Analysis
-
max time kernel
50s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
19/02/2024, 16:35
Static task
static1
Behavioral task
behavioral1
Sample
MEMZ-virus
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
MEMZ-virus
Resource
win10v2004-20231215-en
General
-
Target
MEMZ-virus
-
Size
216KB
-
MD5
2244e59710fe30415f73048955f4e5bd
-
SHA1
d68a8aca7d546b1e19f978d1edc4bcd533b365ed
-
SHA256
1a526a99c81fbd03a98279c634d88543fdbdbc72376cc85b3702d4cbaca71421
-
SHA512
ce82db33b5d1b5ea90f7e45ce553ecbfa60c4b98ee2233cbb1861d59dbb524d884c10543e2cf7c2614913a7c25cd20abfde68df1bcc2345a0723938271e86158
-
SSDEEP
6144:ZDuqJJffeVSgE29xxspm0n1vuz3X9YvZJT3CqbMrhryfQNRPaCieMjAkvCJv1ViU:XffeVSgE29xxspm0n1vuz3X9YvZJT3Cf
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2988 chrome.exe 2988 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe Token: SeShutdownPrivilege 2988 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe 2988 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2988 wrote to memory of 2948 2988 chrome.exe 30 PID 2988 wrote to memory of 2948 2988 chrome.exe 30 PID 2988 wrote to memory of 2948 2988 chrome.exe 30 PID 2988 wrote to memory of 2592 2988 chrome.exe 32 PID 2988 wrote to memory of 2592 2988 chrome.exe 32 PID 2988 wrote to memory of 2592 2988 chrome.exe 32 PID 2988 wrote to memory of 2592 2988 chrome.exe 32 PID 2988 wrote to memory of 2592 2988 chrome.exe 32 PID 2988 wrote to memory of 2592 2988 chrome.exe 32 PID 2988 wrote to memory of 2592 2988 chrome.exe 32 PID 2988 wrote to memory of 2592 2988 chrome.exe 32 PID 2988 wrote to memory of 2592 2988 chrome.exe 32 PID 2988 wrote to memory of 2592 2988 chrome.exe 32 PID 2988 wrote to memory of 2592 2988 chrome.exe 32 PID 2988 wrote to memory of 2592 2988 chrome.exe 32 PID 2988 wrote to memory of 2592 2988 chrome.exe 32 PID 2988 wrote to memory of 2592 2988 chrome.exe 32 PID 2988 wrote to memory of 2592 2988 chrome.exe 32 PID 2988 wrote to memory of 2592 2988 chrome.exe 32 PID 2988 wrote to memory of 2592 2988 chrome.exe 32 PID 2988 wrote to memory of 2592 2988 chrome.exe 32 PID 2988 wrote to memory of 2592 2988 chrome.exe 32 PID 2988 wrote to memory of 2592 2988 chrome.exe 32 PID 2988 wrote to memory of 2592 2988 chrome.exe 32 PID 2988 wrote to memory of 2592 2988 chrome.exe 32 PID 2988 wrote to memory of 2592 2988 chrome.exe 32 PID 2988 wrote to memory of 2592 2988 chrome.exe 32 PID 2988 wrote to memory of 2592 2988 chrome.exe 32 PID 2988 wrote to memory of 2592 2988 chrome.exe 32 PID 2988 wrote to memory of 2592 2988 chrome.exe 32 PID 2988 wrote to memory of 2592 2988 chrome.exe 32 PID 2988 wrote to memory of 2592 2988 chrome.exe 32 PID 2988 wrote to memory of 2592 2988 chrome.exe 32 PID 2988 wrote to memory of 2592 2988 chrome.exe 32 PID 2988 wrote to memory of 2592 2988 chrome.exe 32 PID 2988 wrote to memory of 2592 2988 chrome.exe 32 PID 2988 wrote to memory of 2592 2988 chrome.exe 32 PID 2988 wrote to memory of 2592 2988 chrome.exe 32 PID 2988 wrote to memory of 2592 2988 chrome.exe 32 PID 2988 wrote to memory of 2592 2988 chrome.exe 32 PID 2988 wrote to memory of 2592 2988 chrome.exe 32 PID 2988 wrote to memory of 2592 2988 chrome.exe 32 PID 2988 wrote to memory of 2488 2988 chrome.exe 33 PID 2988 wrote to memory of 2488 2988 chrome.exe 33 PID 2988 wrote to memory of 2488 2988 chrome.exe 33 PID 2988 wrote to memory of 2516 2988 chrome.exe 34 PID 2988 wrote to memory of 2516 2988 chrome.exe 34 PID 2988 wrote to memory of 2516 2988 chrome.exe 34 PID 2988 wrote to memory of 2516 2988 chrome.exe 34 PID 2988 wrote to memory of 2516 2988 chrome.exe 34 PID 2988 wrote to memory of 2516 2988 chrome.exe 34 PID 2988 wrote to memory of 2516 2988 chrome.exe 34 PID 2988 wrote to memory of 2516 2988 chrome.exe 34 PID 2988 wrote to memory of 2516 2988 chrome.exe 34 PID 2988 wrote to memory of 2516 2988 chrome.exe 34 PID 2988 wrote to memory of 2516 2988 chrome.exe 34 PID 2988 wrote to memory of 2516 2988 chrome.exe 34 PID 2988 wrote to memory of 2516 2988 chrome.exe 34 PID 2988 wrote to memory of 2516 2988 chrome.exe 34 PID 2988 wrote to memory of 2516 2988 chrome.exe 34 PID 2988 wrote to memory of 2516 2988 chrome.exe 34 PID 2988 wrote to memory of 2516 2988 chrome.exe 34 PID 2988 wrote to memory of 2516 2988 chrome.exe 34 PID 2988 wrote to memory of 2516 2988 chrome.exe 34
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\MEMZ-virus1⤵PID:2888
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7129758,0x7fef7129768,0x7fef71297782⤵PID:2948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1192 --field-trial-handle=1212,i,9569278536376940039,7919978715138283537,131072 /prefetch:22⤵PID:2592
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1532 --field-trial-handle=1212,i,9569278536376940039,7919978715138283537,131072 /prefetch:82⤵PID:2488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1564 --field-trial-handle=1212,i,9569278536376940039,7919978715138283537,131072 /prefetch:82⤵PID:2516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2344 --field-trial-handle=1212,i,9569278536376940039,7919978715138283537,131072 /prefetch:12⤵PID:2460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2284 --field-trial-handle=1212,i,9569278536376940039,7919978715138283537,131072 /prefetch:12⤵PID:2512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2168 --field-trial-handle=1212,i,9569278536376940039,7919978715138283537,131072 /prefetch:22⤵PID:1256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3240 --field-trial-handle=1212,i,9569278536376940039,7919978715138283537,131072 /prefetch:12⤵PID:784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3760 --field-trial-handle=1212,i,9569278536376940039,7919978715138283537,131072 /prefetch:82⤵PID:1852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3724 --field-trial-handle=1212,i,9569278536376940039,7919978715138283537,131072 /prefetch:12⤵PID:1860
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:764
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
194KB
MD5ac84f1282f8542dee07f8a1af421f2a7
SHA1261885284826281a99ff982428a765be30de9029
SHA256193b8f571f3fd65b98dc39601431ff6e91ade5f90ee7790bfc1fba8f7580a4b0
SHA5129f4f58ab43ddadad903cea3454d79b99a750f05e4d850de5f25371d5bec16fc312015a875b8f418154f1124c400ae1c82e2efd862870cd35c3f0961426c8cd82
-
Filesize
168B
MD5df290c43e59f87ae3abfa0d3fba267c4
SHA14b09a5cd5bdd3569649ea38e446f8d6452861d0c
SHA256c24e4b04539bdd2652d41b6b7d3d193862191e881337bb1b600a619cc3b60eff
SHA51267cede182e00e28fd520de87b0e292eded192cfef8ead7ac17a82d4296096a93c9c44b1a5a9912f59b3d32dd8ef2a56700305c237ca9064a5816155bd9ed556e
-
Filesize
16B
MD5aefd77f47fb84fae5ea194496b44c67a
SHA1dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA2564166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
1012B
MD5201e57a3dc84003f5cc1d53781bd2a1e
SHA1f0c1a8d29c3c2d3e2296eeafc4a27b445cec29b5
SHA2568f47ba08345b790fc69c59f6831e709e03d36b35a689779578e522eedfceaa14
SHA512102305d413379aed12d5ed791d0b3e1e6e41932c46c8713a21db44bfcada56a0520ead5dd77796b133f96beac874b6022747faa722c13b6145c4ca74f00517b7
-
Filesize
5KB
MD579883bc3e93b89b6677b7f333e69c495
SHA1db7b878429c12cedc42aadb177e5ebba6e8a0e0f
SHA256a72e57a65e18d27ecc9c163fd19151469e88eeab5c3cd9f9482456c795859086
SHA51260031eefcf1ec9cb3522ecca8f44b548d9a7ec892c9670b8d2c89df6410eaa3940b1426db508fa689f2cc80a30a002af2c0e0706ced91c4433c42d394e838aeb
-
Filesize
5KB
MD569e2c95f3fef7179bc5958e14d9d48cf
SHA1029a846b70e80975a16a0aa8af6e96b3a99ebdc2
SHA25687c7e87445d9b1ddb22d225bfebf4f6bc14e20ceedb8dca093db975975112b1c
SHA51292876143fe1ec83b3647153397c66202edef23d7f01e4bc0a06a6e1f4d16a6e056330d75a4eddfbca6a04b4e015ec621e06354583ddad5a87f6a14ded7e1308b
-
Filesize
5KB
MD5526253edf51fc61ea25b977c3959eb81
SHA17cb283c76454ef31f08d694f81defe8cdc6af418
SHA256b1a771532f43c96be9afe224d870759181427300bf931857bbd77f78435f423b
SHA512b83f74e9c823ff9f3016b2d11344f97f1756f25cf8f71126598ba95a9c7418258f26dc74a8169de5e5298b9d7c44e41a90041492406796e1461f0e1354237637
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2