hxxps://github[.]com/Dfmaaa/MEMZ-virus

Analysis

max time kernel
78s
max time network
77s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/02/2024, 17:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Dfmaaa/MEMZ-virus

Score

8^/10

bootkit persistence

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	MEMZ.exe
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	MEMZ.exe

Executes dropped EXE 8 IoCs

pid	Process
4840	MEMZ.exe
1096	MEMZ.exe
4260	MEMZ.exe
4080	MEMZ.exe
4648	MEMZ.exe
3160	MEMZ.exe
3780	MEMZ.exe
4400	MEMZ.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
51	raw.githubusercontent.com
52	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 612733.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4048	msedge.exe
4048	msedge.exe
3600	msedge.exe
3600	msedge.exe
2232	identity_helper.exe
2232	identity_helper.exe
3160	msedge.exe
3160	msedge.exe
1096	MEMZ.exe
1096	MEMZ.exe
4080	MEMZ.exe
4080	MEMZ.exe
4260	MEMZ.exe
4260	MEMZ.exe
1096	MEMZ.exe
1096	MEMZ.exe
4260	MEMZ.exe
4260	MEMZ.exe
4080	MEMZ.exe
4080	MEMZ.exe
3160	MEMZ.exe
4648	MEMZ.exe
4648	MEMZ.exe
3160	MEMZ.exe
4080	MEMZ.exe
4080	MEMZ.exe
4260	MEMZ.exe
4260	MEMZ.exe
1096	MEMZ.exe
1096	MEMZ.exe
1096	MEMZ.exe
4080	MEMZ.exe
4080	MEMZ.exe
1096	MEMZ.exe
4648	MEMZ.exe
4648	MEMZ.exe
3160	MEMZ.exe
3160	MEMZ.exe
1096	MEMZ.exe
1096	MEMZ.exe
4080	MEMZ.exe
4080	MEMZ.exe
4260	MEMZ.exe
4260	MEMZ.exe
4080	MEMZ.exe
3160	MEMZ.exe
3160	MEMZ.exe
4648	MEMZ.exe
4648	MEMZ.exe
4080	MEMZ.exe
3160	MEMZ.exe
3160	MEMZ.exe
4260	MEMZ.exe
4260	MEMZ.exe
1096	MEMZ.exe
1096	MEMZ.exe
4648	MEMZ.exe
4080	MEMZ.exe
4080	MEMZ.exe
4648	MEMZ.exe
3160	MEMZ.exe
3160	MEMZ.exe
4080	MEMZ.exe
4080	MEMZ.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3600 wrote to memory of 5048	3600	msedge.exe	69
PID 3600 wrote to memory of 5048	3600	msedge.exe	69
PID 3600 wrote to memory of 972	3600	msedge.exe	85
PID 3600 wrote to memory of 972	3600	msedge.exe	85
PID 3600 wrote to memory of 972	3600	msedge.exe	85
PID 3600 wrote to memory of 972	3600	msedge.exe	85
PID 3600 wrote to memory of 972	3600	msedge.exe	85
PID 3600 wrote to memory of 972	3600	msedge.exe	85
PID 3600 wrote to memory of 972	3600	msedge.exe	85
PID 3600 wrote to memory of 972	3600	msedge.exe	85
PID 3600 wrote to memory of 972	3600	msedge.exe	85
PID 3600 wrote to memory of 972	3600	msedge.exe	85
PID 3600 wrote to memory of 972	3600	msedge.exe	85
PID 3600 wrote to memory of 972	3600	msedge.exe	85
PID 3600 wrote to memory of 972	3600	msedge.exe	85
PID 3600 wrote to memory of 972	3600	msedge.exe	85
PID 3600 wrote to memory of 972	3600	msedge.exe	85
PID 3600 wrote to memory of 972	3600	msedge.exe	85
PID 3600 wrote to memory of 972	3600	msedge.exe	85
PID 3600 wrote to memory of 972	3600	msedge.exe	85
PID 3600 wrote to memory of 972	3600	msedge.exe	85
PID 3600 wrote to memory of 972	3600	msedge.exe	85
PID 3600 wrote to memory of 972	3600	msedge.exe	85
PID 3600 wrote to memory of 972	3600	msedge.exe	85
PID 3600 wrote to memory of 972	3600	msedge.exe	85
PID 3600 wrote to memory of 972	3600	msedge.exe	85
PID 3600 wrote to memory of 972	3600	msedge.exe	85
PID 3600 wrote to memory of 972	3600	msedge.exe	85
PID 3600 wrote to memory of 972	3600	msedge.exe	85
PID 3600 wrote to memory of 972	3600	msedge.exe	85
PID 3600 wrote to memory of 972	3600	msedge.exe	85
PID 3600 wrote to memory of 972	3600	msedge.exe	85
PID 3600 wrote to memory of 972	3600	msedge.exe	85
PID 3600 wrote to memory of 972	3600	msedge.exe	85
PID 3600 wrote to memory of 972	3600	msedge.exe	85
PID 3600 wrote to memory of 972	3600	msedge.exe	85
PID 3600 wrote to memory of 972	3600	msedge.exe	85
PID 3600 wrote to memory of 972	3600	msedge.exe	85
PID 3600 wrote to memory of 972	3600	msedge.exe	85
PID 3600 wrote to memory of 972	3600	msedge.exe	85
PID 3600 wrote to memory of 972	3600	msedge.exe	85
PID 3600 wrote to memory of 972	3600	msedge.exe	85
PID 3600 wrote to memory of 4048	3600	msedge.exe	84
PID 3600 wrote to memory of 4048	3600	msedge.exe	84
PID 3600 wrote to memory of 624	3600	msedge.exe	86
PID 3600 wrote to memory of 624	3600	msedge.exe	86
PID 3600 wrote to memory of 624	3600	msedge.exe	86
PID 3600 wrote to memory of 624	3600	msedge.exe	86
PID 3600 wrote to memory of 624	3600	msedge.exe	86
PID 3600 wrote to memory of 624	3600	msedge.exe	86
PID 3600 wrote to memory of 624	3600	msedge.exe	86
PID 3600 wrote to memory of 624	3600	msedge.exe	86
PID 3600 wrote to memory of 624	3600	msedge.exe	86
PID 3600 wrote to memory of 624	3600	msedge.exe	86
PID 3600 wrote to memory of 624	3600	msedge.exe	86
PID 3600 wrote to memory of 624	3600	msedge.exe	86
PID 3600 wrote to memory of 624	3600	msedge.exe	86
PID 3600 wrote to memory of 624	3600	msedge.exe	86
PID 3600 wrote to memory of 624	3600	msedge.exe	86
PID 3600 wrote to memory of 624	3600	msedge.exe	86
PID 3600 wrote to memory of 624	3600	msedge.exe	86
PID 3600 wrote to memory of 624	3600	msedge.exe	86
PID 3600 wrote to memory of 624	3600	msedge.exe	86
PID 3600 wrote to memory of 624	3600	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Dfmaaa/MEMZ-virus
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc3ad246f8,0x7ffc3ad24708,0x7ffc3ad24718
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,2804686283057191931,15535975186283234814,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,2804686283057191931,15535975186283234814,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,2804686283057191931,15535975186283234814,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,2804686283057191931,15535975186283234814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,2804686283057191931,15535975186283234814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,2804686283057191931,15535975186283234814,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,2804686283057191931,15535975186283234814,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,2804686283057191931,15535975186283234814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2100,2804686283057191931,15535975186283234814,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4796 /prefetch:8
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,2804686283057191931,15535975186283234814,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,2804686283057191931,15535975186283234814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2100,2804686283057191931,15535975186283234814,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,2804686283057191931,15535975186283234814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,2804686283057191931,15535975186283234814,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6424 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,2804686283057191931,15535975186283234814,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3160
- C:\Users\Admin\Downloads\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:4840
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1096
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4260
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4080
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4648
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3160
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /main
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    PID:3780
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe" \note.txt
      4⤵
      PID:3944
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:1864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4608

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1364

C:\Users\Admin\Downloads\MEMZ.exe
"C:\Users\Admin\Downloads\MEMZ.exe"
1⤵
- Executes dropped EXE
PID:4400
- C:\Users\Admin\Downloads\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
  2⤵
  PID:3348
- C:\Users\Admin\Downloads\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
  2⤵
  PID:4632
- C:\Users\Admin\Downloads\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
  2⤵
  PID:4128
- C:\Users\Admin\Downloads\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
  2⤵
  PID:4028
- C:\Users\Admin\Downloads\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
  2⤵
  PID:3364
- C:\Users\Admin\Downloads\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ.exe" /main
  2⤵
  PID:1072
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
011193d03a2492ca44f9a78bdfb8caa5

SHA1
71c9ead344657b55b635898851385b5de45c7604

SHA256
d21f642fdbc0f194081ffdd6a3d51b2781daef229ae6ba54c336156825b247a0

SHA512
239c7d603721c694b7902996ba576c9d56acddca4e2e7bbe500039d26d0c6edafbbdc2d9f326f01d71e162872d6ff3247366481828e0659703507878ed3dd210

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
4deaa4394eb0b882c969366ee74cd623

SHA1
42c7f1a166b3285f590f3619267ef53269e5caf7

SHA256
c7731823f36def8664f381f8faca2d7c956e4a7ce9264f2794e290c524bd6786

SHA512
719a2e362d60ebb4377c3aa6a3b66fc7433b0767684ef6ed1a80196af5a44549942c65236308138aaf1558d7d65c134de6bce0893f24dc87660ccb4d5902bd53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
76ce25dd0003895d216aec011fd48815

SHA1
82b7e4be21ebef67d9fe1b9b8025961da5a45f9a

SHA256
c0098c46f84c08915e00ce0dba99fc5c119a8b277d1525335207466a7ce2f9bb

SHA512
7926cd52bd8cb212c621ebee307fb85584c8f3b565daca95eaef7c8620b68d567334ab8da6b041ff975183fb984d73a84a5f0ae2b7a51c2a60a58a38cdb45f3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
933616222e64fb2d2434f5e96fd1614d

SHA1
c94f5b662d41082495ebe54c8e6f4ef227bf3a5d

SHA256
2410a4c56f830761efaf175dc3a034fe7d84bc27c825b8b7a5cf2f6680d6c471

SHA512
f897d9636873f9510a34e4ddd19710e5a6f15d01e2a791b1df674fd4ce254a1916494b899826cee8af8993098e437fd28025f4326dec9c4f3ab9a1ad8db246cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e69a0943af71f2968ab1e9f7aa03feec

SHA1
ba4d3ba98262550b5f55208fb12c20e04e78a6c4

SHA256
54549b79d3c702f57708753535c0004c01a9f84ffbcfdbad31c97819c61139ee

SHA512
df08013774abe877b9532645c1dae91c524f943e106301224d26b72c21127cf6d76d6afa97b89ad1eccd53edbecb508093beeefc8075ea9860267e3c92e19ca3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8fcd51ac8eb6f1571790f5b9b7ed17cc

SHA1
7acd5486890ba7cbdfe641c41b35df77463da062

SHA256
784431fb152b31f4e7ddcf226663ad68c5199fa47c9ecd8bbb532ee4cf3d0dfe

SHA512
7caba8ee9e37c77fd57930dd434f09411478589f6d015d7c315d2502e41435480ea874d88221fdc35311c0e21f03f5be01617cc6d0bfa360b73e565d7e6df4a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
42930c8e9defac116e229c5d65793dac

SHA1
8e16d1b0e3c4490dcd681f0f9d71d42d9f875d50

SHA256
fdd93b7ba4513a73404c126f4bf120c2a855d113eb2edb208500bfca2a8017c8

SHA512
86545495b9b7cbaf00f0f26af824ae79fcf40047d8e912f960fd08ecbb37cf4355c258be3c3bcd46cf6c27b50bf14363ce675307847cc4f79a579c61dea48042

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
f5b764fa779a5880b1fbe26496fe2448

SHA1
aa46339e9208e7218fb66b15e62324eb1c0722e8

SHA256
97de05bd79a3fd624c0d06f4cb63c244b20a035308ab249a5ef3e503a9338f3d

SHA512
5bfc27e6164bcd0e42cd9aec04ba6bf3a82113ba4ad85aa5d34a550266e20ea6a6e55550ae669af4c2091319e505e1309d27b7c50269c157da0f004d246fe745

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ff86b1e69cec4215ec8eab8477faea31

SHA1
cfd006de8ead0ca6ce65792b1df95cbd0bcd9e47

SHA256
221e55ab755a1c7ed5f05323f99bd5c5b4ba9a4803e96efb3f782f123b365930

SHA512
05bbfd5fbe36ae6df8ec8b5c186dcc7d18c8bc07a00d278fb5d136d8a40590ec6e2f92b6fb44a9d59f17b69b9718aa7d4fcc5f582894176f49f70806469ba34d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583989.TMP

Filesize
1KB

MD5
fb7579d298774209d11c55742cd57356

SHA1
7e85ee2ab63702d8d5b626827f31a7e0e7a222f4

SHA256
8dc22115dd89bbb4420b3758917073baa654eb5bfc9fe1c08d6884af9b5b0293

SHA512
f11c5890283e584537bb206833cd2c367871b3081affdc57b4c1f51973ccb0921b7a10c5d042e3dd7421ab98614c9c11fb15362b6532046bb7ddacc46b75ba0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
00ba924d652f203006fc7e84a1df3812

SHA1
efb34d789eb93b7017adf9948841d0023b791aaa

SHA256
011d9bb2241e324862970bd27f7c8ef163a294a10e13d5b7a91e82adb5b19f95

SHA512
54fd4accc2ab97aae9d52060b14a54cf3020c43dd2d40dda42945c5fc44c35aa783136ec8cf2519916ac49a4d1f46473a3f8ed1765318ce4ed840119f47efbe3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3417097cf54b48b4bc48d177df7b356d

SHA1
308bc47b86eecc48cd0f6d8696662fc8913c45ca

SHA256
d1b9dcb8060143a2a4d320902106382873889194a6f0394502ec32ad9dd0a870

SHA512
f665869dd94e2f142555acb91f3cc881e8ce082b22524d4989555ecd34b3d3d7d167f4e48842c5afda2873acffac2e8d9c0c0c8eff10caa1b716863adc4110c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6265f7814cfd42a85f9d3dad785e9d7b

SHA1
c3e0a841ab7b4702016bd33500c0daa1b5641e1a

SHA256
200034eef80d766d10de8dacac7772a3b58101c426a300a3d25259c297060022

SHA512
2655dbdba8cbf4b0835366e46e16f21d204b8cb8ded3356e75e2753054f3ad8272777d86fc0eedb9dc37f83e0a3e98878de03c2d5d5724cbf846c5637c6c9125

Download Submit
C:\Users\Admin\Downloads\MEMZ.exe

Filesize
16KB

MD5
1d5ad9c8d3fee874d0feb8bfac220a11

SHA1
ca6d3f7e6c784155f664a9179ca64e4034df9595

SHA256
3872c12d31fc9825e8661ac01ecee2572460677afbc7093f920a8436a42e28ff

SHA512
c8246f4137416be33b6d1ac89f2428b7c44d9376ac8489a9fbf65ef128a6c53fb50479e1e400c8e201c8611992ab1d6c1bd3d6cece89013edb4d35cdd22305b1

Download Submit
C:\note.txt

Filesize
218B

MD5
afa6955439b8d516721231029fb9ca1b

SHA1
087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

SHA256
8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

SHA512
5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

Download Submit