
4712	taskmgr.exe
4712	taskmgr.exe
4712	taskmgr.exe
4712	taskmgr.exe
4712	taskmgr.exe
4712	taskmgr.exe
4712	taskmgr.exe
4712	taskmgr.exe
4712	taskmgr.exe
4712	taskmgr.exe

Suspicious use of SetWindowsHookEx 64 IoCs

Processes:

Endermanch@MEMZ.exeEndermanch@MEMZ.exeEndermanch@MEMZ.exeEndermanch@MEMZ.exeEndermanch@MEMZ.exeEndermanch@MEMZ.exeEndermanch@MEMZ.exe

pid	process
3516	Endermanch@MEMZ.exe
3792	Endermanch@MEMZ.exe
3904	Endermanch@MEMZ.exe
1448	Endermanch@MEMZ.exe
464	Endermanch@MEMZ.exe
2076	Endermanch@MEMZ.exe
3880	Endermanch@MEMZ.exe
3904	Endermanch@MEMZ.exe
2076	Endermanch@MEMZ.exe
1448	Endermanch@MEMZ.exe
464	Endermanch@MEMZ.exe
1448	Endermanch@MEMZ.exe
3904	Endermanch@MEMZ.exe
2076	Endermanch@MEMZ.exe
464	Endermanch@MEMZ.exe
2076	Endermanch@MEMZ.exe
3904	Endermanch@MEMZ.exe
1448	Endermanch@MEMZ.exe
464	Endermanch@MEMZ.exe
1448	Endermanch@MEMZ.exe
3904	Endermanch@MEMZ.exe
2076	Endermanch@MEMZ.exe
464	Endermanch@MEMZ.exe
3904	Endermanch@MEMZ.exe
2076	Endermanch@MEMZ.exe
1448	Endermanch@MEMZ.exe
464	Endermanch@MEMZ.exe
2076	Endermanch@MEMZ.exe
3904	Endermanch@MEMZ.exe
1448	Endermanch@MEMZ.exe
464	Endermanch@MEMZ.exe
1448	Endermanch@MEMZ.exe
3904	Endermanch@MEMZ.exe
2076	Endermanch@MEMZ.exe
464	Endermanch@MEMZ.exe
2076	Endermanch@MEMZ.exe
3904	Endermanch@MEMZ.exe
1448	Endermanch@MEMZ.exe
464	Endermanch@MEMZ.exe
1448	Endermanch@MEMZ.exe
2076	Endermanch@MEMZ.exe
3904	Endermanch@MEMZ.exe
464	Endermanch@MEMZ.exe
3904	Endermanch@MEMZ.exe
2076	Endermanch@MEMZ.exe
1448	Endermanch@MEMZ.exe
464	Endermanch@MEMZ.exe
2076	Endermanch@MEMZ.exe
1448	Endermanch@MEMZ.exe
3904	Endermanch@MEMZ.exe
464	Endermanch@MEMZ.exe
3904	Endermanch@MEMZ.exe
2076	Endermanch@MEMZ.exe
1448	Endermanch@MEMZ.exe
464	Endermanch@MEMZ.exe
1448	Endermanch@MEMZ.exe
2076	Endermanch@MEMZ.exe
3904	Endermanch@MEMZ.exe
464	Endermanch@MEMZ.exe
1448	Endermanch@MEMZ.exe
2076	Endermanch@MEMZ.exe
3904	Endermanch@MEMZ.exe
464	Endermanch@MEMZ.exe
1448	Endermanch@MEMZ.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 4796 wrote to memory of 3112	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 3112	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 820	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 820	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 820	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 820	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 820	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 820	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 820	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 820	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 820	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 820	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 820	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 820	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 820	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 820	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 820	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 820	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 820	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 820	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 820	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 820	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 820	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 820	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 820	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 820	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 820	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 820	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 820	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 820	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 820	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 820	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 820	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 820	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 820	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 820	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 820	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 820	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 820	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 820	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 4952	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 4952	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 1584	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 1584	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 1584	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 1584	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 1584	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 1584	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 1584	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 1584	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 1584	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 1584	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 1584	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 1584	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 1584	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 1584	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 1584	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 1584	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 1584	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 1584	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 1584	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 1584	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 1584	4796	chrome.exe	chrome.exe
PID 4796 wrote to memory of 1584	4796	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://github.com/Endermanch/MalwareDatabase/blob/master/trojans/MEMZ.zip
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4796

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b6039758,0x7ff9b6039768,0x7ff9b6039778
2⤵
PID:3112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1784 --field-trial-handle=1816,i,8140072110659462440,6080492138505256520,131072 /prefetch:2
2⤵
PID:820

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1816,i,8140072110659462440,6080492138505256520,131072 /prefetch:8
2⤵
PID:4952

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2228 --field-trial-handle=1816,i,8140072110659462440,6080492138505256520,131072 /prefetch:8
2⤵
PID:1584

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3180 --field-trial-handle=1816,i,8140072110659462440,6080492138505256520,131072 /prefetch:1
2⤵
PID:3688

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3196 --field-trial-handle=1816,i,8140072110659462440,6080492138505256520,131072 /prefetch:1
2⤵
PID:3736

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5032 --field-trial-handle=1816,i,8140072110659462440,6080492138505256520,131072 /prefetch:8
2⤵
PID:4280

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5112 --field-trial-handle=1816,i,8140072110659462440,6080492138505256520,131072 /prefetch:8
2⤵
PID:3904

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4892 --field-trial-handle=1816,i,8140072110659462440,6080492138505256520,131072 /prefetch:8
2⤵
PID:1788

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4688 --field-trial-handle=1816,i,8140072110659462440,6080492138505256520,131072 /prefetch:8
2⤵
PID:1764

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3776

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3728

C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\Endermanch@MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\Endermanch@MEMZ.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3516

C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\Endermanch@MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\Endermanch@MEMZ.exe" /watchdog
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3792

C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\Endermanch@MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\Endermanch@MEMZ.exe" /watchdog
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3904

C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\Endermanch@MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\Endermanch@MEMZ.exe" /watchdog
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1448

C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\Endermanch@MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\Endermanch@MEMZ.exe" /watchdog
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:464

C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\Endermanch@MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\Endermanch@MEMZ.exe" /watchdog
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2076

C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\Endermanch@MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\Endermanch@MEMZ.exe" /main
2⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
PID:3880

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\System32\notepad.exe" \note.txt
3⤵
PID:4964

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4712

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
01c1f1d18b676fe25d7a2eb3d2aaee4e

SHA1
b0ca4f44a3c68ba39ff98ba220a4f063a3e047b7

SHA256
9e1c168d693e4d999ad05bef0ddaacf141614c7c59cfc0009dfde5854993bae4

SHA512
8f01d7cf2d396ad6c9861c39c40b1e4443508a7907d78e801f82f04d3f999e9232fab3abc2756cecad3203b5a105637515ea1f1b450062a0c6969140ede365bc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
67a6a5ae60763aeb7fd88b3165a00616

SHA1
2af58a675a916e893474b15cc22ff686994f2b55

SHA256
774efadd613ed1b85fd19150846d93953943db811deeac3d0bd07a45152a64c6

SHA512
0e414e2eacbddb532aecfa576ec9b1eeacaeb814f921e899262ea5a32866cfd7c50d1c6836e9595756dde819839db69dae2dbbb812a9fa12b4ca0a1f0710bcec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
95d260ea83a5c03afd4e132b7b92fabe

SHA1
be26914fb2f0cc0b20f824b84fc9772ae7ca71e1

SHA256
b3de29a27d109a90504c6de537fa679a35ee1956b45b1926851bd9078eab27d5

SHA512
360f521a111fd4fc873a3e6d8cdde894e9d80655f8882cacf55c162929705f8a42b3c0564bed1895f3a3009699923cff2ea5eef0a8ec8ce1aeedf10a0bf6d5c0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
15KB

MD5
8003013da8e0838eba00eb261ee3bc0c

SHA1
57dcbac1f856d2c029c37027fbac8a41186be9cd

SHA256
7947301f56c269262126f6fc26740cfac54f6a31a2f436cb6cf92612d576f996

SHA512
db79fb4040caa4deb582158d9864d93a86e71b3ad2ba7c39663531c09814f3103030d5cd8f24ca47c7631a73b1fe13534b6421cac5c158266243c382f3e771c4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
173KB

MD5
5cb5720c6c74c5fd350f035ea0c72e83

SHA1
500b60dfdb17d95a463e711acb952030aba1aac1

SHA256
82b2bab01b9088c031bb101540c3d4133966bc7ca133b2ec738cd49db1c947d6

SHA512
c12f5d88da24b2a04ec068381a34a8efe710fca4f21fe286394c7b82c13fdefe50315f8671c55eb4dd4031575096d209e7d281cfac2473ce1c007afe21a852d6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\Downloads\MEMZ.zip
Filesize
8KB

MD5
69977a5d1c648976d47b69ea3aa8fcaa

SHA1
4630cc15000c0d3149350b9ecda6cfc8f402938a

SHA256
61ca4d8dd992c763b47bebb9b5facb68a59ff0a594c2ff215aa4143b593ae9dc

SHA512
ba0671c72cd4209fabe0ee241b71e95bd9d8e78d77a893c94f87de5735fd10ea8b389cf4c48462910042c312ddff2f527999cd2f845d0c19a8673dbceda369fd

Download Submit
C:\note.txt
Filesize
218B

MD5
afa6955439b8d516721231029fb9ca1b

SHA1
087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

SHA256
8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

SHA512
5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

Download Submit
\??\pipe\crashpad_4796_LJSNKWCPKHNCERXJ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/4712-265-0x0000024F8AB30000-0x0000024F8AB31000-memory.dmp

Filesize
4KB

Download
memory/4712-266-0x0000024F8AB30000-0x0000024F8AB31000-memory.dmp

Filesize
4KB

Download
memory/4712-267-0x0000024F8AB30000-0x0000024F8AB31000-memory.dmp

Filesize
4KB

Download
memory/4712-271-0x0000024F8AB30000-0x0000024F8AB31000-memory.dmp

Filesize
4KB

Download
memory/4712-272-0x0000024F8AB30000-0x0000024F8AB31000-memory.dmp

Filesize
4KB

Download
memory/4712-273-0x0000024F8AB30000-0x0000024F8AB31000-memory.dmp

Filesize
4KB

Download
memory/4712-274-0x0000024F8AB30000-0x0000024F8AB31000-memory.dmp

Filesize
4KB

Download
memory/4712-275-0x0000024F8AB30000-0x0000024F8AB31000-memory.dmp

Filesize
4KB

Download
memory/4712-276-0x0000024F8AB30000-0x0000024F8AB31000-memory.dmp

Filesize
4KB

Download
memory/4712-277-0x0000024F8AB30000-0x0000024F8AB31000-memory.dmp

Filesize
4KB

Download