hxxps://github[.]com/NotReal96/Malware/blob/master/MEMZ[.]md

Analysis

max time kernel
148s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240220-en
resource tags

arch:x64arch:x86image:win10v2004-20240220-enlocale:en-usos:windows10-2004-x64system
submitted
20/02/2024, 20:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/NotReal96/Malware/blob/master/MEMZ.md

Score

8^/10

upx

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
3008	NRVP (1).exe
1808	NRVP (1).exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0006000000023212-247.dat	upx
behavioral1/memory/3008-300-0x00007FF66AF20000-0x00007FF66AF2C000-memory.dmp	upx
behavioral1/memory/3008-303-0x00007FF66AF20000-0x00007FF66AF2C000-memory.dmp	upx
behavioral1/memory/1808-338-0x00007FF66AF20000-0x00007FF66AF2C000-memory.dmp	upx
behavioral1/memory/1808-341-0x00007FF66AF20000-0x00007FF66AF2C000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
64	drive.google.com
35	camo.githubusercontent.com
36	camo.githubusercontent.com
62	drive.google.com
63	drive.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4023562663-3911442808-1494947993-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\NRVP (1).exe = "11000"	NRVP (1).exe
Key created	\REGISTRY\USER\S-1-5-21-4023562663-3911442808-1494947993-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	NRVP (1).exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4023562663-3911442808-1494947993-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\NRVP (1).exe = "11000"	NRVP (1).exe
Key created	\REGISTRY\USER\S-1-5-21-4023562663-3911442808-1494947993-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	NRVP (1).exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4023562663-3911442808-1494947993-1000\{A484E9C4-4550-4F06-BD59-0DE0FDBE8280}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4023562663-3911442808-1494947993-1000_Classes\Local Settings	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 978658.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 649521.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2628	msedge.exe
2628	msedge.exe
4436	msedge.exe
4436	msedge.exe
1696	identity_helper.exe
1696	identity_helper.exe
3468	msedge.exe
3468	msedge.exe
4196	msedge.exe
4196	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
548	msedge.exe
548	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2156	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeRestorePrivilege	2156	7zFM.exe
Token: 35	2156	7zFM.exe
Token: SeRestorePrivilege	4636	7zG.exe
Token: 35	4636	7zG.exe
Token: SeSecurityPrivilege	4636	7zG.exe
Token: SeSecurityPrivilege	4636	7zG.exe
Token: SeRestorePrivilege	1432	7zG.exe
Token: 35	1432	7zG.exe
Token: SeSecurityPrivilege	1432	7zG.exe
Token: SeSecurityPrivilege	1432	7zG.exe
Token: SeRestorePrivilege	3340	7zG.exe
Token: 35	3340	7zG.exe
Token: SeSecurityPrivilege	3340	7zG.exe
Token: SeSecurityPrivilege	3340	7zG.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
2156	7zFM.exe
4636	7zG.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
1432	7zG.exe
3340	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3008	NRVP (1).exe
3008	NRVP (1).exe
1808	NRVP (1).exe
1808	NRVP (1).exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 3940	4436	msedge.exe	45
PID 4436 wrote to memory of 3940	4436	msedge.exe	45
PID 4436 wrote to memory of 2944	4436	msedge.exe	88
PID 4436 wrote to memory of 2944	4436	msedge.exe	88
PID 4436 wrote to memory of 2944	4436	msedge.exe	88
PID 4436 wrote to memory of 2944	4436	msedge.exe	88
PID 4436 wrote to memory of 2944	4436	msedge.exe	88
PID 4436 wrote to memory of 2944	4436	msedge.exe	88
PID 4436 wrote to memory of 2944	4436	msedge.exe	88
PID 4436 wrote to memory of 2944	4436	msedge.exe	88
PID 4436 wrote to memory of 2944	4436	msedge.exe	88
PID 4436 wrote to memory of 2944	4436	msedge.exe	88
PID 4436 wrote to memory of 2944	4436	msedge.exe	88
PID 4436 wrote to memory of 2944	4436	msedge.exe	88
PID 4436 wrote to memory of 2944	4436	msedge.exe	88
PID 4436 wrote to memory of 2944	4436	msedge.exe	88
PID 4436 wrote to memory of 2944	4436	msedge.exe	88
PID 4436 wrote to memory of 2944	4436	msedge.exe	88
PID 4436 wrote to memory of 2944	4436	msedge.exe	88
PID 4436 wrote to memory of 2944	4436	msedge.exe	88
PID 4436 wrote to memory of 2944	4436	msedge.exe	88
PID 4436 wrote to memory of 2944	4436	msedge.exe	88
PID 4436 wrote to memory of 2944	4436	msedge.exe	88
PID 4436 wrote to memory of 2944	4436	msedge.exe	88
PID 4436 wrote to memory of 2944	4436	msedge.exe	88
PID 4436 wrote to memory of 2944	4436	msedge.exe	88
PID 4436 wrote to memory of 2944	4436	msedge.exe	88
PID 4436 wrote to memory of 2944	4436	msedge.exe	88
PID 4436 wrote to memory of 2944	4436	msedge.exe	88
PID 4436 wrote to memory of 2944	4436	msedge.exe	88
PID 4436 wrote to memory of 2944	4436	msedge.exe	88
PID 4436 wrote to memory of 2944	4436	msedge.exe	88
PID 4436 wrote to memory of 2944	4436	msedge.exe	88
PID 4436 wrote to memory of 2944	4436	msedge.exe	88
PID 4436 wrote to memory of 2944	4436	msedge.exe	88
PID 4436 wrote to memory of 2944	4436	msedge.exe	88
PID 4436 wrote to memory of 2944	4436	msedge.exe	88
PID 4436 wrote to memory of 2944	4436	msedge.exe	88
PID 4436 wrote to memory of 2944	4436	msedge.exe	88
PID 4436 wrote to memory of 2944	4436	msedge.exe	88
PID 4436 wrote to memory of 2944	4436	msedge.exe	88
PID 4436 wrote to memory of 2944	4436	msedge.exe	88
PID 4436 wrote to memory of 2628	4436	msedge.exe	87
PID 4436 wrote to memory of 2628	4436	msedge.exe	87
PID 4436 wrote to memory of 4820	4436	msedge.exe	89
PID 4436 wrote to memory of 4820	4436	msedge.exe	89
PID 4436 wrote to memory of 4820	4436	msedge.exe	89
PID 4436 wrote to memory of 4820	4436	msedge.exe	89
PID 4436 wrote to memory of 4820	4436	msedge.exe	89
PID 4436 wrote to memory of 4820	4436	msedge.exe	89
PID 4436 wrote to memory of 4820	4436	msedge.exe	89
PID 4436 wrote to memory of 4820	4436	msedge.exe	89
PID 4436 wrote to memory of 4820	4436	msedge.exe	89
PID 4436 wrote to memory of 4820	4436	msedge.exe	89
PID 4436 wrote to memory of 4820	4436	msedge.exe	89
PID 4436 wrote to memory of 4820	4436	msedge.exe	89
PID 4436 wrote to memory of 4820	4436	msedge.exe	89
PID 4436 wrote to memory of 4820	4436	msedge.exe	89
PID 4436 wrote to memory of 4820	4436	msedge.exe	89
PID 4436 wrote to memory of 4820	4436	msedge.exe	89
PID 4436 wrote to memory of 4820	4436	msedge.exe	89
PID 4436 wrote to memory of 4820	4436	msedge.exe	89
PID 4436 wrote to memory of 4820	4436	msedge.exe	89
PID 4436 wrote to memory of 4820	4436	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/NotReal96/Malware/blob/master/MEMZ.md
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9823046f8,0x7ff982304708,0x7ff982304718
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,5365372786119861771,11807429946623115831,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,5365372786119861771,11807429946623115831,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,5365372786119861771,11807429946623115831,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5365372786119861771,11807429946623115831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5365372786119861771,11807429946623115831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,5365372786119861771,11807429946623115831,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,5365372786119861771,11807429946623115831,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5365372786119861771,11807429946623115831,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5365372786119861771,11807429946623115831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5365372786119861771,11807429946623115831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5365372786119861771,11807429946623115831,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5365372786119861771,11807429946623115831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2120,5365372786119861771,11807429946623115831,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5365372786119861771,11807429946623115831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,5365372786119861771,11807429946623115831,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3420 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3468
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\MEMZ-Clean.7z"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5365372786119861771,11807429946623115831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2120,5365372786119861771,11807429946623115831,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6476 /prefetch:8
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2120,5365372786119861771,11807429946623115831,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,5365372786119861771,11807429946623115831,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4196
- C:\Users\Admin\Downloads\NRVP (1).exe
  "C:\Users\Admin\Downloads\NRVP (1).exe"
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5365372786119861771,11807429946623115831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,5365372786119861771,11807429946623115831,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5636 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5365372786119861771,11807429946623115831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5365372786119861771,11807429946623115831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2120,5365372786119861771,11807429946623115831,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2120,5365372786119861771,11807429946623115831,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5365372786119861771,11807429946623115831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6440 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5365372786119861771,11807429946623115831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5365372786119861771,11807429946623115831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1728 /prefetch:1
  2⤵
  PID:4880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2312

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4060

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\MEMZ-Clean\" -spe -an -ai#7zMap1928:80:7zEvent11698
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4636

C:\Users\Admin\Downloads\NRVP (1).exe
"C:\Users\Admin\Downloads\NRVP (1).exe"
1⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1808

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\MEMZ-Clean\" -spe -an -ai#7zMap4745:80:7zEvent32296
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1432

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\MEMZ-Clean\" -spe -an -ai#7zMap17470:80:7zEvent16609
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b1f40e0d6ceaf161dfc1dfdddcfc44af

SHA1
b6557a6331b4c54efb30597ad4da0be03013a23e

SHA256
065557e5cddcc8022528dc82c5fd618ca28c153d6e34978d2ba84d33227eed48

SHA512
0d7fd3eabf2d2b426c627531b29e433cab175232c169a77623213b7b9935458b3067a2860137b030235526e49ca4df6867534135cf9da60697d6fa43441e7818

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
18bc1d880e1a43364e572a20540c025b

SHA1
93b7043da91e7697d7268a52ca9a434a55ddbb75

SHA256
11fcaea6cf095ba038a344829e699198e7c981149f15e30a51229b8dbca6937f

SHA512
3e8ca38dbd4d9aa865fdfa359033fb47f581b93842f1ccb667f243cc630bfabf8390cbf8ed1de6110b18819f0d831312304806667bc68fdd13ea1bb09b44742e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
229a095bbef6c71b378ce3a56b3f84d9

SHA1
3d42dd7fbcb44f7321d62abf39dd4fd33af2c888

SHA256
86032981430dae9d39cb121332051bc7785e76b7f498ded824f72f308a4128ea

SHA512
45005fa754e554d4889540846a99e891a3f3fdf7b09b00be0a7d1c75dd29706c6979f668327b6b13dbe2b25bba60c5437cc9d2a50e7e26d2522da7f3fcfaee65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
982B

MD5
b62e0374521810039a9a161c2bcac671

SHA1
1b47721b75a688196712a3c0b95f94da998d7ebc

SHA256
bbb3a97e68ea71f92752b969a9b8095eb1ffd3f59464955bcb48e07da5758bfa

SHA512
ed84684702ab1e76f5f0868c52b5b0a088c5798172f614fd2813009f7ae262ab74893bab07dde73f504e9c8e3888baefaee0f98848ad4998187f6dddecde5cbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
50335d6c7f577fc6ef3c516cc42336c2

SHA1
b2feba7932ff38bdc6c565f4d80b5d7eda352991

SHA256
ecea7a963a9eeafc1afc0c5892dc6efd0943e5f5e3e7f02ec8f476629300303c

SHA512
80b933ff00f20d98ddc1f74ee1e4726d6881671285068e774e5b6ed57ff008081b45c55ebc4ad87e88ce92655a2298c7ef9c0159f86b87d4bda7cd6b3da66eb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
72889b113256d8a66b55ed1ab283c5aa

SHA1
bcd7fc99fcc4525f8f3ef8756beaa822fb74e538

SHA256
04de266f5ed4d96d1d1febb23ab1c92538ece04713697bc5b982b23528a3cce2

SHA512
0566dc15b041c51fbf321638924bfed994399c411c818738be96b725a0e18745da451325cda5db1eeee551196a74ba376a9e51aa6e4cc46637cd54daf05edeb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4a552f86a93e085c227bbdfc50179b24

SHA1
8f7dea7d012443c4f27c9c47b1492e97c7afb399

SHA256
f83f6d56d00f334b1b3f9f233fd91c0ad8778ca2a5ca25b4764af7cdc64b0818

SHA512
c3a8ba2c4ea3ab721a3c37a595d236aaf0d3d1086c8f970a816eb5b94f952d81ec0c40c4dd1b50ae5ad495df250429b1569585a8129da9bf5794d3d9278a1fda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
50b08d3d9218edbe81815bc99b362f8f

SHA1
aefc8e2ce6d9442bd7deb7dac78bb0dcdc891cea

SHA256
8921c5c6042d1466dafa84c71ed6f30237c8d767add85b209092d39426277a3c

SHA512
30f7852c750d0d217c073e11090addb5f20c243bdc3f7157a3f59a2599e2147f3cd1b919dc7c363c622807884f4a721f8b0bf8b43eea120b6ceb6174632c06e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
47d5210eb9a9bcd8a9c1a7604bc5e8ab

SHA1
8980896ff5aa69cc8dbf400c5968a2b70b30e2ce

SHA256
ee4e1b99508c4a7b1f1f0c72ffc6aaae11189ba69c22426b8e47e0d3dc88266d

SHA512
0bc7576a1b74b60912b183f12f20a5217c50af811ba2780b66e3f2969817d1e2b831195cf8bfd9bcecd7dda83812a6786388e37837a637e837ada5ac7c56fde6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b986c480cdcaea4264ae551a1fe00b6c

SHA1
ad38be375571c5bc63dfa7a721f9fe0dd780ab84

SHA256
89773e65b2ee417e33d5dcf5ad3de59581b00a85e12780a2873d01e7ca5bdbab

SHA512
3bd6389e4cda8998341dce20ce4ceab0f2de878cf3da2f321b6790b9ba40b3882259c6106611d541813d1c64555404e2bed118a74b81ba6e4f2dc8fe9c83476f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
714457744ecbab140a6da767a34eb7da

SHA1
99f9b4547ba98c47213ded20c1e67046b2f26e3a

SHA256
5287efd3fa231b5066c4c37739b777b18bcb52201bdc0434fefd762c68b4ebaf

SHA512
519b39791d9e42c3df3329f0a3477402989e9e475d152dc7468599dc0685d061c7ee9c14ffa5cc0ee886ba6af979eb8636d27fd6785198a3f775898edeb13fc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b81b5d92f9372fce3fc17c2ae80a58c1

SHA1
4afc4d0752310780e1bf2860850054038420d090

SHA256
cd8fa056f6d9e38997d8d5d9bb97a7568599e3ca7c35617364fe786b71f0474c

SHA512
49602d779762658ff2dfd483f644f851df45aa613ec81e510b15f24e918fd3cc4302e0c57c967f5bff38daa90b325f82b6df7bb25b13070a7f0febbc25884bd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
69a32c33d66506a6c81e3d005c71bbc7

SHA1
32739cf46496830574c40293bf15f47e8a5e2447

SHA256
33e26b706c2182f484404d1e82a254ce7c2d751ea138bc226ee68f3b06c6466d

SHA512
9545c2f44cf2a16d73443bf7aebfad2833507b71e865be4a56a017fd21b5ded650239ccb31988a7e9e37dec7b7b3147231a79ff5571809f1fd04fcd3b88b7f08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c07b2c174498d6e6a8d0190f5130379d

SHA1
2e59e0bb4380bef29feaef70115f8b5af4bb8c40

SHA256
356aa2e10c9536115ab19e7623b3f259b2b9809a27bbe0acb2433ea9eb44b98c

SHA512
669b71833c92bc67339820100e1480b4d4d1896247cac91735a8a0f8c551f3589fbf8d2fe862eea581d8d141f1b6d9637432624a552cb7698f3a3b5ed6015ec5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7c6986be07cd20fa3f7e587ec33378c9

SHA1
a36185d66290e934624098a47af2e454a7846a6b

SHA256
5a0a4c07da3829c2cbe91f91e5e37141d7afc29119fb0a3c40e15228b64d67ae

SHA512
346e948e85280dc23d63d3a67769ca8fe94264639e75c24c9fa21e6e8d08d13af3ae033a8526f65f580ebce30eee9a2d4f79cd82b24189fcd101b4da6144a44a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58177b.TMP

Filesize
1KB

MD5
9cfa3835df57a4280d6efc2a1c0ac2e4

SHA1
b64232026a5fbe9d58c8353526b6f514c62d47a1

SHA256
603677ebe49995e54a5dd8e6e8f1d80969bffc7a8907bf33d61e226f3802d1d6

SHA512
32ea58f4a7d88252dd1ff0fd70e92d1b4749f394d7a012a6bd1af6ff29acbf3ae37197fdba0df16ea46c404ea696b0ecf5aa46c47396c896601cc0f415b6ce0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
2aaac554925e1c1de7b75d7370ebb692

SHA1
188c9752a7f873b919cc3ca6fe56726c869d8421

SHA256
0b0910444924be1178cd51b9a7b7b1ad685b765d398772e3696709618b42f077

SHA512
a35294fc7b3129ce602a47fb2122ebaebdac55ac16c5509ee8a1940a65b6ce5c316f95b375f16209141ad61ac6581528d5dd14b00d7a83db520e8a686a750e72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b63d6eaef805bb1b1ed38a314ff29e6d

SHA1
5957bc312fba52c34217c3e7d3c0e48c8cdb6345

SHA256
cd6f047f1de9f2b95fe1a5d096d31f53461461110d916905b1dfbdfa7e1b2564

SHA512
61c70a9aa70a1ce1c574b2e15c08bc9a68b136780cf45af9b9dbb21fe3acde812662de64789fafda69b2c79adebfe74d842137970ef39371c276932d134cbd1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
12135848a4707430edde46eca29fd460

SHA1
da6bfdde07b852c3faa986f4fa3fc95b351da170

SHA256
098daad2e271d1068e86ac2bf0ec9d357adfa38db8b2908d75d22251d53d55ba

SHA512
769b0499e8b7a829ff9529061aec110e15ee5e03c5fe65996ce39b61092354c876cf3d6147bb6aa45269857f5b21c459b130e68f5ab612f9e6e4a225387d1d67

Download Submit
C:\Users\Admin\Downloads\9436edd3-6584-483d-9baa-12bbfa84139d.tmp

Filesize
9KB

MD5
f7349874043c175bee2d0ff66438cbf0

SHA1
da371495289e25e92ad5d73dff6f29beea422427

SHA256
f852b9baeeefde61a20e5de4751b978594a9bf3b34514bc652d01224ee76da1b

SHA512
878f4bc1ab1b84b993725bcf2e98b1b9dcb72f75a20e34287d13016cc72f1df0334ac630aa8604a3d25b9569be2541c8f18f4f644f5f31ff31dd2d3fedd6d1ad

Download Submit
C:\Users\Admin\Downloads\MEMZ-Clean.7z

Filesize
12KB

MD5
e3913d6da93c11310a868c0a5eece687

SHA1
c225d118f984835ec422a40ca35ebde2d9c457a9

SHA256
900882620b2e79da266c1b140c9199dd9c9d11291a7fdd5e29149d1e04b9cef7

SHA512
4e3dd55ac9cc4fd9c9c407f5cc7b181a634179cf55b5b1acb285519590d5db7639ee86a938e7dee0c50b571b2e50f8475f6ba62108e15d72ed3f0f01d98a340e

Download Submit
memory/1808-338-0x00007FF66AF20000-0x00007FF66AF2C000-memory.dmp

Filesize
48KB

Download
memory/1808-341-0x00007FF66AF20000-0x00007FF66AF2C000-memory.dmp

Filesize
48KB

Download
memory/3008-300-0x00007FF66AF20000-0x00007FF66AF2C000-memory.dmp

Filesize
48KB

Download
memory/3008-303-0x00007FF66AF20000-0x00007FF66AF2C000-memory.dmp

Filesize
48KB

Download