Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
17s -
max time network
19s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
13/03/2024, 03:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
MEMZ.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
MEMZ.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
MEMZ.exe
-
Size
16KB
-
MD5
1d5ad9c8d3fee874d0feb8bfac220a11
-
SHA1
ca6d3f7e6c784155f664a9179ca64e4034df9595
-
SHA256
3872c12d31fc9825e8661ac01ecee2572460677afbc7093f920a8436a42e28ff
-
SHA512
c8246f4137416be33b6d1ac89f2428b7c44d9376ac8489a9fbf65ef128a6c53fb50479e1e400c8e201c8611992ab1d6c1bd3d6cece89013edb4d35cdd22305b1
-
SSDEEP
192:M2WgyvSW8gRc6olcIEiwqZKBkDFR43xWTM3LHf26gFrcx3sNq:JWgnSmFlcIqq3agmLH+6gF23sN
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation MEMZ.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 MEMZ.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5084 MEMZ.exe 5084 MEMZ.exe 5084 MEMZ.exe 5084 MEMZ.exe 5084 MEMZ.exe 5056 MEMZ.exe 5084 MEMZ.exe 5056 MEMZ.exe 5084 MEMZ.exe 5056 MEMZ.exe 5056 MEMZ.exe 5084 MEMZ.exe 5084 MEMZ.exe 5056 MEMZ.exe 5084 MEMZ.exe 5056 MEMZ.exe 3292 MEMZ.exe 3292 MEMZ.exe 5056 MEMZ.exe 5084 MEMZ.exe 5056 MEMZ.exe 5084 MEMZ.exe 5084 MEMZ.exe 3508 MEMZ.exe 5084 MEMZ.exe 3508 MEMZ.exe 5056 MEMZ.exe 5056 MEMZ.exe 3292 MEMZ.exe 3292 MEMZ.exe 5084 MEMZ.exe 5084 MEMZ.exe 5084 MEMZ.exe 3292 MEMZ.exe 3292 MEMZ.exe 5084 MEMZ.exe 5056 MEMZ.exe 5056 MEMZ.exe 4464 MEMZ.exe 4464 MEMZ.exe 3508 MEMZ.exe 3508 MEMZ.exe 3292 MEMZ.exe 3292 MEMZ.exe 5084 MEMZ.exe 5084 MEMZ.exe 5084 MEMZ.exe 3508 MEMZ.exe 3508 MEMZ.exe 5084 MEMZ.exe 5056 MEMZ.exe 4464 MEMZ.exe 5056 MEMZ.exe 4464 MEMZ.exe 3508 MEMZ.exe 5084 MEMZ.exe 3508 MEMZ.exe 5084 MEMZ.exe 3292 MEMZ.exe 3292 MEMZ.exe 5084 MEMZ.exe 3508 MEMZ.exe 3508 MEMZ.exe 5084 MEMZ.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3404 wrote to memory of 5084 3404 MEMZ.exe 103 PID 3404 wrote to memory of 5084 3404 MEMZ.exe 103 PID 3404 wrote to memory of 5084 3404 MEMZ.exe 103 PID 3404 wrote to memory of 5056 3404 MEMZ.exe 104 PID 3404 wrote to memory of 5056 3404 MEMZ.exe 104 PID 3404 wrote to memory of 5056 3404 MEMZ.exe 104 PID 3404 wrote to memory of 3292 3404 MEMZ.exe 105 PID 3404 wrote to memory of 3292 3404 MEMZ.exe 105 PID 3404 wrote to memory of 3292 3404 MEMZ.exe 105 PID 3404 wrote to memory of 3508 3404 MEMZ.exe 106 PID 3404 wrote to memory of 3508 3404 MEMZ.exe 106 PID 3404 wrote to memory of 3508 3404 MEMZ.exe 106 PID 3404 wrote to memory of 4464 3404 MEMZ.exe 107 PID 3404 wrote to memory of 4464 3404 MEMZ.exe 107 PID 3404 wrote to memory of 4464 3404 MEMZ.exe 107 PID 3404 wrote to memory of 1540 3404 MEMZ.exe 108 PID 3404 wrote to memory of 1540 3404 MEMZ.exe 108 PID 3404 wrote to memory of 1540 3404 MEMZ.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5084
-
-
C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5056
-
-
C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3292
-
-
C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3508
-
-
C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4464
-
-
C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /main2⤵
- Writes to the Master Boot Record (MBR)
PID:1540 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe" \note.txt3⤵PID:3528
-
-