3872c12d31fc9825e8661ac01ecee2572460677afbc7093f920a8436a42e28ff

Analysis

max time kernel
44s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 10:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
MEMZ.exe
Size 16KB
Sample240614-mbqd4swekd
SHA256 3872c12d31fc9825e8661ac01ecee2572460677afbc7093f920a8436a42e28ff
MD5 1d5ad9c8d3fee874d0feb8bfac220a11
SHA1 ca6d3f7e6c784155f664a9179ca64e4034df9595
SHA512 c8246f4137416be33b6d1ac89f2428b7c44d9376ac8489a9fbf65ef128a6c53fb50479e1e400c8e201c8611992ab1d6c1bd3d6cece89013edb4d35cdd22305b1
SSDEEP 192:M2WgyvSW8gRc6olcIEiwqZKBkDFR43xWTM3LHf26gFrcx3sNq:JWgnSmFlcIqq3agmLH+6gF23sN
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

bootkit persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	MEMZ.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	MEMZ.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1740	MEMZ.exe
1740	MEMZ.exe
1740	MEMZ.exe
1452	MEMZ.exe
1740	MEMZ.exe
1452	MEMZ.exe
4080	MEMZ.exe
4080	MEMZ.exe
4080	MEMZ.exe
1452	MEMZ.exe
4080	MEMZ.exe
1452	MEMZ.exe
1740	MEMZ.exe
1740	MEMZ.exe
4144	MEMZ.exe
4144	MEMZ.exe
4332	MEMZ.exe
4332	MEMZ.exe
4332	MEMZ.exe
4144	MEMZ.exe
4332	MEMZ.exe
4144	MEMZ.exe
1740	MEMZ.exe
1740	MEMZ.exe
1452	MEMZ.exe
1452	MEMZ.exe
4080	MEMZ.exe
4080	MEMZ.exe
4080	MEMZ.exe
1452	MEMZ.exe
1452	MEMZ.exe
4080	MEMZ.exe
1740	MEMZ.exe
4144	MEMZ.exe
1740	MEMZ.exe
4144	MEMZ.exe
4332	MEMZ.exe
4332	MEMZ.exe
4332	MEMZ.exe
4144	MEMZ.exe
4332	MEMZ.exe
4144	MEMZ.exe
1740	MEMZ.exe
4080	MEMZ.exe
1740	MEMZ.exe
4080	MEMZ.exe
1452	MEMZ.exe
1452	MEMZ.exe
1452	MEMZ.exe
4080	MEMZ.exe
1452	MEMZ.exe
4080	MEMZ.exe
1740	MEMZ.exe
1740	MEMZ.exe
4144	MEMZ.exe
4144	MEMZ.exe
4332	MEMZ.exe
4332	MEMZ.exe
4144	MEMZ.exe
4332	MEMZ.exe
4144	MEMZ.exe
4332	MEMZ.exe
1740	MEMZ.exe
1740	MEMZ.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3288	msedge.exe
3288	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1788	taskmgr.exe
Token: SeSystemProfilePrivilege	1788	taskmgr.exe
Token: SeCreateGlobalPrivilege	1788	taskmgr.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
1788	taskmgr.exe
1788	taskmgr.exe
1788	taskmgr.exe
1788	taskmgr.exe
1788	taskmgr.exe
1788	taskmgr.exe
1788	taskmgr.exe
1788	taskmgr.exe
1788	taskmgr.exe
1788	taskmgr.exe
1788	taskmgr.exe
1788	taskmgr.exe
1788	taskmgr.exe
1788	taskmgr.exe
1788	taskmgr.exe
1788	taskmgr.exe
1788	taskmgr.exe
1788	taskmgr.exe
1788	taskmgr.exe
1788	taskmgr.exe
1788	taskmgr.exe
1788	taskmgr.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe

Suspicious use of SendNotifyMessage 38 IoCs

pid	Process
1788	taskmgr.exe
1788	taskmgr.exe
1788	taskmgr.exe
1788	taskmgr.exe
1788	taskmgr.exe
1788	taskmgr.exe
1788	taskmgr.exe
1788	taskmgr.exe
1788	taskmgr.exe
1788	taskmgr.exe
1788	taskmgr.exe
1788	taskmgr.exe
1788	taskmgr.exe
1788	taskmgr.exe
1788	taskmgr.exe
1788	taskmgr.exe
1788	taskmgr.exe
1788	taskmgr.exe
1788	taskmgr.exe
1788	taskmgr.exe
1788	taskmgr.exe
1788	taskmgr.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 1740	4660	MEMZ.exe	85
PID 4660 wrote to memory of 1740	4660	MEMZ.exe	85
PID 4660 wrote to memory of 1740	4660	MEMZ.exe	85
PID 4660 wrote to memory of 1452	4660	MEMZ.exe	86
PID 4660 wrote to memory of 1452	4660	MEMZ.exe	86
PID 4660 wrote to memory of 1452	4660	MEMZ.exe	86
PID 4660 wrote to memory of 4080	4660	MEMZ.exe	87
PID 4660 wrote to memory of 4080	4660	MEMZ.exe	87
PID 4660 wrote to memory of 4080	4660	MEMZ.exe	87
PID 4660 wrote to memory of 4332	4660	MEMZ.exe	88
PID 4660 wrote to memory of 4332	4660	MEMZ.exe	88
PID 4660 wrote to memory of 4332	4660	MEMZ.exe	88
PID 4660 wrote to memory of 4144	4660	MEMZ.exe	89
PID 4660 wrote to memory of 4144	4660	MEMZ.exe	89
PID 4660 wrote to memory of 4144	4660	MEMZ.exe	89
PID 4660 wrote to memory of 4072	4660	MEMZ.exe	90
PID 4660 wrote to memory of 4072	4660	MEMZ.exe	90
PID 4660 wrote to memory of 4072	4660	MEMZ.exe	90
PID 4072 wrote to memory of 2724	4072	MEMZ.exe	92
PID 4072 wrote to memory of 2724	4072	MEMZ.exe	92
PID 4072 wrote to memory of 2724	4072	MEMZ.exe	92
PID 4072 wrote to memory of 3288	4072	MEMZ.exe	98
PID 4072 wrote to memory of 3288	4072	MEMZ.exe	98
PID 3288 wrote to memory of 4448	3288	msedge.exe	99
PID 3288 wrote to memory of 4448	3288	msedge.exe	99
PID 3288 wrote to memory of 488	3288	msedge.exe	100
PID 3288 wrote to memory of 488	3288	msedge.exe	100
PID 3288 wrote to memory of 488	3288	msedge.exe	100
PID 3288 wrote to memory of 488	3288	msedge.exe	100
PID 3288 wrote to memory of 488	3288	msedge.exe	100
PID 3288 wrote to memory of 488	3288	msedge.exe	100
PID 3288 wrote to memory of 488	3288	msedge.exe	100
PID 3288 wrote to memory of 488	3288	msedge.exe	100
PID 3288 wrote to memory of 488	3288	msedge.exe	100
PID 3288 wrote to memory of 488	3288	msedge.exe	100
PID 3288 wrote to memory of 488	3288	msedge.exe	100
PID 3288 wrote to memory of 488	3288	msedge.exe	100
PID 3288 wrote to memory of 488	3288	msedge.exe	100
PID 3288 wrote to memory of 488	3288	msedge.exe	100
PID 3288 wrote to memory of 488	3288	msedge.exe	100
PID 3288 wrote to memory of 488	3288	msedge.exe	100
PID 3288 wrote to memory of 488	3288	msedge.exe	100
PID 3288 wrote to memory of 488	3288	msedge.exe	100
PID 3288 wrote to memory of 488	3288	msedge.exe	100
PID 3288 wrote to memory of 488	3288	msedge.exe	100
PID 3288 wrote to memory of 488	3288	msedge.exe	100
PID 3288 wrote to memory of 488	3288	msedge.exe	100
PID 3288 wrote to memory of 488	3288	msedge.exe	100
PID 3288 wrote to memory of 488	3288	msedge.exe	100
PID 3288 wrote to memory of 488	3288	msedge.exe	100
PID 3288 wrote to memory of 488	3288	msedge.exe	100
PID 3288 wrote to memory of 488	3288	msedge.exe	100
PID 3288 wrote to memory of 488	3288	msedge.exe	100
PID 3288 wrote to memory of 488	3288	msedge.exe	100
PID 3288 wrote to memory of 488	3288	msedge.exe	100
PID 3288 wrote to memory of 488	3288	msedge.exe	100
PID 3288 wrote to memory of 488	3288	msedge.exe	100
PID 3288 wrote to memory of 488	3288	msedge.exe	100
PID 3288 wrote to memory of 488	3288	msedge.exe	100
PID 3288 wrote to memory of 488	3288	msedge.exe	100
PID 3288 wrote to memory of 488	3288	msedge.exe	100
PID 3288 wrote to memory of 488	3288	msedge.exe	100
PID 3288 wrote to memory of 488	3288	msedge.exe	100
PID 3288 wrote to memory of 488	3288	msedge.exe	100

C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1740
- C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1452
- C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4080
- C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4332
- C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4144
- C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /main
  2⤵
  - Checks computer location settings
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of WriteProcessMemory
  PID:4072
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    PID:2724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=g3t+r3kt
    3⤵
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb070246f8,0x7ffb07024708,0x7ffb07024718
      4⤵
      PID:4448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,13299707672886416876,9122837320895610670,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
      4⤵
      PID:488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,13299707672886416876,9122837320895610670,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
      4⤵
      PID:404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,13299707672886416876,9122837320895610670,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
      4⤵
      PID:4308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13299707672886416876,9122837320895610670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
      4⤵
      PID:948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13299707672886416876,9122837320895610670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
      4⤵
      PID:1232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13299707672886416876,9122837320895610670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
      4⤵
      PID:2748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13299707672886416876,9122837320895610670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
      4⤵
      PID:2440

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c
MD5 c39b3aa574c0c938c80eb263bb450311
SHA1 f4d11275b63f4f906be7a55ec6ca050c62c18c88
SHA512 eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201
MD5 dabfafd78687947a9de64dd5b776d25f
SHA1 16084c74980dbad713f9d332091985808b436dea
SHA512 dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 fa2a7490a0471466386ba88ce90696cd36249b6cdcffd0ac6ec23cc2bdb1c4c0
MD5 2c60b1f2aca8634277f602475a456d22
SHA1 1b6e569067fbf52f575f11f6906d3b796ed6105e
SHA512 0ac266067e087ed3e2883de11c8a78aac78fbda9b9a10a359632136cd6d79c5656faaf077ff724dbb0e48e577e17fc3a99e1ff82f20a3113fa5e1ce980b26197
SSDEEP 96:nokVoxm/DQYmqv1lGmwpvWMoiVmdeH1Da+UWQyV+VDCziEwb:nokfI0LGmGWMXg+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

note.txt

Path C:\note.txt
Size 218B
SHA256 8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
MD5 afa6955439b8d516721231029fb9ca1b
SHA1 087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA512 5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
MD5 SHA1 SHA512

Submit Download

memory/1788-13-0x000001794AC60000-0x000001794AC61000-memory.dmp

Download

memory/1788-14-0x000001794AC60000-0x000001794AC61000-memory.dmp

Download

memory/1788-12-0x000001794AC60000-0x000001794AC61000-memory.dmp

Download

memory/1788-11-0x000001794AC60000-0x000001794AC61000-memory.dmp

Download

memory/1788-10-0x000001794AC60000-0x000001794AC61000-memory.dmp

Download

memory/1788-9-0x000001794AC60000-0x000001794AC61000-memory.dmp

Download

memory/1788-8-0x000001794AC60000-0x000001794AC61000-memory.dmp

Download

memory/1788-3-0x000001794AC60000-0x000001794AC61000-memory.dmp

Download

memory/1788-4-0x000001794AC60000-0x000001794AC61000-memory.dmp

Download

memory/1788-2-0x000001794AC60000-0x000001794AC61000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads