Analysis
-
max time kernel
3s -
max time network
4s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
02-05-2024 12:59
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/Dfmaaa/MEMZ-virus
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
https://github.com/Dfmaaa/MEMZ-virus
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3604 msedge.exe 3604 msedge.exe 4288 msedge.exe 4288 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4288 msedge.exe 4288 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4288 wrote to memory of 1904 4288 msedge.exe 81 PID 4288 wrote to memory of 1904 4288 msedge.exe 81 PID 4288 wrote to memory of 4676 4288 msedge.exe 82 PID 4288 wrote to memory of 4676 4288 msedge.exe 82 PID 4288 wrote to memory of 4676 4288 msedge.exe 82 PID 4288 wrote to memory of 4676 4288 msedge.exe 82 PID 4288 wrote to memory of 4676 4288 msedge.exe 82 PID 4288 wrote to memory of 4676 4288 msedge.exe 82 PID 4288 wrote to memory of 4676 4288 msedge.exe 82 PID 4288 wrote to memory of 4676 4288 msedge.exe 82 PID 4288 wrote to memory of 4676 4288 msedge.exe 82 PID 4288 wrote to memory of 4676 4288 msedge.exe 82 PID 4288 wrote to memory of 4676 4288 msedge.exe 82 PID 4288 wrote to memory of 4676 4288 msedge.exe 82 PID 4288 wrote to memory of 4676 4288 msedge.exe 82 PID 4288 wrote to memory of 4676 4288 msedge.exe 82 PID 4288 wrote to memory of 4676 4288 msedge.exe 82 PID 4288 wrote to memory of 4676 4288 msedge.exe 82 PID 4288 wrote to memory of 4676 4288 msedge.exe 82 PID 4288 wrote to memory of 4676 4288 msedge.exe 82 PID 4288 wrote to memory of 4676 4288 msedge.exe 82 PID 4288 wrote to memory of 4676 4288 msedge.exe 82 PID 4288 wrote to memory of 4676 4288 msedge.exe 82 PID 4288 wrote to memory of 4676 4288 msedge.exe 82 PID 4288 wrote to memory of 4676 4288 msedge.exe 82 PID 4288 wrote to memory of 4676 4288 msedge.exe 82 PID 4288 wrote to memory of 4676 4288 msedge.exe 82 PID 4288 wrote to memory of 4676 4288 msedge.exe 82 PID 4288 wrote to memory of 4676 4288 msedge.exe 82 PID 4288 wrote to memory of 4676 4288 msedge.exe 82 PID 4288 wrote to memory of 4676 4288 msedge.exe 82 PID 4288 wrote to memory of 4676 4288 msedge.exe 82 PID 4288 wrote to memory of 4676 4288 msedge.exe 82 PID 4288 wrote to memory of 4676 4288 msedge.exe 82 PID 4288 wrote to memory of 4676 4288 msedge.exe 82 PID 4288 wrote to memory of 4676 4288 msedge.exe 82 PID 4288 wrote to memory of 4676 4288 msedge.exe 82 PID 4288 wrote to memory of 4676 4288 msedge.exe 82 PID 4288 wrote to memory of 4676 4288 msedge.exe 82 PID 4288 wrote to memory of 4676 4288 msedge.exe 82 PID 4288 wrote to memory of 4676 4288 msedge.exe 82 PID 4288 wrote to memory of 4676 4288 msedge.exe 82 PID 4288 wrote to memory of 3604 4288 msedge.exe 83 PID 4288 wrote to memory of 3604 4288 msedge.exe 83 PID 4288 wrote to memory of 4092 4288 msedge.exe 84 PID 4288 wrote to memory of 4092 4288 msedge.exe 84 PID 4288 wrote to memory of 4092 4288 msedge.exe 84 PID 4288 wrote to memory of 4092 4288 msedge.exe 84 PID 4288 wrote to memory of 4092 4288 msedge.exe 84 PID 4288 wrote to memory of 4092 4288 msedge.exe 84 PID 4288 wrote to memory of 4092 4288 msedge.exe 84 PID 4288 wrote to memory of 4092 4288 msedge.exe 84 PID 4288 wrote to memory of 4092 4288 msedge.exe 84 PID 4288 wrote to memory of 4092 4288 msedge.exe 84 PID 4288 wrote to memory of 4092 4288 msedge.exe 84 PID 4288 wrote to memory of 4092 4288 msedge.exe 84 PID 4288 wrote to memory of 4092 4288 msedge.exe 84 PID 4288 wrote to memory of 4092 4288 msedge.exe 84 PID 4288 wrote to memory of 4092 4288 msedge.exe 84 PID 4288 wrote to memory of 4092 4288 msedge.exe 84 PID 4288 wrote to memory of 4092 4288 msedge.exe 84 PID 4288 wrote to memory of 4092 4288 msedge.exe 84 PID 4288 wrote to memory of 4092 4288 msedge.exe 84 PID 4288 wrote to memory of 4092 4288 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Dfmaaa/MEMZ-virus1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffea97546f8,0x7ffea9754708,0x7ffea97547182⤵PID:1904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,14150707242990893485,14193740374133558536,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:22⤵PID:4676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,14150707242990893485,14193740374133558536,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,14150707242990893485,14193740374133558536,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:82⤵PID:4092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14150707242990893485,14193740374133558536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:12⤵PID:8
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14150707242990893485,14193740374133558536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:12⤵PID:1980
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2676
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3088
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD54f7152bc5a1a715ef481e37d1c791959
SHA1c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
SHA256704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
SHA5122e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c
-
Filesize
152B
MD5ea98e583ad99df195d29aa066204ab56
SHA1f89398664af0179641aa0138b337097b617cb2db
SHA256a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
SHA512e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f
-
Filesize
6KB
MD5439c0d72ed16ae2c54a1920278722b98
SHA19c23d3b9b83648c5e656997cf6969f9619c48627
SHA25696f5dfc69efd209eea15336c3ec481da8d04df4ee34bb08f7f99ec0871e00699
SHA51228b51d404ee54d140b5a79dfa47773b6388ef692b87fada658add19acddcf82c9d7a7d391afa116104e247a08b5ba77636d911929483028d68629c9860cb392c