Analysis
- max time kernel
92s - max time network
115s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
24/03/2024, 19:50
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
Client-built.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
18 signatures
150 seconds
General
- Target Client-built.exe
- Size 78KB
- Sample240324-ykgdcaff89
- SHA256 a938ff9ba13e88cd2989b4e7c4ec27805242a5da86d23d6ff7fbe0a1a868ba4f
- MD5 6efc303244df90861ea895d5e32391ab
- SHA1 58a6c06a60b2c5c9d54a78ef217fd7ed1edc7747
- SHA512 e943190ca72652b912f30f8620ceb06a850502cc2c088583a82b27e18ce46a0f9f7312812b6cbeb1aa4d045b7349b6828f55e95fca60586bd210944e89f857a5
- SSDEEP 1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+NPIC:5Zv5PDwbjNrmAE+dIC
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
discordrat
Attributes
-
discord_token
MTIyMTU0MzQwNjU4MTMyMTc2OA.GnG4Nm.0S3-zLC_CuQZnYYEbaguj4NVMBsyRSCgReVpu8
-
server_id
1221543160388259971
Signatures
- Discord RAT
A RAT written in C# using Discord as a C2.
- Downloads MZ/PE file
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation MEMZ.exe Key value queried \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation MEMZ.exe - Executes dropped EXE 7 IoCs
pid Process 6016 MEMZ.exe 5988 MEMZ.exe 5956 MEMZ.exe 2396 MEMZ.exe 5276 MEMZ.exe 3024 MEMZ.exe 2136 MEMZ.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 110 raw.githubusercontent.com 111 raw.githubusercontent.com - Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 MEMZ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133557834508382449" chrome.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2248 chrome.exe 2248 chrome.exe 5956 MEMZ.exe 5988 MEMZ.exe 5956 MEMZ.exe 5988 MEMZ.exe 2396 MEMZ.exe 2396 MEMZ.exe 5956 MEMZ.exe 5956 MEMZ.exe 5988 MEMZ.exe 5988 MEMZ.exe 5276 MEMZ.exe 5276 MEMZ.exe 2396 MEMZ.exe 2396 MEMZ.exe 5988 MEMZ.exe 5988 MEMZ.exe 5956 MEMZ.exe 5956 MEMZ.exe 2396 MEMZ.exe 5276 MEMZ.exe 2396 MEMZ.exe 5276 MEMZ.exe 5988 MEMZ.exe 3024 MEMZ.exe 5988 MEMZ.exe 3024 MEMZ.exe 5956 MEMZ.exe 5956 MEMZ.exe 5276 MEMZ.exe 5276 MEMZ.exe 2396 MEMZ.exe 2396 MEMZ.exe 3024 MEMZ.exe 3024 MEMZ.exe 5988 MEMZ.exe 5988 MEMZ.exe 2396 MEMZ.exe 5276 MEMZ.exe 2396 MEMZ.exe 5276 MEMZ.exe 5956 MEMZ.exe 5956 MEMZ.exe 2396 MEMZ.exe 5276 MEMZ.exe 2396 MEMZ.exe 5276 MEMZ.exe 3024 MEMZ.exe 5988 MEMZ.exe 3024 MEMZ.exe 5988 MEMZ.exe 5956 MEMZ.exe 5956 MEMZ.exe 5956 MEMZ.exe 5956 MEMZ.exe 5988 MEMZ.exe 5988 MEMZ.exe 3024 MEMZ.exe 3024 MEMZ.exe 5276 MEMZ.exe 2396 MEMZ.exe 5276 MEMZ.exe 2396 MEMZ.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5492 taskmgr.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2564 Client-built.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe - Suspicious use of FindShellTrayWindow 62 IoCs
pid Process 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe - Suspicious use of SendNotifyMessage 52 IoCs
pid Process 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe 5492 taskmgr.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3024 MEMZ.exe 5276 MEMZ.exe 5988 MEMZ.exe 2396 MEMZ.exe 5988 MEMZ.exe 2396 MEMZ.exe 3024 MEMZ.exe 5276 MEMZ.exe 5276 MEMZ.exe 3024 MEMZ.exe 5988 MEMZ.exe 2396 MEMZ.exe 2396 MEMZ.exe 5988 MEMZ.exe 5276 MEMZ.exe 3024 MEMZ.exe 5276 MEMZ.exe 3024 MEMZ.exe 5988 MEMZ.exe 2396 MEMZ.exe 2396 MEMZ.exe 3024 MEMZ.exe 5988 MEMZ.exe 5276 MEMZ.exe 3024 MEMZ.exe 5276 MEMZ.exe 5988 MEMZ.exe 2396 MEMZ.exe 2396 MEMZ.exe 5988 MEMZ.exe 5276 MEMZ.exe 3024 MEMZ.exe 3024 MEMZ.exe 5988 MEMZ.exe 5276 MEMZ.exe 2396 MEMZ.exe 2396 MEMZ.exe 5988 MEMZ.exe 5276 MEMZ.exe 3024 MEMZ.exe 5276 MEMZ.exe 3024 MEMZ.exe 5988 MEMZ.exe 2396 MEMZ.exe 5276 MEMZ.exe 3024 MEMZ.exe 2396 MEMZ.exe 5988 MEMZ.exe 5988 MEMZ.exe 2396 MEMZ.exe 3024 MEMZ.exe 5276 MEMZ.exe 5276 MEMZ.exe 2396 MEMZ.exe 3024 MEMZ.exe 5988 MEMZ.exe 5988 MEMZ.exe 2396 MEMZ.exe 3024 MEMZ.exe 5276 MEMZ.exe 3024 MEMZ.exe 5276 MEMZ.exe 2396 MEMZ.exe 5988 MEMZ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2248 wrote to memory of 3816 2248 chrome.exe 101 PID 2248 wrote to memory of 3816 2248 chrome.exe 101 PID 2248 wrote to memory of 4316 2248 chrome.exe 105 PID 2248 wrote to memory of 4316 2248 chrome.exe 105 PID 2248 wrote to memory of 4316 2248 chrome.exe 105 PID 2248 wrote to memory of 4316 2248 chrome.exe 105 PID 2248 wrote to memory of 4316 2248 chrome.exe 105 PID 2248 wrote to memory of 4316 2248 chrome.exe 105 PID 2248 wrote to memory of 4316 2248 chrome.exe 105 PID 2248 wrote to memory of 4316 2248 chrome.exe 105 PID 2248 wrote to memory of 4316 2248 chrome.exe 105 PID 2248 wrote to memory of 4316 2248 chrome.exe 105 PID 2248 wrote to memory of 4316 2248 chrome.exe 105 PID 2248 wrote to memory of 4316 2248 chrome.exe 105 PID 2248 wrote to memory of 4316 2248 chrome.exe 105 PID 2248 wrote to memory of 4316 2248 chrome.exe 105 PID 2248 wrote to memory of 4316 2248 chrome.exe 105 PID 2248 wrote to memory of 4316 2248 chrome.exe 105 PID 2248 wrote to memory of 4316 2248 chrome.exe 105 PID 2248 wrote to memory of 4316 2248 chrome.exe 105 PID 2248 wrote to memory of 4316 2248 chrome.exe 105 PID 2248 wrote to memory of 4316 2248 chrome.exe 105 PID 2248 wrote to memory of 4316 2248 chrome.exe 105 PID 2248 wrote to memory of 4316 2248 chrome.exe 105 PID 2248 wrote to memory of 4316 2248 chrome.exe 105 PID 2248 wrote to memory of 4316 2248 chrome.exe 105 PID 2248 wrote to memory of 4316 2248 chrome.exe 105 PID 2248 wrote to memory of 4316 2248 chrome.exe 105 PID 2248 wrote to memory of 4316 2248 chrome.exe 105 PID 2248 wrote to memory of 4316 2248 chrome.exe 105 PID 2248 wrote to memory of 4316 2248 chrome.exe 105 PID 2248 wrote to memory of 4316 2248 chrome.exe 105 PID 2248 wrote to memory of 4316 2248 chrome.exe 105 PID 2248 wrote to memory of 4316 2248 chrome.exe 105 PID 2248 wrote to memory of 4316 2248 chrome.exe 105 PID 2248 wrote to memory of 4316 2248 chrome.exe 105 PID 2248 wrote to memory of 4316 2248 chrome.exe 105 PID 2248 wrote to memory of 4316 2248 chrome.exe 105 PID 2248 wrote to memory of 4316 2248 chrome.exe 105 PID 2248 wrote to memory of 4316 2248 chrome.exe 105 PID 2248 wrote to memory of 3824 2248 chrome.exe 106 PID 2248 wrote to memory of 3824 2248 chrome.exe 106 PID 2248 wrote to memory of 2836 2248 chrome.exe 107 PID 2248 wrote to memory of 2836 2248 chrome.exe 107 PID 2248 wrote to memory of 2836 2248 chrome.exe 107 PID 2248 wrote to memory of 2836 2248 chrome.exe 107 PID 2248 wrote to memory of 2836 2248 chrome.exe 107 PID 2248 wrote to memory of 2836 2248 chrome.exe 107 PID 2248 wrote to memory of 2836 2248 chrome.exe 107 PID 2248 wrote to memory of 2836 2248 chrome.exe 107 PID 2248 wrote to memory of 2836 2248 chrome.exe 107 PID 2248 wrote to memory of 2836 2248 chrome.exe 107 PID 2248 wrote to memory of 2836 2248 chrome.exe 107 PID 2248 wrote to memory of 2836 2248 chrome.exe 107 PID 2248 wrote to memory of 2836 2248 chrome.exe 107 PID 2248 wrote to memory of 2836 2248 chrome.exe 107 PID 2248 wrote to memory of 2836 2248 chrome.exe 107 PID 2248 wrote to memory of 2836 2248 chrome.exe 107 PID 2248 wrote to memory of 2836 2248 chrome.exe 107 PID 2248 wrote to memory of 2836 2248 chrome.exe 107 PID 2248 wrote to memory of 2836 2248 chrome.exe 107 PID 2248 wrote to memory of 2836 2248 chrome.exe 107 PID 2248 wrote to memory of 2836 2248 chrome.exe 107 PID 2248 wrote to memory of 2836 2248 chrome.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2564
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb24ff9758,0x7ffb24ff9768,0x7ffb24ff97782⤵PID:3816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1772 --field-trial-handle=1740,i,2094961941544854416,6859390562316372167,131072 /prefetch:22⤵PID:4316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1740,i,2094961941544854416,6859390562316372167,131072 /prefetch:82⤵PID:3824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2256 --field-trial-handle=1740,i,2094961941544854416,6859390562316372167,131072 /prefetch:82⤵PID:2836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3124 --field-trial-handle=1740,i,2094961941544854416,6859390562316372167,131072 /prefetch:12⤵PID:884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3136 --field-trial-handle=1740,i,2094961941544854416,6859390562316372167,131072 /prefetch:12⤵PID:3416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4720 --field-trial-handle=1740,i,2094961941544854416,6859390562316372167,131072 /prefetch:12⤵PID:5316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 --field-trial-handle=1740,i,2094961941544854416,6859390562316372167,131072 /prefetch:82⤵PID:5496
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5200 --field-trial-handle=1740,i,2094961941544854416,6859390562316372167,131072 /prefetch:82⤵PID:5516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 --field-trial-handle=1740,i,2094961941544854416,6859390562316372167,131072 /prefetch:82⤵PID:5672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5424 --field-trial-handle=1740,i,2094961941544854416,6859390562316372167,131072 /prefetch:12⤵PID:6008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3220 --field-trial-handle=1740,i,2094961941544854416,6859390562316372167,131072 /prefetch:82⤵PID:5500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3112 --field-trial-handle=1740,i,2094961941544854416,6859390562316372167,131072 /prefetch:12⤵PID:5916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5884 --field-trial-handle=1740,i,2094961941544854416,6859390562316372167,131072 /prefetch:82⤵PID:5536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5840 --field-trial-handle=1740,i,2094961941544854416,6859390562316372167,131072 /prefetch:82⤵PID:3236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4712 --field-trial-handle=1740,i,2094961941544854416,6859390562316372167,131072 /prefetch:82⤵PID:4856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5788 --field-trial-handle=1740,i,2094961941544854416,6859390562316372167,131072 /prefetch:82⤵PID:1908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3320 --field-trial-handle=1740,i,2094961941544854416,6859390562316372167,131072 /prefetch:82⤵PID:5088
-
-
C:\Users\Admin\Downloads\MEMZ.exe"C:\Users\Admin\Downloads\MEMZ.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
PID:6016 -
C:\Users\Admin\Downloads\MEMZ.exe"C:\Users\Admin\Downloads\MEMZ.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5988
-
-
C:\Users\Admin\Downloads\MEMZ.exe"C:\Users\Admin\Downloads\MEMZ.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5956
-
-
C:\Users\Admin\Downloads\MEMZ.exe"C:\Users\Admin\Downloads\MEMZ.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2396
-
-
C:\Users\Admin\Downloads\MEMZ.exe"C:\Users\Admin\Downloads\MEMZ.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5276
-
-
C:\Users\Admin\Downloads\MEMZ.exe"C:\Users\Admin\Downloads\MEMZ.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3024
-
-
C:\Users\Admin\Downloads\MEMZ.exe"C:\Users\Admin\Downloads\MEMZ.exe" /main3⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:2136 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe" \note.txt4⤵PID:3412
-
-
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3924
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4128 --field-trial-handle=2264,i,13734085038406049477,12426093271221802693,262144 --variations-seed-version /prefetch:81⤵PID:5204
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5492
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 2KB
- SHA256 38e7704da4c83a611bdf28c5f874723bf2d9d4f86993fa5ed35fac0f1ca1ec26
- MD5 1d13bf229cb6e8f2ccf00800902c2992
- SHA1 3541ba801607712e54bd2011e68680daebb1d57e
- SHA512 a2f32c1d57ed357a611c0eb3e0b59672894dae6f30141e45a15652494bee0f9f60e55d2f64ceb1f582b9dd17ff24ae2652f9befbe2f945820a88f1bb3ce82f9c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 72B
- SHA256 90c80b7757b660f0cc0d5020c7321d53ea5ef4e685f4854c0c90181bdc500a37
- MD5 a210e9aec6bff2a1a564354ab1883dce
- SHA1 e540c13c40adfd789ae1b17ff659a37f057b0891
- SHA512 d115f213db8b51d33dd63e7cdc315919e99ae85306264bdaeb547fa6b3e5fa0c34e49ee3bca89c4dcdefe5d697a04b9aa2bbaec98accf6cd81d37501c0bcb537
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 6068a3c56e354d304337f7245452071c08615d5ef7681a25b4bea807cb1fe365
- MD5 9ee37e4da10009cdccfe5bd895a889bb
- SHA1 9cf7732913a9f8b520acf5e990e997fe24b04f2f
- SHA512 635f01ffcfef5d7fd9c17fa7bf7ae4d0d94e438924ebdad039242704640a7cc2701deca057007cc0af02f149e49f3c316777425023323e1cb7a74d0b016ec119
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 863B
- SHA256 87d66982fb2807f93a281a97e93cb71708d37e297df13d168f269b38b2ddcd30
- MD5 f9a46bddaafa30bc407973a80e2b5619
- SHA1 641f86609c002c6aed64967f696ca3f999c556d1
- SHA512 6b29163d000e96e513d1feeb463550555e0506acc49f2ff25449b5eee504ccf59b3ef25b6397137fc1382da7d3be5492e4d349938ae1256629c6f19c18aa1f37
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 367B
- SHA256 cde50c49502154c5eea000a4b5a8a81eb300aa5f59a18f9cc78f0a99ad6b8ae4
- MD5 4a7ebf5a4083075adf0d362e0806ba16
- SHA1 b952ed6b523a08f5fc7378f213aa73300bc8e684
- SHA512 a345677225a84637aeb6455b50af8c21ed18e861dd1aac2e8cd6b94bd4f9627c2ab4b54f591e98aa449a30035167ef4ec404c9ec28c57f8c743ad1c07aab4115
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 1KB
- SHA256 9467fae3db673d781dda62e34238fee242e1ca23c5c07aaac8da62ceac6c92bc
- MD5 880145427c2daa71d0712a2551240102
- SHA1 cbeeb3d6fee909904cba009fe21cb35f7d463c1b
- SHA512 8d3780295425028c67d12571f47eb7a6fdc27a292aee42132c12d9570fdeefe4b7f86db56de0670512e8a30f951bd41443041503325343a750b9ce2a3294386b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 532B
- SHA256 01fd88394b2f01af8628f38691b54968dc62582f5f31143c0d1e80d637f5e617
- MD5 c7ac9f770c8b5e45a4fc3acaeb96e4f3
- SHA1 6fc1cc0cd603d611e8ca845e34580e71917829e8
- SHA512 402cdc1e2948fe76ac8d8f7efed285fde2040bd7f33299a0063852294942ba5fc78b5e910a349b003956fd544cb8ba3014a160621804730b71c67d0c7dbcd70b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 6KB
- SHA256 bb4a38bd361690f9924eee343112b522f10623d5c08b2d15ef072a068ec66607
- MD5 276bf56f57406b61c646a4d013674634
- SHA1 7a380f33fa90d2a6ba1a0641607a660f9da1373d
- SHA512 6da0da7cca8b45823a3db4e88c233fc4f81f76e7f32ce8a53a6c9fc5015d28a6bd77c69b25711d2a0886e4d0d0ce7ec077579ced9787ad9043455ceca71019e2
- SSDEEP 192:Y66GCvhP88syy+F2Wowk/nlkQ19Rgzl0otjEsXtScPS:Y66GC5Oyx2fJnp19RgzxtIsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 6KB
- SHA256 e57f3fb214c9f06c63b3a534e32b42e676b3e570f29d2d92d09303f702c7ce53
- MD5 fff35cd282f22232a929a12aff5f0787
- SHA1 f9502c7f444ec8de57bdc92c689d594aa121e51c
- SHA512 f1fcd6dfe63d2c6796b365976797f8619a9d1372610244bd44e174954469d850b8896259284a8f9e0f7ff8e4bcfe6ca49c3ee38de9383c10a6c24c15934df95d
- SSDEEP 192:Y66GCvhP88syy+FKwk/1xRgzl0otjEsXtScPS:Y66GC5OyxKJ1xRgzxtIsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 7KB
- SHA256 7736fe9ada8970df3024b5404c98ac44f44b6cac6b25cc9c16d7f3f375314961
- MD5 5614c8cbdedb1e673e1c4fdbd7ff7020
- SHA1 d17980bb808a2a65f02a10701dcad118a52bf94d
- SHA512 b38430b79e68bb732cde9a49e194be6cf97c4321dffd37497ea33fedba11dac8a1875771b79a5bc6caddfa93f3b9f96d6b0781ca3541988c02d035e1096f2891
- SSDEEP 192:Y66G/MvhP88syy+F2Wowk/nAkHdCQRgzl0otjEsXtScPS:Y66G/M5Oyx2fJnBdCQRgzxtIsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 6KB
- SHA256 acae8957e764be7d54c2db6e13c5edb2448f901f142b7ed21705f9d8b0e6474f
- MD5 918b492634f5757051430cbb21be5c7b
- SHA1 6858cb580d225b54d2db4338ed1505f8cffc3ada
- SHA512 fe2f6874b2728092e1e100eb8a60bb20ae6f82cd975766cc6e5de55299554499e41b6e483cd34117ee108da22dabd52141c28d9f4c190c06ac8f95d96952c385
- SSDEEP 192:Y66GCvhP88syy+FFXRgzl0otjEsXtScPS:Y66GC5OyxpRgzxtIsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 15KB
- SHA256 74a2d3cf1af2b28e0dc4005e843d9d04da8055855e79641ecf355cf9c14f7ef3
- MD5 42f44c4e86e4e3c4368f8a495127cb7a
- SHA1 c5b339275a848995f553bd9778e2564265720771
- SHA512 60a0604229141d105022bd1b3130f7a9c14a031f9cf59aed057c5bb4628da43d14eb17c58a334a54956c6df3fb33ab3704345bc0f4c54c42e0ef32e1799a8317
- SSDEEP 384:zecLPLeaXr1kXqKf/pUZNCgVLH2HfkmrUYAHGuFYbnkOAvW:bLPLXr1kXqKf/pUZNCgVLH2HflrUdGuO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 258KB
- SHA256 7fa0a74a73d2b35ed88fe3ae9add589dd86786f0f9c2fc3c1e868429303c7937
- MD5 b8ebcaf3ab8e1d1c88b66419be138c11
- SHA1 ec2054b9669acbe964caebc051063a026f1d8759
- SHA512 955c7fd9644c0971e5ef7d29ca5b35cd41d3d8141666fb5ec47544a90674fbdf7519d63e36e277829ff4c2a39b401a5c83f938154837007675c2efaab93130aa
- SSDEEP 6144:Z/rv7qCq4dHL8uXordgRiaQASNdvXCNpbMHtCMpS7:YT4dH/o3ASNdpHtXW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
- Size 114KB
- SHA256 7364a3c92dd6c6e90549a7a053edcf6dd78abc28a224e756aeac40981b33d0dc
- MD5 b94b733a01efb9fb822f3bca632f9316
- SHA1 06f1210a3d1ee75e4a0b6b7fc51781f6fe43227a
- SHA512 7d81a931f2e266427860ea2431d77ce25ab2d585a2584db4e24140cde1c76da21f288c4dfeded1dd2e0b27ea5936c81050bcc35ab75130e97fe19d307914581c
- SSDEEP 384:kCkt+YaOo+IeGghbnxjgHwelpmeept6En1s8RQfgdqKYg7DHby94xI4e3OJVVucO:g+YWBnJ2pz3Dr0I+Yi1uK3iWf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
- Size 101KB
- SHA256 cd474ddf4b30813dc3804c2a606f938fe75438d39da8724f9e2a504f20d46279
- MD5 275abfd86af6f9fd0f0cb2db3a7ef0d2
- SHA1 ab6600ce962ac28c1e8b038c1e9227096f5d05e0
- SHA512 789b531673658afae46e931da0d0aa698e1d48edd39c9bca14caa951b4d8fec6b2344755bfaea347875d961e34ed189cac25398efe01b420c53bf024a0643dbc
- SSDEEP 384:zCkt+YaOo+IeBbnxjgHwelpmeept6EQs8RQfg8KYZDHbP64exJVVucA6zo3bXmZB:n+YonJ2zSc5ITRi1uKZiW0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5860d8.TMP
- Size 96KB
- SHA256 514ffbda9a71a3536f620512b072dd546044c793b678b2a477da5e9b70db6414
- MD5 f06a682182cdc0306a87e3a5ba8da503
- SHA1 d9983169ef0cdc0c8cd70bfa11547a7308287d68
- SHA512 7fc08b0b42b68e6b842853ef3417edf695ce41fc734461fed4e5bbc4fb76246fcf5a8b6f58a1c54ea79c7d8eab399a13995cc7859ad04c3bd7207401088aba5e
- SSDEEP 384:KCkt+YaOo+IeBbnxjgHwelpmert6EQs8RQfg8KYZDHbP64exJDucA6zo3bXMS+kw:y+YonOyzSc5I1Mi1uKliWT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Downloads\MEMZ.exe
- Size 16KB
- SHA256 3872c12d31fc9825e8661ac01ecee2572460677afbc7093f920a8436a42e28ff
- MD5 1d5ad9c8d3fee874d0feb8bfac220a11
- SHA1 ca6d3f7e6c784155f664a9179ca64e4034df9595
- SHA512 c8246f4137416be33b6d1ac89f2428b7c44d9376ac8489a9fbf65ef128a6c53fb50479e1e400c8e201c8611992ab1d6c1bd3d6cece89013edb4d35cdd22305b1
- SSDEEP 192:M2WgyvSW8gRc6olcIEiwqZKBkDFR43xWTM3LHf26gFrcx3sNq:JWgnSmFlcIqq3agmLH+6gF23sN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\note.txt
- Size 218B
- SHA256 8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
- MD5 afa6955439b8d516721231029fb9ca1b
- SHA1 087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
- SHA512 5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
- MD5 SHA1 SHA512