hxxp://google[.]com

Analysis

max time kernel
224s
max time network
202s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
08/05/2024, 19:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
http://google.com
Sample240508-ym865sfa94

Score

8^/10

bootkit persistence

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 7 IoCs

pid	Process
1756	MEMZ.exe
236	MEMZ.exe
3300	MEMZ.exe
2504	MEMZ.exe
5036	MEMZ.exe
1860	MEMZ.exe
1120	MEMZ.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
58	raw.githubusercontent.com
45	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\MEMZ.exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4528	chrome.exe
4528	chrome.exe
3728	chrome.exe
3728	chrome.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe
236	MEMZ.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe

Suspicious use of SetWindowsHookEx 40 IoCs

pid	Process
236	MEMZ.exe
2504	MEMZ.exe
236	MEMZ.exe
2504	MEMZ.exe
236	MEMZ.exe
2504	MEMZ.exe
236	MEMZ.exe
2504	MEMZ.exe
236	MEMZ.exe
2504	MEMZ.exe
236	MEMZ.exe
2504	MEMZ.exe
236	MEMZ.exe
2504	MEMZ.exe
236	MEMZ.exe
2504	MEMZ.exe
236	MEMZ.exe
2504	MEMZ.exe
236	MEMZ.exe
2504	MEMZ.exe
236	MEMZ.exe
2504	MEMZ.exe
236	MEMZ.exe
2504	MEMZ.exe
236	MEMZ.exe
2504	MEMZ.exe
236	MEMZ.exe
2504	MEMZ.exe
236	MEMZ.exe
2504	MEMZ.exe
236	MEMZ.exe
2504	MEMZ.exe
236	MEMZ.exe
2504	MEMZ.exe
236	MEMZ.exe
2504	MEMZ.exe
236	MEMZ.exe
2504	MEMZ.exe
236	MEMZ.exe
2504	MEMZ.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 2256	4528	chrome.exe	78
PID 4528 wrote to memory of 2256	4528	chrome.exe	78
PID 4528 wrote to memory of 4288	4528	chrome.exe	79
PID 4528 wrote to memory of 4288	4528	chrome.exe	79
PID 4528 wrote to memory of 4288	4528	chrome.exe	79
PID 4528 wrote to memory of 4288	4528	chrome.exe	79
PID 4528 wrote to memory of 4288	4528	chrome.exe	79
PID 4528 wrote to memory of 4288	4528	chrome.exe	79
PID 4528 wrote to memory of 4288	4528	chrome.exe	79
PID 4528 wrote to memory of 4288	4528	chrome.exe	79
PID 4528 wrote to memory of 4288	4528	chrome.exe	79
PID 4528 wrote to memory of 4288	4528	chrome.exe	79
PID 4528 wrote to memory of 4288	4528	chrome.exe	79
PID 4528 wrote to memory of 4288	4528	chrome.exe	79
PID 4528 wrote to memory of 4288	4528	chrome.exe	79
PID 4528 wrote to memory of 4288	4528	chrome.exe	79
PID 4528 wrote to memory of 4288	4528	chrome.exe	79
PID 4528 wrote to memory of 4288	4528	chrome.exe	79
PID 4528 wrote to memory of 4288	4528	chrome.exe	79
PID 4528 wrote to memory of 4288	4528	chrome.exe	79
PID 4528 wrote to memory of 4288	4528	chrome.exe	79
PID 4528 wrote to memory of 4288	4528	chrome.exe	79
PID 4528 wrote to memory of 4288	4528	chrome.exe	79
PID 4528 wrote to memory of 4288	4528	chrome.exe	79
PID 4528 wrote to memory of 4288	4528	chrome.exe	79
PID 4528 wrote to memory of 4288	4528	chrome.exe	79
PID 4528 wrote to memory of 4288	4528	chrome.exe	79
PID 4528 wrote to memory of 4288	4528	chrome.exe	79
PID 4528 wrote to memory of 4288	4528	chrome.exe	79
PID 4528 wrote to memory of 4288	4528	chrome.exe	79
PID 4528 wrote to memory of 4288	4528	chrome.exe	79
PID 4528 wrote to memory of 4288	4528	chrome.exe	79
PID 4528 wrote to memory of 4288	4528	chrome.exe	79
PID 4528 wrote to memory of 2204	4528	chrome.exe	80
PID 4528 wrote to memory of 2204	4528	chrome.exe	80
PID 4528 wrote to memory of 2024	4528	chrome.exe	81
PID 4528 wrote to memory of 2024	4528	chrome.exe	81
PID 4528 wrote to memory of 2024	4528	chrome.exe	81
PID 4528 wrote to memory of 2024	4528	chrome.exe	81
PID 4528 wrote to memory of 2024	4528	chrome.exe	81
PID 4528 wrote to memory of 2024	4528	chrome.exe	81
PID 4528 wrote to memory of 2024	4528	chrome.exe	81
PID 4528 wrote to memory of 2024	4528	chrome.exe	81
PID 4528 wrote to memory of 2024	4528	chrome.exe	81
PID 4528 wrote to memory of 2024	4528	chrome.exe	81
PID 4528 wrote to memory of 2024	4528	chrome.exe	81
PID 4528 wrote to memory of 2024	4528	chrome.exe	81
PID 4528 wrote to memory of 2024	4528	chrome.exe	81
PID 4528 wrote to memory of 2024	4528	chrome.exe	81
PID 4528 wrote to memory of 2024	4528	chrome.exe	81
PID 4528 wrote to memory of 2024	4528	chrome.exe	81
PID 4528 wrote to memory of 2024	4528	chrome.exe	81
PID 4528 wrote to memory of 2024	4528	chrome.exe	81
PID 4528 wrote to memory of 2024	4528	chrome.exe	81
PID 4528 wrote to memory of 2024	4528	chrome.exe	81
PID 4528 wrote to memory of 2024	4528	chrome.exe	81
PID 4528 wrote to memory of 2024	4528	chrome.exe	81
PID 4528 wrote to memory of 2024	4528	chrome.exe	81
PID 4528 wrote to memory of 2024	4528	chrome.exe	81
PID 4528 wrote to memory of 2024	4528	chrome.exe	81
PID 4528 wrote to memory of 2024	4528	chrome.exe	81
PID 4528 wrote to memory of 2024	4528	chrome.exe	81
PID 4528 wrote to memory of 2024	4528	chrome.exe	81
PID 4528 wrote to memory of 2024	4528	chrome.exe	81

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://google.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc6337ab58,0x7ffc6337ab68,0x7ffc6337ab78
  2⤵
  PID:2256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1608 --field-trial-handle=1832,i,1014411153863106954,12347616744446581226,131072 /prefetch:2
  2⤵
  PID:4288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1832,i,1014411153863106954,12347616744446581226,131072 /prefetch:8
  2⤵
  PID:2204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2104 --field-trial-handle=1832,i,1014411153863106954,12347616744446581226,131072 /prefetch:8
  2⤵
  PID:2024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2932 --field-trial-handle=1832,i,1014411153863106954,12347616744446581226,131072 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2948 --field-trial-handle=1832,i,1014411153863106954,12347616744446581226,131072 /prefetch:1
  2⤵
  PID:1784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4176 --field-trial-handle=1832,i,1014411153863106954,12347616744446581226,131072 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2964 --field-trial-handle=1832,i,1014411153863106954,12347616744446581226,131072 /prefetch:8
  2⤵
  PID:2876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4380 --field-trial-handle=1832,i,1014411153863106954,12347616744446581226,131072 /prefetch:8
  2⤵
  PID:4356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1440 --field-trial-handle=1832,i,1014411153863106954,12347616744446581226,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=2484 --field-trial-handle=1832,i,1014411153863106954,12347616744446581226,131072 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 --field-trial-handle=1832,i,1014411153863106954,12347616744446581226,131072 /prefetch:8
  2⤵
  PID:3044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1732 --field-trial-handle=1832,i,1014411153863106954,12347616744446581226,131072 /prefetch:8
  2⤵
  PID:2836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4180 --field-trial-handle=1832,i,1014411153863106954,12347616744446581226,131072 /prefetch:8
  2⤵
  PID:2832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 --field-trial-handle=1832,i,1014411153863106954,12347616744446581226,131072 /prefetch:8
  2⤵
  - NTFS ADS
  PID:1500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1460 --field-trial-handle=1832,i,1014411153863106954,12347616744446581226,131072 /prefetch:8
  2⤵
  PID:4804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5252 --field-trial-handle=1832,i,1014411153863106954,12347616744446581226,131072 /prefetch:8
  2⤵
  PID:864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4704 --field-trial-handle=1832,i,1014411153863106954,12347616744446581226,131072 /prefetch:8
  2⤵
  PID:4568
- C:\Users\Admin\Downloads\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ.exe"
  2⤵
  - Executes dropped EXE
  PID:1756
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:236
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    PID:3300
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2504
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    PID:5036
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    PID:1860
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /main
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    PID:1120
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe" \note.txt
      4⤵
      PID:3604

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:2464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 ba2066cc3fb20d586f87747b6e1edfb7cf60457cd47394682adc1a3d143efca1
MD5 f700474d9d5847882e040738e6641c90
SHA1 d9a894ee5a2b19a4fe6fb1110eb24d4b60d3214b
SHA512 a9de987eccf38ff1b5e77101a36402e124f4b4810257ebee6bb09cf7e9acbb17780aea51cc4007f60abfc9a9e7d67958086c66e3246f843ffe3424b6c2b3888f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 b30088a374313cb01ba908b8c02dc1dfea6767e8bbc373f6902e675e7ab282c7
MD5 2bb51a37e32f8a5994781e1beb35aa37
SHA1 d37a866f4172b763f215e0d161e100cc709bd5be
SHA512 cf88f2d2a66b88401bf74047454a612055ed7dcf1f5cbe7d0fc92870c314dead7df22cb2eeb06c19a8aac567b9008653f9ede580b9e5fec8b7df337c7e1985f7
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
Size 264KB
SHA256 52a5113ec74788ab746d5899f1fc52efcb4838d3db4867c7af9ceef90d57de5c
MD5 eab3d94693444492c8b57b652c6519d7
SHA1 a6171219903ecd1a4847f70c8e93f0093408504b
SHA512 32cac58ace8413ff9ba23babb03063e15b3c42dc883d15dc2dfd1a63fe62d93f98437c8a07faf3d010a4117817fbdb4cb540d601cc830a18e884b31e6ddbcb60
SSDEEP 3:MsEllllkEthXllkl2zELRtml:/M/xT02zqS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 768b2f6b14a8445c39e81b45ead9ed3d3df9980cda183559f1636d94adb16156
MD5 666fdf45f5244e37be3543ed5f4dafee
SHA1 bb9f713a50ce72531b1dc9987ed2fb3effe43fdf
SHA512 5b707ad9aac3a5b8f6096ca8cccd623c07e440fa4cfc76f680657aaf266d01502fea585d8c1cc1ea105fd02cc431b2f60e82bde1c55de4670c54795871b8cbff
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 0bf7acbb0285087d671b5a3360a653b0403e4fc4cb1fc9091a707808e0ef8558
MD5 b1be82938f652c04e06634aeeda5b536
SHA1 ad0afc17007f1f71132cb4ca123befe8224c95ba
SHA512 53217104b5b1f81ec4062f2ea13326717f5b18fb71a02df86e5396308e5b96f4feaf84eded80dad08367cdc479f7e96dd3a6753f2fb811507530b38c72e57461
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 685B
SHA256 6fadf2b6d4b355dfefc82067be9f1e2f390eca64c3623e3ae57271e803279f2a
MD5 2c4c18e307105045a489186e25addfaa
SHA1 dd6034f9a9ef708ac0c0985de7e23fdcd7808aad
SHA512 dbd1ca7b71bc939b6210a238bf5b425f50165009f83db5f544fb1777c0def2955718067b3c606339d653c712d49bc4f00593dae2f334699270c600c16482e8c8
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 f81e531492231425e611198ddde068080559102698046722aedb29127ae6ec00
MD5 667e923f0844b492d367b03330cdf9a6
SHA1 7ec67ada64be178a6017ba26e4c82adef1ff160b
SHA512 35fff67a201b7916470c28113392e6339efe2d3f598130c6e73e7ecf385b119ad4ec8575fde810d01539d81f194affc4e90820482eb8dc266063491565b9f7b7
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 dc7d7ff9457fa6886cf9e7455b05e36d61d5a3fa9e005fa48a929e9be253dcc6
MD5 98a252690cb946b377ebdcf5bb7fede1
SHA1 0f91ae0788e472cbc993d8aa415962205f82bf83
SHA512 5956917d2206e15a6c950970e769b3db32d77bdb5bdc74afe38874dbbd2f01d8bd07e8fdcf8751523e6b212f555d221be00a3e5f8e84cfe0e18248ecd9799083
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 7a89e971b8f4972c7449e01408f264395394147fcc38f4ea25555835aed86154
MD5 9db9125a04e94bba18e939c774d02e0c
SHA1 633288877b7343f8aacb25a3c609309713040d86
SHA512 17b236a07a50f97bf5361c38757deee921b2df51eac17f88cc28e6df34c0219c9f34d6ebf393fe384b0e697e95eb96de4f71fb2e2d7b98c1634dbabad9b52d8f
SSDEEP 192:31rc2kJHipKl1aJh8Pyh+Fzx1I+P5tjEsXtScR:31rcHicYMyq9i6tIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 48d487f0ae644140b38a4ea54ce267359a24c189d4a599cc1206151f856cdc2d
MD5 97e0e58fceca0827b3bd71a3050232ee
SHA1 363e517895a6eb4f94e0e7dbee1950a6ba587e84
SHA512 20ecc193af8afc2792dd7c986ef1abab719c0d2f47089dd4039b9a82fca3da6bda91b508fe16f649f78e8318b8a7feff9a6428ec60d7c7ba51c376769ffc2996
SSDEEP 192:31rc2kJH+pKl1aJh8syh+FWx1PMd5tjEsXtScR:31rcH+cY/yqGditIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 b43b24c864c7273f0fbd2e828bf8a5cf0dbaca0af21e90931b8be651b0085592
MD5 34d0697a5a376f66e925703ed7a7a805
SHA1 d845ff4adfed906b8322b437df9f9159f47f150e
SHA512 59c6a695a9a5f305b345230371b6dcdd85e330c4e7706fc87ce1197d043a6f978c251410cb3e9bb3cb849167842123411fd39d9598670b955b34604e8c87942c
SSDEEP 192:31XipKl1aJh8uyh+FMCPa+P5tjEsXtScR:31XicY9yqxS6tIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 87e2c5acb6e5c72a0334baddabcec5b06b78497a613a0711f7c3715b98bf9a6b
MD5 70b9461be1fff1265a31be51e1f011a3
SHA1 ac3d758b189bbc1d01b33740fe7b57d5560f99f2
SHA512 8fe2fb5fe666fe6811eb8bef2aeefda593bd3e2834afd9e209fd8100d5febfa2862dea0882a8a860a06002dc5b0446559e92bcb3dd28a136692b573bca20e9ae
SSDEEP 3072:9Jtel1QotTyzB+lLrOuxfBSw6jKy7JCEmOPXsaUTysR:9rI1Qo5yzkpeXjnJFzXsWA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 ec598c167f34b426395b049f7c991fab969c828e9b3495c85ac0944eb184ab58
MD5 3feb0be90ce41b8df7fffcf8aae69044
SHA1 f1ee4a9fcc98a9f37172a59b56993e8ba0653976
SHA512 068b66a4f4119fabe88d447ab785ad8441ea3a2ce606b3d6849a1af338e693fa358cb06f6713ff2f273d9ca7523f51bc41c61ff16e477fbbc72fd3bb5569b5dc
SSDEEP 3072:tJtel1QotTyzB+lLrOuxfBSw6jKy7JCEmOPXsaUTysR:trI1Qo5yzkpeXjnJFzXsWA
MD5 SHA1 SHA512 SSDEEP

Submit Download

MEMZ.exe

Path C:\Users\Admin\Downloads\MEMZ.exe
Size 16KB
SHA256 3872c12d31fc9825e8661ac01ecee2572460677afbc7093f920a8436a42e28ff
MD5 1d5ad9c8d3fee874d0feb8bfac220a11
SHA1 ca6d3f7e6c784155f664a9179ca64e4034df9595
SHA512 c8246f4137416be33b6d1ac89f2428b7c44d9376ac8489a9fbf65ef128a6c53fb50479e1e400c8e201c8611992ab1d6c1bd3d6cece89013edb4d35cdd22305b1
SSDEEP 192:M2WgyvSW8gRc6olcIEiwqZKBkDFR43xWTM3LHf26gFrcx3sNq:JWgnSmFlcIqq3agmLH+6gF23sN
MD5 SHA1 SHA512 SSDEEP

Submit Download

MEMZ.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\MEMZ.exe:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

note.txt

Path C:\note.txt
Size 218B
SHA256 8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
MD5 afa6955439b8d516721231029fb9ca1b
SHA1 087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA512 5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads