734403a96fad68cb2ef2b340adddd9cadd5894007aac703dcdb4a4cb8326c538

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11-03-2024 01:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eeeeeeeeeeeeee/Malware_pack_2/Malware_pack_2/MEMZ 3.0 (1)/MEMZ 3.0/MEMZ.bat
Size

12KB
MD5

13a43c26bb98449fd82d2a552877013a
SHA1

71eb7dc393ac1f204488e11f5c1eef56f1e746af
SHA256

5f52365accb76d679b2b3946870439a62eb8936b9a0595f0fb0198138106b513
SHA512

602518b238d80010fa88c2c88699f70645513963ef4f148a0345675738cf9b0c23b9aeb899d9f7830cc1e5c7e9c7147b2dc4a9222770b4a052ee0c879062cd5a
SSDEEP

384:nnLhRNiqt0kCH2LR0GPXxGiZgCz+KG/yKhLdW79HOli+lz3:nLhRN9t0SR4iZtzlREBWhuF

Score

7^/10

bootkit persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MEMZ.exeMEMZ.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	MEMZ.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	MEMZ.exe

Executes dropped EXE 7 IoCs

Processes:

MEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exe

pid process

1524 MEMZ.exe
4784 MEMZ.exe
8 MEMZ.exe
4876 MEMZ.exe
3176 MEMZ.exe
2196 MEMZ.exe
3048 MEMZ.exe
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

MEMZ.exe

description ioc process

File opened for modification \??\PhysicalDrive0 MEMZ.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1524	MEMZ.exe
4784	MEMZ.exe
8	MEMZ.exe
4876	MEMZ.exe
3176	MEMZ.exe
2196	MEMZ.exe
3048	MEMZ.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

calc.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings calc.exe
Runs regedit.exe 1 IoCs

Processes:

regedit.exe

pid process

4664 regedit.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings	calc.exe

pid	process
4664	regedit.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

MEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exe

pid	process
4784	MEMZ.exe
4784	MEMZ.exe
4784	MEMZ.exe
4784	MEMZ.exe
4876	MEMZ.exe
4876	MEMZ.exe
4784	MEMZ.exe
4784	MEMZ.exe
8	MEMZ.exe
8	MEMZ.exe
3176	MEMZ.exe
8	MEMZ.exe
8	MEMZ.exe
3176	MEMZ.exe
4784	MEMZ.exe
4784	MEMZ.exe
4876	MEMZ.exe
4876	MEMZ.exe
4876	MEMZ.exe
3176	MEMZ.exe
4876	MEMZ.exe
3176	MEMZ.exe
4784	MEMZ.exe
4784	MEMZ.exe
8	MEMZ.exe
8	MEMZ.exe
2196	MEMZ.exe
2196	MEMZ.exe
8	MEMZ.exe
2196	MEMZ.exe
2196	MEMZ.exe
8	MEMZ.exe
3176	MEMZ.exe
3176	MEMZ.exe
4784	MEMZ.exe
4784	MEMZ.exe
4876	MEMZ.exe
4876	MEMZ.exe
4876	MEMZ.exe
4876	MEMZ.exe
4784	MEMZ.exe
4784	MEMZ.exe
3176	MEMZ.exe
3176	MEMZ.exe
8	MEMZ.exe
8	MEMZ.exe
2196	MEMZ.exe
2196	MEMZ.exe
2196	MEMZ.exe
2196	MEMZ.exe
8	MEMZ.exe
8	MEMZ.exe
4784	MEMZ.exe
4784	MEMZ.exe
3176	MEMZ.exe
3176	MEMZ.exe
4876	MEMZ.exe
4876	MEMZ.exe
8	MEMZ.exe
8	MEMZ.exe
4876	MEMZ.exe
3176	MEMZ.exe
3176	MEMZ.exe
4784	MEMZ.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

4724 msedge.exe
4724 msedge.exe
4724 msedge.exe
4724 msedge.exe
4724 msedge.exe
4724 msedge.exe
4724 msedge.exe
4724 msedge.exe
4724 msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

AUDIODG.EXEtaskmgr.exe

description	pid	process
Token: 33	5844	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5844	AUDIODG.EXE
Token: SeDebugPrivilege	5192	taskmgr.exe
Token: SeSystemProfilePrivilege	5192	taskmgr.exe
Token: SeCreateGlobalPrivilege	5192	taskmgr.exe

Suspicious use of FindShellTrayWindow 46 IoCs

Processes:

msedge.exetaskmgr.exe

pid	process
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe

Suspicious use of SendNotifyMessage 45 IoCs

Processes:

msedge.exetaskmgr.exe

pid	process
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe

Suspicious use of SetWindowsHookEx 64 IoCs

Processes:

MEMZ.exeOpenWith.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exe

pid	process
3048	MEMZ.exe
3984	OpenWith.exe
4784	MEMZ.exe
3176	MEMZ.exe
4876	MEMZ.exe
8	MEMZ.exe
4876	MEMZ.exe
8	MEMZ.exe
3176	MEMZ.exe
4784	MEMZ.exe
4876	MEMZ.exe
4784	MEMZ.exe
8	MEMZ.exe
3176	MEMZ.exe
4876	MEMZ.exe
8	MEMZ.exe
3176	MEMZ.exe
4784	MEMZ.exe
4784	MEMZ.exe
3176	MEMZ.exe
4876	MEMZ.exe
8	MEMZ.exe
8	MEMZ.exe
3176	MEMZ.exe
4784	MEMZ.exe
4876	MEMZ.exe
8	MEMZ.exe
4876	MEMZ.exe
3176	MEMZ.exe
4784	MEMZ.exe
8	MEMZ.exe
4876	MEMZ.exe
3176	MEMZ.exe
4784	MEMZ.exe
4876	MEMZ.exe
3176	MEMZ.exe
4784	MEMZ.exe
8	MEMZ.exe
4784	MEMZ.exe
3176	MEMZ.exe
4876	MEMZ.exe
8	MEMZ.exe
4784	MEMZ.exe
4876	MEMZ.exe
8	MEMZ.exe
3176	MEMZ.exe
8	MEMZ.exe
4876	MEMZ.exe
3176	MEMZ.exe
4784	MEMZ.exe
8	MEMZ.exe
4876	MEMZ.exe
3176	MEMZ.exe
4784	MEMZ.exe
8	MEMZ.exe
3176	MEMZ.exe
4876	MEMZ.exe
4784	MEMZ.exe
3176	MEMZ.exe
4876	MEMZ.exe
8	MEMZ.exe
4784	MEMZ.exe
4876	MEMZ.exe
3176	MEMZ.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.exeMEMZ.exeMEMZ.exemsedge.exe

description	pid	process	target process
PID 744 wrote to memory of 5108	744	cmd.exe	cscript.exe
PID 744 wrote to memory of 5108	744	cmd.exe	cscript.exe
PID 744 wrote to memory of 1524	744	cmd.exe	MEMZ.exe
PID 744 wrote to memory of 1524	744	cmd.exe	MEMZ.exe
PID 744 wrote to memory of 1524	744	cmd.exe	MEMZ.exe
PID 1524 wrote to memory of 4784	1524	MEMZ.exe	MEMZ.exe
PID 1524 wrote to memory of 4784	1524	MEMZ.exe	MEMZ.exe
PID 1524 wrote to memory of 4784	1524	MEMZ.exe	MEMZ.exe
PID 1524 wrote to memory of 8	1524	MEMZ.exe	MEMZ.exe
PID 1524 wrote to memory of 8	1524	MEMZ.exe	MEMZ.exe
PID 1524 wrote to memory of 8	1524	MEMZ.exe	MEMZ.exe
PID 1524 wrote to memory of 4876	1524	MEMZ.exe	MEMZ.exe
PID 1524 wrote to memory of 4876	1524	MEMZ.exe	MEMZ.exe
PID 1524 wrote to memory of 4876	1524	MEMZ.exe	MEMZ.exe
PID 1524 wrote to memory of 3176	1524	MEMZ.exe	MEMZ.exe
PID 1524 wrote to memory of 3176	1524	MEMZ.exe	MEMZ.exe
PID 1524 wrote to memory of 3176	1524	MEMZ.exe	MEMZ.exe
PID 1524 wrote to memory of 2196	1524	MEMZ.exe	MEMZ.exe
PID 1524 wrote to memory of 2196	1524	MEMZ.exe	MEMZ.exe
PID 1524 wrote to memory of 2196	1524	MEMZ.exe	MEMZ.exe
PID 1524 wrote to memory of 3048	1524	MEMZ.exe	MEMZ.exe
PID 1524 wrote to memory of 3048	1524	MEMZ.exe	MEMZ.exe
PID 1524 wrote to memory of 3048	1524	MEMZ.exe	MEMZ.exe
PID 3048 wrote to memory of 3076	3048	MEMZ.exe	notepad.exe
PID 3048 wrote to memory of 3076	3048	MEMZ.exe	notepad.exe
PID 3048 wrote to memory of 3076	3048	MEMZ.exe	notepad.exe
PID 3048 wrote to memory of 3408	3048	MEMZ.exe	cmd.exe
PID 3048 wrote to memory of 3408	3048	MEMZ.exe	cmd.exe
PID 3048 wrote to memory of 3408	3048	MEMZ.exe	cmd.exe
PID 3048 wrote to memory of 4664	3048	MEMZ.exe	regedit.exe
PID 3048 wrote to memory of 4664	3048	MEMZ.exe	regedit.exe
PID 3048 wrote to memory of 4664	3048	MEMZ.exe	regedit.exe
PID 3048 wrote to memory of 2928	3048	MEMZ.exe	calc.exe
PID 3048 wrote to memory of 2928	3048	MEMZ.exe	calc.exe
PID 3048 wrote to memory of 2928	3048	MEMZ.exe	calc.exe
PID 3048 wrote to memory of 4724	3048	MEMZ.exe	msedge.exe
PID 3048 wrote to memory of 4724	3048	MEMZ.exe	msedge.exe
PID 4724 wrote to memory of 4244	4724	msedge.exe	msedge.exe
PID 4724 wrote to memory of 4244	4724	msedge.exe	msedge.exe
PID 4724 wrote to memory of 4952	4724	msedge.exe	msedge.exe
PID 4724 wrote to memory of 4952	4724	msedge.exe	msedge.exe
PID 4724 wrote to memory of 4952	4724	msedge.exe	msedge.exe
PID 4724 wrote to memory of 4952	4724	msedge.exe	msedge.exe
PID 4724 wrote to memory of 4952	4724	msedge.exe	msedge.exe
PID 4724 wrote to memory of 4952	4724	msedge.exe	msedge.exe
PID 4724 wrote to memory of 4952	4724	msedge.exe	msedge.exe
PID 4724 wrote to memory of 4952	4724	msedge.exe	msedge.exe
PID 4724 wrote to memory of 4952	4724	msedge.exe	msedge.exe
PID 4724 wrote to memory of 4952	4724	msedge.exe	msedge.exe
PID 4724 wrote to memory of 4952	4724	msedge.exe	msedge.exe
PID 4724 wrote to memory of 4952	4724	msedge.exe	msedge.exe
PID 4724 wrote to memory of 4952	4724	msedge.exe	msedge.exe
PID 4724 wrote to memory of 4952	4724	msedge.exe	msedge.exe
PID 4724 wrote to memory of 4952	4724	msedge.exe	msedge.exe
PID 4724 wrote to memory of 4952	4724	msedge.exe	msedge.exe
PID 4724 wrote to memory of 4952	4724	msedge.exe	msedge.exe
PID 4724 wrote to memory of 4952	4724	msedge.exe	msedge.exe
PID 4724 wrote to memory of 4952	4724	msedge.exe	msedge.exe
PID 4724 wrote to memory of 4952	4724	msedge.exe	msedge.exe
PID 4724 wrote to memory of 4952	4724	msedge.exe	msedge.exe
PID 4724 wrote to memory of 4952	4724	msedge.exe	msedge.exe
PID 4724 wrote to memory of 4952	4724	msedge.exe	msedge.exe
PID 4724 wrote to memory of 4952	4724	msedge.exe	msedge.exe
PID 4724 wrote to memory of 4952	4724	msedge.exe	msedge.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\eeeeeeeeeeeeee\Malware_pack_2\Malware_pack_2\MEMZ 3.0 (1)\MEMZ 3.0\MEMZ.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:744
- C:\Windows\system32\cscript.exe
  cscript x.js
  2⤵
  PID:5108
- C:\Users\Admin\AppData\Roaming\MEMZ.exe
  "C:\Users\Admin\AppData\Roaming\MEMZ.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4784
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:8
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4876
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:3176
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2196
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /main
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3048
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe" \note.txt
      4⤵
      PID:3076
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:3408
  - - C:\Windows\SysWOW64\regedit.exe
      "C:\Windows\System32\regedit.exe"
      4⤵
      Runs regedit.exe
      PID:4664
  - - C:\Windows\SysWOW64\calc.exe
      "C:\Windows\System32\calc.exe"
      4⤵
      Modifies registry class
      PID:2928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=how+to+create+your+own+ransomware
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4724
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff8eb9446f8,0x7ff8eb944708,0x7ff8eb944718
        5⤵
        
        PID:4244
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,11818300671016233646,6748930769657103264,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
        5⤵
        
        PID:4952
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,11818300671016233646,6748930769657103264,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
        5⤵
        
        PID:3680
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,11818300671016233646,6748930769657103264,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2948 /prefetch:8
        5⤵
        
        PID:760
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11818300671016233646,6748930769657103264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
        5⤵
        
        PID:4432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11818300671016233646,6748930769657103264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
        5⤵
        
        PID:3240
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11818300671016233646,6748930769657103264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
        5⤵
        
        PID:5324
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,11818300671016233646,6748930769657103264,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:8
        5⤵
        
        PID:5620
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,11818300671016233646,6748930769657103264,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:8
        5⤵
        
        PID:5636
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11818300671016233646,6748930769657103264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3676 /prefetch:1
        5⤵
        
        PID:5724
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11818300671016233646,6748930769657103264,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
        5⤵
        
        PID:5736
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11818300671016233646,6748930769657103264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
        5⤵
        
        PID:5900
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11818300671016233646,6748930769657103264,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
        5⤵
        
        PID:5908
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11818300671016233646,6748930769657103264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
        5⤵
        
        PID:5532
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11818300671016233646,6748930769657103264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
        5⤵
        
        PID:5348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=g3t+r3kt
      4⤵
      PID:3796
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff8eb9446f8,0x7ff8eb944708,0x7ff8eb944718
        5⤵
        
        PID:1540

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:764

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2d4 0x4f0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5844

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
279e783b0129b64a8529800a88fbf1ee

SHA1
204c62ec8cef8467e5729cad52adae293178744f

SHA256
3619c3b82a8cbdce37bfd88b66d4fdfcd728a1112b05eb26998bea527d187932

SHA512
32730d9124dd28c196bd4abcfd6a283a04553f3f6b050c057264bc883783d30d6602781137762e66e1f90847724d0e994bddf6e729de11a809f263f139023d3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cbec32729772aa6c576e97df4fef48f5

SHA1
6ec173d5313f27ba1e46ad66c7bbe7c0a9767dba

SHA256
d34331aa91a21e127bbe68f55c4c1898c429d9d43545c3253d317ffb105aa24e

SHA512
425b3638fed70da3bc16bba8b9878de528aca98669203f39473b931f487a614d3f66073b8c3d9bc2211e152b4bbdeceb2777001467954eec491f862912f3c7a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
194KB

MD5
f5b4137b040ec6bd884feee514f7c176

SHA1
7897677377a9ced759be35a66fdee34b391ab0ff

SHA256
845aa24ba38524f33f097b0d9bae7d9112b01fa35c443be5ec1f7b0da23513e6

SHA512
813b764a5650e4e3d1574172dd5d6a26f72c0ba5c8af7b0d676c62bc1b245e4563952bf33663bffc02089127b76a67f9977b0a8f18eaef22d9b4aa3abaaa7c40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
24KB

MD5
b82ca47ee5d42100e589bdd94e57936e

SHA1
0dad0cd7d0472248b9b409b02122d13bab513b4c

SHA256
d3c59060e591b3839ec59cad150c0a38a2a2a6ba4cc4dc5530f68be54f14ef1d

SHA512
58840a773a3a6cb0913e6a542934daecaef9c0eeab626446a29a70cd6d063fdb012229ff2ccfa283e3c05bc2a91a7cac331293965264715bdb9020f162dc7383

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f7179eac8f2206d7d623b65ed8740bf1

SHA1
745f9d020e885a55f22be834cb8725b32c672119

SHA256
a49a9b8f1a17767707260cadf66d690c597420626b47853b73642300b9e7d5fb

SHA512
94de2fa102bf941f85527782ce2e4932ccb9d83468adfb71ef6f90f9ee4ca2d3851cb86541426f26dd4289166168cfbc375e77702adedd3e8ee3c0b4712bae7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8b55a12ff19f3dad619bcbf3ba4ade6b

SHA1
098717ccc36ee39d6601e5000f4653ffe1d27c4f

SHA256
c1c22ab69231353a3181ed466368052b2e1103d873a442bfa5e68961703c1679

SHA512
7cd052244c2aae24ac5a2cea85993ec62dbf3e5b16dbfce94291a062fd542f13f5d8a526be77027c79dd77951eee03b793f3ec0af0907643dd06a60023915519

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1d5c62fd8fcf2743907c721dc3b7153c

SHA1
b0eb1209ff9f21e1bd1f24d1b28f6fc188f2214a

SHA256
31022a108bdb505280b25d300d3b237e4b7128cce599e4497629b8b19b2691a8

SHA512
6ce8acbc5cbc6818652e09edff87470adbae88431359161f2feca333f4e466cd3e61de74340cabb152c66ffaca4c592c79c4ca26930ea7a545004d79fd6fcbdf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3a4462359cda6d70edc28c469baceb66

SHA1
c4ad8add7645cd6abf26a281f1f64eabeca5a57d

SHA256
ec8088e38f1dbe08883018d1b4643967b2edeff5d10d66d1dfa21d3cd0fc8754

SHA512
6ce8d7b416b02388170b41ac19f48be2393cc56d3c37427f7b92bb018c11def9debfa894f91828ddcdb726292aa0fbb2f7b7c403c8f9d1232ad55d8af32ca255

Download Submit
C:\Users\Admin\AppData\Local\Temp\eeeeeeeeeeeeee\Malware_pack_2\Malware_pack_2\MEMZ 3.0 (1)\MEMZ 3.0\x

Filesize
10KB

MD5
fc59b7d2eb1edbb9c8cb9eb08115a98e

SHA1
90a6479ce14f8548df54c434c0a524e25efd9d17

SHA256
a05b9be9dd87492f265094146e18d628744c6b09c0e7efaabf228a9f1091a279

SHA512
3392cfc0dbddb37932e76da5a49f4e010a49aaa863c882b85cccab676cd458cfc8f880d8a0e0dc7581175f447e6b0a002da1591ecd14756650bb74996eacd2b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\eeeeeeeeeeeeee\Malware_pack_2\Malware_pack_2\MEMZ 3.0 (1)\MEMZ 3.0\x

Filesize
4KB

MD5
b6873c6cbfc8482c7f0e2dcb77fb7f12

SHA1
844b14037e1f90973a04593785dc88dfca517673

SHA256
0a0cad82d9284ccc3c07de323b76ee2d1c0b328bd2ce59073ed5ac4eb7609bd1

SHA512
f3aa3d46d970db574113f40f489ff8a5f041606e79c4ab02301b283c66ff05732be4c5edc1cf4a851da9fbaaa2f296b97fc1135210966a0e2dfc3763398dfcaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\eeeeeeeeeeeeee\Malware_pack_2\Malware_pack_2\MEMZ 3.0 (1)\MEMZ 3.0\x.js

Filesize
448B

MD5
8eec8704d2a7bc80b95b7460c06f4854

SHA1
1b34585c1fa7ec0bd0505478ac9dbb8b8d19f326

SHA256
aa01b8864b43e92077a106ed3d4656a511f3ba1910fba40c78a32ee6a621d596

SHA512
e274b92810e9a30627a65f87448d784967a2fcfbf49858cbe6ccb841f09e0f53fde253ecc1ea0c7de491d8cc56a6cf8c79d1b7c657e72928cfb0479d11035210

Download Submit
C:\Users\Admin\AppData\Local\Temp\eeeeeeeeeeeeee\Malware_pack_2\Malware_pack_2\MEMZ 3.0 (1)\MEMZ 3.0\z.zip

Filesize
7KB

MD5
cf0c19ef6909e5c1f10c8460ba9299d8

SHA1
875b575c124acfc1a4a21c1e05acb9690e50b880

SHA256
abb834ebd4b7d7f8ddf545976818f41b3cb51d2b895038a56457616d3a2c6776

SHA512
d930a022a373c283f35d103e277487c2034a0b0814913b8f6ec695b45e20528667aa830eeab58e4483d523bd6a755a16a5379095cb137db6c91909a545a19a2f

Download Submit
C:\Users\Admin\AppData\Roaming\MEMZ.exe

Filesize
12KB

MD5
a7bcf7ea8e9f3f36ebfb85b823e39d91

SHA1
761168201520c199dba68add3a607922d8d4a86e

SHA256
3ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42

SHA512
89923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523

Download Submit
C:\note.txt

Filesize
218B

MD5
afa6955439b8d516721231029fb9ca1b

SHA1
087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

SHA256
8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

SHA512
5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

Download Submit
\??\pipe\LOCAL\crashpad_4724_FUWNQDFGEXCQUODH

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/5192-281-0x000001ECF6940000-0x000001ECF6941000-memory.dmp

Filesize
4KB

Download
memory/5192-279-0x000001ECF6940000-0x000001ECF6941000-memory.dmp

Filesize
4KB

Download
memory/5192-280-0x000001ECF6940000-0x000001ECF6941000-memory.dmp

Filesize
4KB

Download
memory/5192-286-0x000001ECF6940000-0x000001ECF6941000-memory.dmp

Filesize
4KB

Download
memory/5192-291-0x000001ECF6940000-0x000001ECF6941000-memory.dmp

Filesize
4KB

Download
memory/5192-290-0x000001ECF6940000-0x000001ECF6941000-memory.dmp

Filesize
4KB

Download
memory/5192-289-0x000001ECF6940000-0x000001ECF6941000-memory.dmp

Filesize
4KB

Download
memory/5192-288-0x000001ECF6940000-0x000001ECF6941000-memory.dmp

Filesize
4KB

Download
memory/5192-287-0x000001ECF6940000-0x000001ECF6941000-memory.dmp

Filesize
4KB

Download
memory/5192-285-0x000001ECF6940000-0x000001ECF6941000-memory.dmp

Filesize
4KB

Download