hxxps://github[.]com/XPower7125/memz/archive/refs/heads/main[.]zip

Resubmissions

28/06/2023, 16:19

230628-tsrf3abc5s 9

28/06/2023, 16:14

230628-tplreaac57 6

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2023, 16:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/XPower7125/memz/archive/refs/heads/main.zip

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\a768588b-9378-4996-b789-96d709a0f261.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230628161823.pma	setup.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	Taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = a482627946a4d901	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{144EC908-15CF-11EE-8DA0-EE0C9724CE29} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "394733954"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31042011"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3906873409"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\RepId\PublicId = "{3D7F3E37-CC02-4F24-8830-20E2523D7E80}"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DownloadWindowPlacement = 2c0000000000000000000000ffffffffffffffffffffffffffffffff100100003c000000900300001c020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\Software\Microsoft\Internet Explorer\RepId	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3906873409"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31042011"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000_Classes\Local Settings	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3844	MEMZ.exe
3844	MEMZ.exe
2180	MEMZ.exe
2180	MEMZ.exe
3844	MEMZ.exe
3844	MEMZ.exe
2864	MEMZ.exe
4012	MEMZ.exe
4012	MEMZ.exe
2864	MEMZ.exe
1136	MEMZ.exe
1136	MEMZ.exe
2180	MEMZ.exe
2180	MEMZ.exe
3844	MEMZ.exe
3844	MEMZ.exe
2180	MEMZ.exe
1136	MEMZ.exe
2180	MEMZ.exe
1136	MEMZ.exe
2864	MEMZ.exe
4012	MEMZ.exe
2864	MEMZ.exe
4012	MEMZ.exe
3844	MEMZ.exe
3844	MEMZ.exe
4012	MEMZ.exe
4012	MEMZ.exe
2864	MEMZ.exe
2864	MEMZ.exe
1136	MEMZ.exe
1136	MEMZ.exe
2180	MEMZ.exe
2180	MEMZ.exe
3844	MEMZ.exe
3844	MEMZ.exe
2180	MEMZ.exe
2180	MEMZ.exe
1136	MEMZ.exe
1136	MEMZ.exe
2864	MEMZ.exe
2864	MEMZ.exe
4012	MEMZ.exe
4012	MEMZ.exe
3844	MEMZ.exe
3844	MEMZ.exe
1136	MEMZ.exe
4012	MEMZ.exe
1136	MEMZ.exe
4012	MEMZ.exe
2180	MEMZ.exe
2180	MEMZ.exe
2864	MEMZ.exe
2864	MEMZ.exe
1136	MEMZ.exe
3844	MEMZ.exe
1136	MEMZ.exe
3844	MEMZ.exe
2180	MEMZ.exe
4012	MEMZ.exe
2180	MEMZ.exe
4012	MEMZ.exe
2864	MEMZ.exe
2864	MEMZ.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1176	Taskmgr.exe
Token: SeSystemProfilePrivilege	1176	Taskmgr.exe
Token: SeCreateGlobalPrivilege	1176	Taskmgr.exe
Token: 33	1176	Taskmgr.exe
Token: SeIncBasePriorityPrivilege	1176	Taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1580	iexplore.exe
1580	iexplore.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe
1176	Taskmgr.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
1580	iexplore.exe
1580	iexplore.exe
2584	IEXPLORE.EXE
2584	IEXPLORE.EXE
2436	MEMZ.exe
3844	MEMZ.exe
2180	MEMZ.exe
1136	MEMZ.exe
4012	MEMZ.exe
2864	MEMZ.exe
884	MEMZ.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 2584	1580	iexplore.exe	87
PID 1580 wrote to memory of 2584	1580	iexplore.exe	87
PID 1580 wrote to memory of 2584	1580	iexplore.exe	87
PID 2436 wrote to memory of 3844	2436	MEMZ.exe	106
PID 2436 wrote to memory of 3844	2436	MEMZ.exe	106
PID 2436 wrote to memory of 3844	2436	MEMZ.exe	106
PID 2436 wrote to memory of 2180	2436	MEMZ.exe	107
PID 2436 wrote to memory of 2180	2436	MEMZ.exe	107
PID 2436 wrote to memory of 2180	2436	MEMZ.exe	107
PID 2436 wrote to memory of 1136	2436	MEMZ.exe	108
PID 2436 wrote to memory of 1136	2436	MEMZ.exe	108
PID 2436 wrote to memory of 1136	2436	MEMZ.exe	108
PID 2436 wrote to memory of 4012	2436	MEMZ.exe	109
PID 2436 wrote to memory of 4012	2436	MEMZ.exe	109
PID 2436 wrote to memory of 4012	2436	MEMZ.exe	109
PID 2436 wrote to memory of 2864	2436	MEMZ.exe	110
PID 2436 wrote to memory of 2864	2436	MEMZ.exe	110
PID 2436 wrote to memory of 2864	2436	MEMZ.exe	110
PID 2436 wrote to memory of 884	2436	MEMZ.exe	111
PID 2436 wrote to memory of 884	2436	MEMZ.exe	111
PID 2436 wrote to memory of 884	2436	MEMZ.exe	111
PID 884 wrote to memory of 4892	884	MEMZ.exe	112
PID 884 wrote to memory of 4892	884	MEMZ.exe	112
PID 884 wrote to memory of 4892	884	MEMZ.exe	112
PID 884 wrote to memory of 1176	884	MEMZ.exe	114
PID 884 wrote to memory of 1176	884	MEMZ.exe	114
PID 884 wrote to memory of 1176	884	MEMZ.exe	114
PID 884 wrote to memory of 1616	884	MEMZ.exe	115
PID 884 wrote to memory of 1616	884	MEMZ.exe	115
PID 1616 wrote to memory of 1912	1616	msedge.exe	116
PID 1616 wrote to memory of 1912	1616	msedge.exe	116
PID 1616 wrote to memory of 4528	1616	msedge.exe	118
PID 1616 wrote to memory of 4528	1616	msedge.exe	118
PID 1616 wrote to memory of 4528	1616	msedge.exe	118
PID 1616 wrote to memory of 4528	1616	msedge.exe	118
PID 1616 wrote to memory of 4528	1616	msedge.exe	118
PID 1616 wrote to memory of 4528	1616	msedge.exe	118
PID 1616 wrote to memory of 4528	1616	msedge.exe	118
PID 1616 wrote to memory of 4528	1616	msedge.exe	118
PID 1616 wrote to memory of 4528	1616	msedge.exe	118
PID 1616 wrote to memory of 4528	1616	msedge.exe	118
PID 1616 wrote to memory of 4528	1616	msedge.exe	118
PID 1616 wrote to memory of 4528	1616	msedge.exe	118
PID 1616 wrote to memory of 4528	1616	msedge.exe	118
PID 1616 wrote to memory of 4528	1616	msedge.exe	118
PID 1616 wrote to memory of 4528	1616	msedge.exe	118
PID 1616 wrote to memory of 4528	1616	msedge.exe	118
PID 1616 wrote to memory of 4528	1616	msedge.exe	118
PID 1616 wrote to memory of 4528	1616	msedge.exe	118
PID 1616 wrote to memory of 4528	1616	msedge.exe	118
PID 1616 wrote to memory of 4528	1616	msedge.exe	118
PID 1616 wrote to memory of 4528	1616	msedge.exe	118
PID 1616 wrote to memory of 4528	1616	msedge.exe	118
PID 1616 wrote to memory of 4528	1616	msedge.exe	118
PID 1616 wrote to memory of 4528	1616	msedge.exe	118
PID 1616 wrote to memory of 4528	1616	msedge.exe	118
PID 1616 wrote to memory of 4528	1616	msedge.exe	118
PID 1616 wrote to memory of 4528	1616	msedge.exe	118
PID 1616 wrote to memory of 4528	1616	msedge.exe	118
PID 1616 wrote to memory of 4528	1616	msedge.exe	118
PID 1616 wrote to memory of 4528	1616	msedge.exe	118
PID 1616 wrote to memory of 4528	1616	msedge.exe	118
PID 1616 wrote to memory of 4528	1616	msedge.exe	118
PID 1616 wrote to memory of 4528	1616	msedge.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://github.com/XPower7125/memz/archive/refs/heads/main.zip
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1580 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2584

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1484

C:\Users\Admin\Documents\MEMZ 3.0 (1)\MEMZ 3.0\MEMZ.exe
"C:\Users\Admin\Documents\MEMZ 3.0 (1)\MEMZ 3.0\MEMZ.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Users\Admin\Documents\MEMZ 3.0 (1)\MEMZ 3.0\MEMZ.exe
  "C:\Users\Admin\Documents\MEMZ 3.0 (1)\MEMZ 3.0\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3844
- C:\Users\Admin\Documents\MEMZ 3.0 (1)\MEMZ 3.0\MEMZ.exe
  "C:\Users\Admin\Documents\MEMZ 3.0 (1)\MEMZ 3.0\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2180
- C:\Users\Admin\Documents\MEMZ 3.0 (1)\MEMZ 3.0\MEMZ.exe
  "C:\Users\Admin\Documents\MEMZ 3.0 (1)\MEMZ 3.0\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1136
- C:\Users\Admin\Documents\MEMZ 3.0 (1)\MEMZ 3.0\MEMZ.exe
  "C:\Users\Admin\Documents\MEMZ 3.0 (1)\MEMZ 3.0\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4012
- C:\Users\Admin\Documents\MEMZ 3.0 (1)\MEMZ 3.0\MEMZ.exe
  "C:\Users\Admin\Documents\MEMZ 3.0 (1)\MEMZ 3.0\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2864
- C:\Users\Admin\Documents\MEMZ 3.0 (1)\MEMZ 3.0\MEMZ.exe
  "C:\Users\Admin\Documents\MEMZ 3.0 (1)\MEMZ 3.0\MEMZ.exe" /main
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:884
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    PID:4892
- - C:\Windows\SysWOW64\Taskmgr.exe
    "C:\Windows\System32\Taskmgr.exe"
    3⤵
    - Checks SCSI registry key(s)
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pcoptimizerpro.com/
    3⤵
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa739b46f8,0x7ffa739b4708,0x7ffa739b4718
      4⤵
      PID:1912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,17148605938081799732,746155655526887500,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
      4⤵
      PID:1800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,17148605938081799732,746155655526887500,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
      4⤵
      PID:4528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,17148605938081799732,746155655526887500,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
      4⤵
      PID:980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17148605938081799732,746155655526887500,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:1
      4⤵
      PID:3372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17148605938081799732,746155655526887500,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:1
      4⤵
      PID:1520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17148605938081799732,746155655526887500,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
      4⤵
      PID:3512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,17148605938081799732,746155655526887500,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
      4⤵
      PID:3496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      PID:436
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x238,0x23c,0x240,0x218,0x244,0x7ff674715460,0x7ff674715470,0x7ff674715480
        5⤵
        
        PID:1796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,17148605938081799732,746155655526887500,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
      4⤵
      PID:4980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17148605938081799732,746155655526887500,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
      4⤵
      PID:2516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17148605938081799732,746155655526887500,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
      4⤵
      PID:3804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17148605938081799732,746155655526887500,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
      4⤵
      PID:2932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4792

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1bc17b7cd8fa734d758d912dd1736549

SHA1
93a85e1c5f57be65ecae8ead2bbfd10b56e38fe0

SHA256
d364a06a24f1b868d272c8e4fdb117a2a4c9d3e665ae2f7c5b98bd063b0371fb

SHA512
00792d3a5520d1e0db0c9dc39ae1b8ba6e2279d47dd497a89cebdf56cb060755e42fbba2271dd4a45356b931d30ac3d87fa670ffee9bc0912a209b3fe13f34d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ffa866f40e55bb7ebdcd4ead72c92045

SHA1
a069ef16ae9d7b1c99bc67e116391f97155b4acf

SHA256
7cfc1fae0160ad84303799925f5da514c3f34e9d89ce483f8b303667cbfb6e3f

SHA512
c36f6336de9349da596e4a65760006ea302ef387ac519d00ed53d70a03cbe8c6edf2b139e2e4aa4ef56d7fc8e77a79c8e5da1910c7aac304ea86862c8aba4327

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
36eb6c753e04b0ab7e3ee715dbf1aba4

SHA1
221aaaf1f19b4872771d176f3463503e7a2a5d10

SHA256
1de222d5ca1e68dcfe49474b568f2896f7cef5b24d4fb8d7a15bd94bcf6b0b53

SHA512
795e47d601542cb755a37a10ed45b11431b78af20bbcf9a9442c05499fd56d74df776f4cc2c9eab5371e11bd98c600d4287a48a6006ebed73b2cb8e7b8aca304

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
db2d0b9c86635ca2bbedc962c1467593

SHA1
79e850a54014637c77c89c7b087b5489ab7e3b88

SHA256
4052dc0b0a14feb2e0ee5ae640a1bb7f3efcf6ef8e9946b8e69bd747aaae2bb4

SHA512
5c98d7a8e71e606a10f57c4f29b159f5422cbf96a8d625ca51822db4852407d446d2e027e761bb38bcbd04344545208a9dee2cd25bed99903b3dd86c204b720e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f7e380f4d8174bf6843d4e6cf2fc42c6

SHA1
722865b7811e00584fe0b04110b155a3f09b87b5

SHA256
6b960558dd81a6ebda0f1117a48d0fece70356cdee081b0c4ad1c12c62bca876

SHA512
5a055bc23a4703f275dc2d0e0c5f0f0cf7793d89c47b3031663ef0fc4bc173fa3f318f4f680679c80df8ee08945f7d4a0b00585a194042749dfca6e1bf9162d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
9b23dcbb6869543b7a8a6121b25969ae

SHA1
e0e61709de699ea617c20b41a203956f97935515

SHA256
a4332c10225e56fc2754fcc1c303596ea5d4f7678532744baf124aac46e67a3d

SHA512
a68b2c3127be60120a2b377799ab9201eaabd2a2256e0fcf96167eb227f943f7fef3a1f036369a4e30f9c4e6184ba6c71bcf7dbae50d2e12b1be7ad915f0c5ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
77d9eef3edd1a0ea06baf1c87dea6588

SHA1
d54a7a6e898a2b2b205a2d96515d1abef0e4a0db

SHA256
1d96fab2eee85a342761ccc102d5138004cce1845795ad5720ec71a4713dca66

SHA512
8851109d2575ff2b5e9229f5065a8f35b76c79b0c582c817e718aef16f4c9018564ebe3f7e4abd055cfd26416e91fc729e5b2ce0bd41450781e088a523553b56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c1457001-be5c-40fb-8a6c-f5bcec46fa53.tmp

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1bb54480043f7eeb5fdcb2ea530dcddc

SHA1
6b990974213171c1df8ca9b28344461abd5dcd6c

SHA256
813d636968f19e8be842faf0656bb9d7218978219860cc601371a24d0d7555e4

SHA512
6ec1c0161fdc8f10a4a7f946a17fd5f21a7c426be1bfb882ce4e38e685f6e2c45af2e6766006b3149f6874b3392e986914ff020d59c81394daf4e538c21219ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6WT1PKWJ\memz-main.zip.m0zr64c.partial

Filesize
16KB

MD5
103fbf0c1c832fb7893471f0fb8afe26

SHA1
cfdc1a5ce3864e0049ca8b1cbe14f221aee5f9b4

SHA256
7a80a9cbb48c81b3bcf3a4482acb3af6f5cd2318bfbaddf9d9581d55b0540bf2

SHA512
48316225933b9fc92eee25013da06d4ddda454a0ec00e2d1dfc0af3fd31df26e6bebe49119b040449c970862794ebb9b4df460343b863a986858c957d97dd771

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\97XIF11T\memz-main[1].zip

Filesize
16KB

MD5
103fbf0c1c832fb7893471f0fb8afe26

SHA1
cfdc1a5ce3864e0049ca8b1cbe14f221aee5f9b4

SHA256
7a80a9cbb48c81b3bcf3a4482acb3af6f5cd2318bfbaddf9d9581d55b0540bf2

SHA512
48316225933b9fc92eee25013da06d4ddda454a0ec00e2d1dfc0af3fd31df26e6bebe49119b040449c970862794ebb9b4df460343b863a986858c957d97dd771

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\97XIF11T\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
5718af2e05d616cc82008b24084a410e

SHA1
f4ed901f07a51440e7f2090aea3d71ed502da644

SHA256
2569f46e043109eb212a79e752623227a8c6513778ab7e65f06ba0b0182a05d8

SHA512
0e7654f343e58f7f4044a25ad25ba9bbbda40894a41caf16b05e761244f3240d5fb6c5fea2b8e557ffa0269f2af2ef8f33f70bbbb306c0587f71ce714ea46776

Download Submit
C:\note.txt

Filesize
218B

MD5
afa6955439b8d516721231029fb9ca1b

SHA1
087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

SHA256
8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

SHA512
5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

Download Submit
memory/1176-182-0x0000000004FD0000-0x0000000004FD1000-memory.dmp

Filesize
4KB

Download
memory/1176-171-0x0000000004FD0000-0x0000000004FD1000-memory.dmp

Filesize
4KB

Download
memory/1176-172-0x0000000004FD0000-0x0000000004FD1000-memory.dmp

Filesize
4KB

Download
memory/1176-173-0x0000000004FD0000-0x0000000004FD1000-memory.dmp

Filesize
4KB

Download
memory/1176-183-0x0000000004FD0000-0x0000000004FD1000-memory.dmp

Filesize
4KB

Download
memory/1176-178-0x0000000004FD0000-0x0000000004FD1000-memory.dmp

Filesize
4KB

Download
memory/1176-181-0x0000000004FD0000-0x0000000004FD1000-memory.dmp

Filesize
4KB

Download
memory/1176-180-0x0000000004FD0000-0x0000000004FD1000-memory.dmp

Filesize
4KB

Download
memory/1176-179-0x0000000004FD0000-0x0000000004FD1000-memory.dmp

Filesize
4KB

Download
memory/1176-177-0x0000000004FD0000-0x0000000004FD1000-memory.dmp

Filesize
4KB

Download