2a45e44be359fba4c85591e7b13d1ec772ed181adc41254d8b00d31b2d15878e

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
25-04-2024 21:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Memz.exe
Size

14KB
MD5

19dbec50735b5f2a72d4199c4e184960
SHA1

6fed7732f7cb6f59743795b2ab154a3676f4c822
SHA256

a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
SHA512

aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
SSDEEP

192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

Processes:

Memz.exe

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	Memz.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Memz.exeMemz.exeMemz.exeMemz.exeMemz.exe

pid	Process
4932	Memz.exe
5072	Memz.exe
4932	Memz.exe
5072	Memz.exe
4932	Memz.exe
5072	Memz.exe
4932	Memz.exe
5072	Memz.exe
1496	Memz.exe
1496	Memz.exe
5072	Memz.exe
1496	Memz.exe
5072	Memz.exe
1496	Memz.exe
4932	Memz.exe
4124	Memz.exe
4932	Memz.exe
4124	Memz.exe
3544	Memz.exe
3544	Memz.exe
4932	Memz.exe
4124	Memz.exe
4932	Memz.exe
4124	Memz.exe
1496	Memz.exe
5072	Memz.exe
1496	Memz.exe
5072	Memz.exe
4932	Memz.exe
4932	Memz.exe
4124	Memz.exe
4124	Memz.exe
3544	Memz.exe
5072	Memz.exe
3544	Memz.exe
5072	Memz.exe
1496	Memz.exe
1496	Memz.exe
1496	Memz.exe
1496	Memz.exe
5072	Memz.exe
5072	Memz.exe
3544	Memz.exe
3544	Memz.exe
4124	Memz.exe
4124	Memz.exe
4932	Memz.exe
4932	Memz.exe
5072	Memz.exe
1496	Memz.exe
5072	Memz.exe
1496	Memz.exe
5072	Memz.exe
5072	Memz.exe
1496	Memz.exe
1496	Memz.exe
4932	Memz.exe
4932	Memz.exe
4124	Memz.exe
4124	Memz.exe
3544	Memz.exe
3544	Memz.exe
5072	Memz.exe
3544	Memz.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

Processes:

msedge.exe

pid	Process
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

AUDIODG.EXE

description	pid	Process
Token: 33	480	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	480	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	Process
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	Process
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

Memz.exeidentity_helper.exe

pid	Process
4956	Memz.exe
2952	identity_helper.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Memz.exeMemz.exemsedge.exe

description	pid	Process	procid_target
PID 3700 wrote to memory of 5072	3700	Memz.exe	82
PID 3700 wrote to memory of 5072	3700	Memz.exe	82
PID 3700 wrote to memory of 5072	3700	Memz.exe	82
PID 3700 wrote to memory of 4932	3700	Memz.exe	83
PID 3700 wrote to memory of 4932	3700	Memz.exe	83
PID 3700 wrote to memory of 4932	3700	Memz.exe	83
PID 3700 wrote to memory of 1496	3700	Memz.exe	84
PID 3700 wrote to memory of 1496	3700	Memz.exe	84
PID 3700 wrote to memory of 1496	3700	Memz.exe	84
PID 3700 wrote to memory of 3544	3700	Memz.exe	85
PID 3700 wrote to memory of 3544	3700	Memz.exe	85
PID 3700 wrote to memory of 3544	3700	Memz.exe	85
PID 3700 wrote to memory of 4124	3700	Memz.exe	86
PID 3700 wrote to memory of 4124	3700	Memz.exe	86
PID 3700 wrote to memory of 4124	3700	Memz.exe	86
PID 3700 wrote to memory of 4956	3700	Memz.exe	87
PID 3700 wrote to memory of 4956	3700	Memz.exe	87
PID 3700 wrote to memory of 4956	3700	Memz.exe	87
PID 4956 wrote to memory of 1872	4956	Memz.exe	90
PID 4956 wrote to memory of 1872	4956	Memz.exe	90
PID 4956 wrote to memory of 1872	4956	Memz.exe	90
PID 4956 wrote to memory of 1016	4956	Memz.exe	91
PID 4956 wrote to memory of 1016	4956	Memz.exe	91
PID 1016 wrote to memory of 556	1016	msedge.exe	92
PID 1016 wrote to memory of 556	1016	msedge.exe	92
PID 1016 wrote to memory of 2864	1016	msedge.exe	93
PID 1016 wrote to memory of 2864	1016	msedge.exe	93
PID 1016 wrote to memory of 2864	1016	msedge.exe	93
PID 1016 wrote to memory of 2864	1016	msedge.exe	93
PID 1016 wrote to memory of 2864	1016	msedge.exe	93
PID 1016 wrote to memory of 2864	1016	msedge.exe	93
PID 1016 wrote to memory of 2864	1016	msedge.exe	93
PID 1016 wrote to memory of 2864	1016	msedge.exe	93
PID 1016 wrote to memory of 2864	1016	msedge.exe	93
PID 1016 wrote to memory of 2864	1016	msedge.exe	93
PID 1016 wrote to memory of 2864	1016	msedge.exe	93
PID 1016 wrote to memory of 2864	1016	msedge.exe	93
PID 1016 wrote to memory of 2864	1016	msedge.exe	93
PID 1016 wrote to memory of 2864	1016	msedge.exe	93
PID 1016 wrote to memory of 2864	1016	msedge.exe	93
PID 1016 wrote to memory of 2864	1016	msedge.exe	93
PID 1016 wrote to memory of 2864	1016	msedge.exe	93
PID 1016 wrote to memory of 2864	1016	msedge.exe	93
PID 1016 wrote to memory of 2864	1016	msedge.exe	93
PID 1016 wrote to memory of 2864	1016	msedge.exe	93
PID 1016 wrote to memory of 2864	1016	msedge.exe	93
PID 1016 wrote to memory of 2864	1016	msedge.exe	93
PID 1016 wrote to memory of 2864	1016	msedge.exe	93
PID 1016 wrote to memory of 2864	1016	msedge.exe	93
PID 1016 wrote to memory of 2864	1016	msedge.exe	93
PID 1016 wrote to memory of 2864	1016	msedge.exe	93
PID 1016 wrote to memory of 2864	1016	msedge.exe	93
PID 1016 wrote to memory of 2864	1016	msedge.exe	93
PID 1016 wrote to memory of 2864	1016	msedge.exe	93
PID 1016 wrote to memory of 2864	1016	msedge.exe	93
PID 1016 wrote to memory of 2864	1016	msedge.exe	93
PID 1016 wrote to memory of 2864	1016	msedge.exe	93
PID 1016 wrote to memory of 2864	1016	msedge.exe	93
PID 1016 wrote to memory of 2864	1016	msedge.exe	93
PID 1016 wrote to memory of 2864	1016	msedge.exe	93
PID 1016 wrote to memory of 2864	1016	msedge.exe	93
PID 1016 wrote to memory of 2864	1016	msedge.exe	93
PID 1016 wrote to memory of 2864	1016	msedge.exe	93
PID 1016 wrote to memory of 2864	1016	msedge.exe	93

C:\Users\Admin\AppData\Local\Temp\Memz.exe
"C:\Users\Admin\AppData\Local\Temp\Memz.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3700
- C:\Users\Admin\AppData\Local\Temp\Memz.exe
  "C:\Users\Admin\AppData\Local\Temp\Memz.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5072
- C:\Users\Admin\AppData\Local\Temp\Memz.exe
  "C:\Users\Admin\AppData\Local\Temp\Memz.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4932
- C:\Users\Admin\AppData\Local\Temp\Memz.exe
  "C:\Users\Admin\AppData\Local\Temp\Memz.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1496
- C:\Users\Admin\AppData\Local\Temp\Memz.exe
  "C:\Users\Admin\AppData\Local\Temp\Memz.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3544
- C:\Users\Admin\AppData\Local\Temp\Memz.exe
  "C:\Users\Admin\AppData\Local\Temp\Memz.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4124
- C:\Users\Admin\AppData\Local\Temp\Memz.exe
  "C:\Users\Admin\AppData\Local\Temp\Memz.exe" /main
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    PID:1872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+2+remove+a+virus
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa1fc73cb8,0x7ffa1fc73cc8,0x7ffa1fc73cd8
      4⤵
      PID:556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,13850621032365592137,17665660785828218517,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
      4⤵
      PID:2864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1888,13850621032365592137,17665660785828218517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
      4⤵
      PID:4320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1888,13850621032365592137,17665660785828218517,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
      4⤵
      PID:4948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,13850621032365592137,17665660785828218517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
      4⤵
      PID:4640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,13850621032365592137,17665660785828218517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
      4⤵
      PID:2340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,13850621032365592137,17665660785828218517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
      4⤵
      PID:1140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,13850621032365592137,17665660785828218517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
      4⤵
      PID:1380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,13850621032365592137,17665660785828218517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
      4⤵
      PID:1800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,13850621032365592137,17665660785828218517,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
      4⤵
      PID:1972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1888,13850621032365592137,17665660785828218517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5956 /prefetch:8
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:2952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,13850621032365592137,17665660785828218517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3940 /prefetch:1
      4⤵
      PID:752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,13850621032365592137,17665660785828218517,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
      4⤵
      PID:3900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1888,13850621032365592137,17665660785828218517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:8
      4⤵
      PID:4212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,13850621032365592137,17665660785828218517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
      4⤵
      PID:4888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,13850621032365592137,17665660785828218517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
      4⤵
      PID:4288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,13850621032365592137,17665660785828218517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
      4⤵
      PID:2528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,13850621032365592137,17665660785828218517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6320 /prefetch:1
      4⤵
      PID:4212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=vinesauce+meme+collection
    3⤵
    PID:4224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa1fc73cb8,0x7ffa1fc73cc8,0x7ffa1fc73cd8
      4⤵
      PID:3216
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:4876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=montage+parody+making+program+2016
    3⤵
    PID:4908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffa1fc73cb8,0x7ffa1fc73cc8,0x7ffa1fc73cd8
      4⤵
      PID:2124

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4360

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2032

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004EC 0x00000000000004F0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0fcda4fac8ec713700f95299a89bc126

SHA1
576a818957f882dc0b892a29da15c4bb71b93455

SHA256
f7a257742d3a6e6edd16ac8c4c4696d4bdf653041868329461444a0973e71430

SHA512
ab350ca508c412ff860f82d25ac7492afb3baf4a2827249ebc7ec9632ee444f8f0716389f0623afc0756f395cf00d7a90a0f89b360acdf72b1befe34eecb5986

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
21986fa2280bae3957498a58adf62fc2

SHA1
d01ad69975b7dc46eba6806783450f987fa2b48d

SHA256
c91d76b0f27ccea28c4f5f872dee6a98f2d37424ef0b5f188af8c6757090cbb5

SHA512
ae9ba1abe7def7f6924d486a58427f04a02af7dd82aa3a36c1ed527a23ec7897f00b0e30f22529e9599ae2db88e8abc7ba8013b426885aa3c961ee74678455f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
200KB

MD5
a484f2f3418f65b8214cbcd3e4a31057

SHA1
5c002c51b67db40f88b6895a5d5caa67608a65ce

SHA256
79cbe928773386d07f0127f256f383debed5ccea5ff230465bf46ec7c87319d6

SHA512
0be1bb8db08f6e6041a85cfee90cd36a5b595afbca34d52a125465454fc806b4bb7ae569eaf4c882922fb1b962b6060534e597791cd0ad23483be5981d9be85c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
2d1c606cf2a2aaada909039c5a0aaaea

SHA1
dfc0e9cf8e1051371f5c7c3034c3e18abe7fb66e

SHA256
382c3feff236971527f0fd267b28b76b5efeed42784f31a3817b410d646e9eb0

SHA512
f461059bb4a93836ee0ffee5a2d4e880c096724838e83a630afc450cf30b356eed162879071ef200f415550be374817b2c0cb436e2ee0df04d31e34869571a85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
98ff9d427c6e1de866d883a68b54e5bc

SHA1
fd8d3da9e3a1ec5b9c5a7e39b1608e4341f5bf87

SHA256
950f248ad2944184a6d0f3d1b0154277605486c43f0385fd1ba7bf27cd697a42

SHA512
3fb5371aae8c395078fd853ba78db879d4b43d1d73785f6accdd1b17350b367fa9d60ad8c9ec18a55b75e69fe9854b0499a238adfc9b33ba9542dcf45ff95633

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
05b4319393f3ab8fcbce83bd5dc95b45

SHA1
02ba0e777a4c3b36b1a606f8b3bd0dfd31ec8c39

SHA256
643ea77c2c341e661e068ce0a4ee0fb5f3663d855c0a7f23e246fa7a13bfdc8b

SHA512
17026fed305c118be325670699aca87a58f48537885e173b73e0cfd375aeb7314752404dced47a0e58632e15b58387f288700acc2b15f4b0ef748ae2b9339840

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
814B

MD5
a31a292372f438af7583cb5d60c2e1fc

SHA1
68563beb1d0d19dd5f03cc8a7c111b2db1ddcfe4

SHA256
98180cef2f4aa1a1e02b28265178c66e4db2ee2ec7c90b2a34646bb62af4bea2

SHA512
862e50138b80f585ba0f76e43f9f4d1d4778e4e9a2cdfa5e4ab621d2b7ae080ec2da5de079cf8d989c3a4c3b3660bd71ed0a504140ceab5f87243934f6a83939

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1f404c5c47041a2c8e12bebb4de1772e

SHA1
279c6c844b8ae59ac089362a5b5e25c498449bd7

SHA256
af96140cfffc39b05c37431e44e599ea266563f744d7419bcfe7574c9d3b0985

SHA512
0f677905f5c083d35bd1c63dc7374afcf025c9cdb83933b5615e2c7467fc8ec2d47f0eda35b4487141b0f3d3666e6b636574494b60247fc342649ae77ff85712

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ae5d822c8a9fecce11d342ee8e2de9ba

SHA1
ab03342bcb3f65835ba6195a63fc022e12e00d12

SHA256
cc583d2b7fd3434e2bdd770625e6f9b77cecd19ad1a513afb54ab2bd11c87855

SHA512
ce37df4862647be3ceace98f996e4c8315ae8f9ca236f14b73a050b9cb1ca603d09dd9fafd55ed2df54cd0449a2f18ac334e5b02f639b718ecddec69bb85acfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2403c370f845c959f55bee15148c3066

SHA1
f2cb1647f8c231f7e99a0a82a82c5ef7caa33149

SHA256
10b1f642aba89e6220f3f8feeeb3b8afa83455b3825500e6fa02fdbaf4c06356

SHA512
fd12611451c872856c882610535294750b93c2df8656bcb989f9e655f0734344333c78ac98cdc7260642ae6b508055ccfa982947ce5af161e0b04ae025232e7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f5352b37-0ab5-4578-a747-caf67a2cdb52.tmp

Filesize
6KB

MD5
4aafd043d988c2f1f4254aa44fb26435

SHA1
577c44fdcd4eed1bd2e19395123cbc363949f4ad

SHA256
d6a5dc4918fb40f3af035ee7427e7dcdced9b9668f8376add553a82e5e132107

SHA512
4b0a0f5c2317198466f92ea1aed33fc74c765092c7a5d81bae3dc36d2fae79e42682e0ec1a517fab6d10f1033ae85dc65d3ce0794634e135d3e042852d491b4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ee01e2ece2d72ccb0af78329375b31d0

SHA1
32b501ebc5da72a1ac42a1fadb3c58eded3bb67d

SHA256
4fc225de83e4ae8bac59adccf590a44689f61b8249664ee4894fc28cfc10879c

SHA512
88c9207b3fd0868881a522e551a4a7319bdcade7d445c8d59caf798b9db53b12866732d019140e06b3973e0da964be826419c9aeabc5a14b630aa95903c5ca86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
a7e73ec6cae3d9429b93d68ada54186a

SHA1
179134995e9cd177cf1e20c0f36ebbf889604a7b

SHA256
299da3e6c8ccfd3e477ff9502de4a9a5fdaf2d83caa1f367039c949b6cd24e96

SHA512
653b4d73c6da734c28fff51b1989eb77bf35214ab6ea12ca9aec7d69a290a2bbcbbfd3d60a5bf77a363e4e846c78efb7b49dadcfa0179fcc8b90b723d5d5d7b6

Download Submit
C:\note.txt

Filesize
218B

MD5
afa6955439b8d516721231029fb9ca1b

SHA1
087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

SHA256
8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

SHA512
5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

Download Submit
\??\pipe\LOCAL\crashpad_1016_DMVPACOSFTAOTKSA

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit