4b30f308a5f0cf34361f5a53f2d73c523188adbbd9ac264275946197a3a8aa28

Resubmissions

03-03-2024 13:51

240303-q5vgpscb85 10

03-03-2024 13:45

240303-q2r76sbd9y 10

Analysis

max time kernel
150s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03-03-2024 13:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MEMZ-Destructive.exe
Size

14KB
MD5

19dbec50735b5f2a72d4199c4e184960
SHA1

6fed7732f7cb6f59743795b2ab154a3676f4c822
SHA256

a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
SHA512

aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
SSDEEP

192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj

Score

7^/10

bootkit persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MEMZ-Destructive.exeMEMZ-Destructive.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	MEMZ-Destructive.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	MEMZ-Destructive.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

Processes:

MEMZ-Destructive.exe

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ-Destructive.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

MEMZ-Destructive.exeMEMZ-Destructive.exeMEMZ-Destructive.exeMEMZ-Destructive.exeMEMZ-Destructive.exe

pid	Process
3596	MEMZ-Destructive.exe
3596	MEMZ-Destructive.exe
3596	MEMZ-Destructive.exe
3596	MEMZ-Destructive.exe
1164	MEMZ-Destructive.exe
1164	MEMZ-Destructive.exe
1164	MEMZ-Destructive.exe
404	MEMZ-Destructive.exe
404	MEMZ-Destructive.exe
1164	MEMZ-Destructive.exe
3596	MEMZ-Destructive.exe
3596	MEMZ-Destructive.exe
4472	MEMZ-Destructive.exe
4472	MEMZ-Destructive.exe
1164	MEMZ-Destructive.exe
3596	MEMZ-Destructive.exe
1164	MEMZ-Destructive.exe
3596	MEMZ-Destructive.exe
404	MEMZ-Destructive.exe
404	MEMZ-Destructive.exe
1052	MEMZ-Destructive.exe
1052	MEMZ-Destructive.exe
404	MEMZ-Destructive.exe
404	MEMZ-Destructive.exe
3596	MEMZ-Destructive.exe
3596	MEMZ-Destructive.exe
1164	MEMZ-Destructive.exe
1164	MEMZ-Destructive.exe
4472	MEMZ-Destructive.exe
4472	MEMZ-Destructive.exe
1164	MEMZ-Destructive.exe
1164	MEMZ-Destructive.exe
4472	MEMZ-Destructive.exe
4472	MEMZ-Destructive.exe
3596	MEMZ-Destructive.exe
3596	MEMZ-Destructive.exe
404	MEMZ-Destructive.exe
404	MEMZ-Destructive.exe
1052	MEMZ-Destructive.exe
1052	MEMZ-Destructive.exe
3596	MEMZ-Destructive.exe
3596	MEMZ-Destructive.exe
404	MEMZ-Destructive.exe
4472	MEMZ-Destructive.exe
404	MEMZ-Destructive.exe
4472	MEMZ-Destructive.exe
1164	MEMZ-Destructive.exe
1164	MEMZ-Destructive.exe
4472	MEMZ-Destructive.exe
1164	MEMZ-Destructive.exe
4472	MEMZ-Destructive.exe
1164	MEMZ-Destructive.exe
404	MEMZ-Destructive.exe
3596	MEMZ-Destructive.exe
404	MEMZ-Destructive.exe
3596	MEMZ-Destructive.exe
1052	MEMZ-Destructive.exe
1052	MEMZ-Destructive.exe
3596	MEMZ-Destructive.exe
404	MEMZ-Destructive.exe
3596	MEMZ-Destructive.exe
404	MEMZ-Destructive.exe
1164	MEMZ-Destructive.exe
1164	MEMZ-Destructive.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

Processes:

msedge.exe

pid	Process
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

mmc.exeAUDIODG.EXE

description	pid	Process
Token: 33	2172	mmc.exe
Token: SeIncBasePriorityPrivilege	2172	mmc.exe
Token: 33	2172	mmc.exe
Token: SeIncBasePriorityPrivilege	2172	mmc.exe
Token: 33	2172	mmc.exe
Token: SeIncBasePriorityPrivilege	2172	mmc.exe
Token: 33	4992	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4992	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	Process
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	Process
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

MEMZ-Destructive.exemmc.exemmc.exe

pid	Process
752	MEMZ-Destructive.exe
3372	mmc.exe
2172	mmc.exe
2172	mmc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

MEMZ-Destructive.exeMEMZ-Destructive.exemmc.exemsedge.exe

description	pid	Process	procid_target
PID 3968 wrote to memory of 3596	3968	MEMZ-Destructive.exe	92
PID 3968 wrote to memory of 3596	3968	MEMZ-Destructive.exe	92
PID 3968 wrote to memory of 3596	3968	MEMZ-Destructive.exe	92
PID 3968 wrote to memory of 1164	3968	MEMZ-Destructive.exe	93
PID 3968 wrote to memory of 1164	3968	MEMZ-Destructive.exe	93
PID 3968 wrote to memory of 1164	3968	MEMZ-Destructive.exe	93
PID 3968 wrote to memory of 4472	3968	MEMZ-Destructive.exe	94
PID 3968 wrote to memory of 4472	3968	MEMZ-Destructive.exe	94
PID 3968 wrote to memory of 4472	3968	MEMZ-Destructive.exe	94
PID 3968 wrote to memory of 404	3968	MEMZ-Destructive.exe	95
PID 3968 wrote to memory of 404	3968	MEMZ-Destructive.exe	95
PID 3968 wrote to memory of 404	3968	MEMZ-Destructive.exe	95
PID 3968 wrote to memory of 1052	3968	MEMZ-Destructive.exe	96
PID 3968 wrote to memory of 1052	3968	MEMZ-Destructive.exe	96
PID 3968 wrote to memory of 1052	3968	MEMZ-Destructive.exe	96
PID 3968 wrote to memory of 752	3968	MEMZ-Destructive.exe	97
PID 3968 wrote to memory of 752	3968	MEMZ-Destructive.exe	97
PID 3968 wrote to memory of 752	3968	MEMZ-Destructive.exe	97
PID 752 wrote to memory of 1980	752	MEMZ-Destructive.exe	99
PID 752 wrote to memory of 1980	752	MEMZ-Destructive.exe	99
PID 752 wrote to memory of 1980	752	MEMZ-Destructive.exe	99
PID 752 wrote to memory of 3372	752	MEMZ-Destructive.exe	103
PID 752 wrote to memory of 3372	752	MEMZ-Destructive.exe	103
PID 752 wrote to memory of 3372	752	MEMZ-Destructive.exe	103
PID 3372 wrote to memory of 2172	3372	mmc.exe	104
PID 3372 wrote to memory of 2172	3372	mmc.exe	104
PID 752 wrote to memory of 2528	752	MEMZ-Destructive.exe	105
PID 752 wrote to memory of 2528	752	MEMZ-Destructive.exe	105
PID 2528 wrote to memory of 1828	2528	msedge.exe	106
PID 2528 wrote to memory of 1828	2528	msedge.exe	106
PID 2528 wrote to memory of 3256	2528	msedge.exe	107
PID 2528 wrote to memory of 3256	2528	msedge.exe	107
PID 2528 wrote to memory of 3256	2528	msedge.exe	107
PID 2528 wrote to memory of 3256	2528	msedge.exe	107
PID 2528 wrote to memory of 3256	2528	msedge.exe	107
PID 2528 wrote to memory of 3256	2528	msedge.exe	107
PID 2528 wrote to memory of 3256	2528	msedge.exe	107
PID 2528 wrote to memory of 3256	2528	msedge.exe	107
PID 2528 wrote to memory of 3256	2528	msedge.exe	107
PID 2528 wrote to memory of 3256	2528	msedge.exe	107
PID 2528 wrote to memory of 3256	2528	msedge.exe	107
PID 2528 wrote to memory of 3256	2528	msedge.exe	107
PID 2528 wrote to memory of 3256	2528	msedge.exe	107
PID 2528 wrote to memory of 3256	2528	msedge.exe	107
PID 2528 wrote to memory of 3256	2528	msedge.exe	107
PID 2528 wrote to memory of 3256	2528	msedge.exe	107
PID 2528 wrote to memory of 3256	2528	msedge.exe	107
PID 2528 wrote to memory of 3256	2528	msedge.exe	107
PID 2528 wrote to memory of 3256	2528	msedge.exe	107
PID 2528 wrote to memory of 3256	2528	msedge.exe	107
PID 2528 wrote to memory of 3256	2528	msedge.exe	107
PID 2528 wrote to memory of 3256	2528	msedge.exe	107
PID 2528 wrote to memory of 3256	2528	msedge.exe	107
PID 2528 wrote to memory of 3256	2528	msedge.exe	107
PID 2528 wrote to memory of 3256	2528	msedge.exe	107
PID 2528 wrote to memory of 3256	2528	msedge.exe	107
PID 2528 wrote to memory of 3256	2528	msedge.exe	107
PID 2528 wrote to memory of 3256	2528	msedge.exe	107
PID 2528 wrote to memory of 3256	2528	msedge.exe	107
PID 2528 wrote to memory of 3256	2528	msedge.exe	107
PID 2528 wrote to memory of 3256	2528	msedge.exe	107
PID 2528 wrote to memory of 3256	2528	msedge.exe	107
PID 2528 wrote to memory of 3256	2528	msedge.exe	107
PID 2528 wrote to memory of 3256	2528	msedge.exe	107

C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe
"C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3968
- C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3596
- C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1164
- C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4472
- C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:404
- C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1052
- C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe" /main
  2⤵
  - Checks computer location settings
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:752
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    PID:1980
- - C:\Windows\SysWOW64\mmc.exe
    "C:\Windows\System32\mmc.exe"
    3⤵
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3372
  - - C:\Windows\system32\mmc.exe
      "C:\Windows\system32\mmc.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=montage+parody+making+program+2016
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffcc70d46f8,0x7ffcc70d4708,0x7ffcc70d4718
      4⤵
      PID:1828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,10845232431809981531,12366914375750939802,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
      4⤵
      PID:3256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,10845232431809981531,12366914375750939802,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
      4⤵
      PID:3012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,10845232431809981531,12366914375750939802,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
      4⤵
      PID:3500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10845232431809981531,12366914375750939802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
      4⤵
      PID:876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10845232431809981531,12366914375750939802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
      4⤵
      PID:4912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10845232431809981531,12366914375750939802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
      4⤵
      PID:4496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10845232431809981531,12366914375750939802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3700 /prefetch:1
      4⤵
      PID:4756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,10845232431809981531,12366914375750939802,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5532 /prefetch:8
      4⤵
      PID:2816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,10845232431809981531,12366914375750939802,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5532 /prefetch:8
      4⤵
      PID:3312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10845232431809981531,12366914375750939802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
      4⤵
      PID:2548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10845232431809981531,12366914375750939802,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
      4⤵
      PID:1368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10845232431809981531,12366914375750939802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
      4⤵
      PID:3640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10845232431809981531,12366914375750939802,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
      4⤵
      PID:4720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10845232431809981531,12366914375750939802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
      4⤵
      PID:3968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10845232431809981531,12366914375750939802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3700 /prefetch:1
      4⤵
      PID:3536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10845232431809981531,12366914375750939802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2080 /prefetch:1
      4⤵
      PID:1592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10845232431809981531,12366914375750939802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
      4⤵
      PID:3560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=montage+parody+making+program+2016
    3⤵
    PID:3620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffcc70d46f8,0x7ffcc70d4708,0x7ffcc70d4718
      4⤵
      PID:4888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=best+way+to+kill+yourself
    3⤵
    PID:2548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffcc70d46f8,0x7ffcc70d4708,0x7ffcc70d4718
      4⤵
      PID:3284

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2024

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3876

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x504 0x510
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
47b2c6613360b818825d076d14c051f7

SHA1
7df7304568313a06540f490bf3305cb89bc03e5c

SHA256
47a22bea2e7d0154c59bf5d8790ec68274eb05e9fa6cf0eab0d648121f1a02ac

SHA512
08d2366fc1ce87dbe96b9bf997e4c59c9206fcfea47c1f17b01e79aeb0580f25cac5c7349bb453a50775b2743053446653f4129f835f81f4a8547ca392557aac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e0811105475d528ab174dfdb69f935f3

SHA1
dd9689f0f70a07b4e6fb29607e42d2d5faf1f516

SHA256
c91388c87878a9e2c530c6096dbdd993b0a26fefe8ad797e0133547225032d6c

SHA512
8374a721ea3ff3a1ea70d8a074e5c193dbba27ba7e301f19cea89d648b2378c376e48310c33fe81078cd40b1863daec935e8ac22e8e3878dc3a5bb529d028852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
195KB

MD5
89d79dbf26a3c2e22ddd95766fe3173d

SHA1
f38fd066eef4cf4e72a934548eafb5f6abb00b53

SHA256
367ef9ec8dc07f84fed51cac5c75dc1ac87688bbf8f5da8e17655e7917bd7b69

SHA512
ab7ce168e6f59e2250b82ec62857c2f2b08e5a548de85ac82177ac550729287ead40382a7c8a92fbce7f53b106d199b1c8adbb770e47287fc70ea0ea858faba6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
aa532c320e68dfbbd0c57c397823252c

SHA1
65fe8ee2b1a2024d3a11ac53427f612d52d81c77

SHA256
d343ab20f23bd8090dec6038b4a02c0f94347828d5e7a1b7f5185a07d5290ce9

SHA512
c25a1f5e80845bac2f2ebc9f17a770dafe4698f29157ec27bf9aa9bfe1a40c874f844fabbb63d140363763507f762ee92bc1a92f5fa259bd549de632c0b7ad2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
b2371f274b2e9c13a40c0d700ef7802e

SHA1
d54718aad20a9eae0fdb6706709f0a3ed9eb3293

SHA256
69ffa1d901d79d3ac7c1a3c5920c273da1b98fefb0c46e53bb72381785fac0d4

SHA512
b0b914ea50a7db70c9098a2ee8eac655c1486ff631243041745dbb2cd28a702deedee58f3aad1374754f2dd28a17900b6e0ac4c5cbde36212f0082d9c60fc977

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
783B

MD5
fc56588cc0790059fb062988f4d44621

SHA1
b2a78e68c39ca65d58f5baadfa22732654aea229

SHA256
539fb77ebd4983b404d2a60c5bc84c60cad3f7def84df3d11a7eb44f6335549c

SHA512
19d50c43b9f7156a5f978a8fa74e603c5da5ae6dcc6fa5fec199eec17d3baddc05593898b79910d27e9f1b20810b78aa0e06c8d528849c37dc20911987a366c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ab7a5b60c453708113d23d5a815e6f24

SHA1
940b17bba9b3c66b108936e1e0d9a9d6c9255b55

SHA256
b948ba95815f864a2f3a41dc3e0942af4a87d4fcc90809fd6b0f42a0e4a02bb6

SHA512
a9dd26e4c022b215aa0b7a7eb003f0e94331ad2d2a341c72fb6b14d73d29cf481b9ec0a2895d074cce5ee758b4557b34f04ba46eeeaad4276b12c46412cf1f90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
adf453f1a0748e59d39fc126de895234

SHA1
4e641412d246292f28b27e3cf2dd99192207f655

SHA256
586fb89b54bf36ace066ae72459d4e5a9b7244eb224ec0d317facb9e990927a6

SHA512
7d1cd249d6ee7464d5ac02b9d03f51cab3f4ef55c721bdcb320c31c0901e37b4631cd75a0d4d748975109f580c3422e1cc49e494d529910aa9cd5fb443ebc412

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
380d725b8d513e5fa3c279197ed3ac7d

SHA1
2b7fcae29348566e21f2ca59dc2298c90a0cecb8

SHA256
7110146a823e702c6fa16d03bf4088c67b38ab39b973d5a4a16f425464a175ad

SHA512
8335c4155abb4fe280e0613e1a0152b20067554367ac7dce4e22db8fc24aae79a3f265066684728793ef5f71178b5f27af4fff747e0d99514faa38a4723e048a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
572927bbe891087c25cddf82fa6e5b4b

SHA1
835ac224e55a4304dc8da188d09b61d58b58e836

SHA256
05987e16c0339477b7b7a1c51d81427221463ee0466f39d68b42e5fdad2ead4a

SHA512
8d63a271482545e11d3fa92f0236eeeff765ab20b15d7e730e6ab27826a5780214ab888eae0491046b79203f6c6a6d692bdaa61e7ae7b7c7924a96b556be769e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5ce274de40835685a0c5e6dda88f2300

SHA1
98ef2c9474b8a3a56f79ef8174a212a567eef3df

SHA256
4354a289aee2da86cdd6a75658540a49c6cd67255e1551e339371947b8330277

SHA512
a279b4971222b6c48447974e15b910d40146ce8c25bc8b64f438795a61ac62f28faacf1643781a6cb1e28ece86fc7858c995a4d13150ad45a9722ff8d807e0df

Download Submit
C:\note.txt

Filesize
218B

MD5
afa6955439b8d516721231029fb9ca1b

SHA1
087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

SHA256
8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

SHA512
5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

Download Submit
\??\pipe\LOCAL\crashpad_2528_XOHBCOFRBTWXXFTG

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit