2f1c3f37c6468ebb385731ae5867a7a142ebd58cbb6791f3208a19504cc7e822

Resubmissions

05/07/2024, 22:54

240705-2vvkhayaqk7

05/07/2024, 22:51

240705-2s416azhrf7

Analysis

max time kernel
150s
max time network
123s
platform
windows11-21h2_x64
resource
win11-20240704-en
resource tags

arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system
submitted
05/07/2024, 22:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MEMZ 4.0 Clean/MEMZ-Clean.bat
Size 9KB
Sample240705-2s416azhrf
SHA256 5c3fde60c178ed0306dd3e396032acdc9bc55c690e27a926923dd18238bbd64c
MD5 bbae81b88416d8fba76dd3145a831d19
SHA1 42fa0e1b90ad49f66d4ab96c8cca02f81248da8b
SHA512 f03ac63bbb504cb53dc896c2bec8666257034b1c4a5827a4ad75c434af05f1cd631a814cc8689e60210e4ca757e61390db8d222f05bf9f3a0fa7026bdf8c4368
SSDEEP 192:XBOTDzoOgdlf7MAdTyQuHq2b1vXei2SLca5icrLJlz3:ss/tDyQuHZddL5Jlz3
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3788	MEMZ.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "36"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2068	msedge.exe
2068	msedge.exe
1280	msedge.exe
1280	msedge.exe
1728	msedge.exe
1728	msedge.exe
1252	identity_helper.exe
1252	identity_helper.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
1560	Process not Found
1856	Process not Found
712	Process not Found
2996	Process not Found
1972	Process not Found
4388	Process not Found
3728	Process not Found
2908	Process not Found
2800	Process not Found
4324	Process not Found
2872	Process not Found
2092	Process not Found
5024	Process not Found
1768	Process not Found
3148	Process not Found
876	Process not Found
3932	Process not Found
1220	Process not Found
1956	Process not Found
1672	Process not Found
1316	Process not Found
3632	Process not Found
5092	Process not Found
896	Process not Found
5072	Process not Found
2440	Process not Found
1600	Process not Found
3532	Process not Found
3404	Process not Found
2600	Process not Found
1304	Process not Found
3708	Process not Found
4964	Process not Found
2324	Process not Found
4068	Process not Found
412	Process not Found
3380	Process not Found
4004	Process not Found
3008	Process not Found
4480	Process not Found
1576	Process not Found
3960	Process not Found
640	Process not Found
5096	Process not Found
464	Process not Found
5100	Process not Found
4088	Process not Found
380	Process not Found
2852	Process not Found
552	Process not Found
3848	Process not Found
5020	Process not Found
248	Process not Found
3340	Process not Found
2864	Process not Found
4588	Process not Found
3136	Process not Found
2848	Process not Found
1528	Process not Found
1728	Process not Found
2332	Process not Found
4936	Process not Found
1396	Process not Found
780	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3032	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3032	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3788	MEMZ.exe
3788	MEMZ.exe
1924	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 4944	4088	cmd.exe	78
PID 4088 wrote to memory of 4944	4088	cmd.exe	78
PID 4088 wrote to memory of 3788	4088	cmd.exe	79
PID 4088 wrote to memory of 3788	4088	cmd.exe	79
PID 4088 wrote to memory of 3788	4088	cmd.exe	79
PID 3788 wrote to memory of 1280	3788	MEMZ.exe	81
PID 3788 wrote to memory of 1280	3788	MEMZ.exe	81
PID 1280 wrote to memory of 2332	1280	msedge.exe	82
PID 1280 wrote to memory of 2332	1280	msedge.exe	82
PID 1280 wrote to memory of 3224	1280	msedge.exe	83
PID 1280 wrote to memory of 3224	1280	msedge.exe	83
PID 1280 wrote to memory of 3224	1280	msedge.exe	83
PID 1280 wrote to memory of 3224	1280	msedge.exe	83
PID 1280 wrote to memory of 3224	1280	msedge.exe	83
PID 1280 wrote to memory of 3224	1280	msedge.exe	83
PID 1280 wrote to memory of 3224	1280	msedge.exe	83
PID 1280 wrote to memory of 3224	1280	msedge.exe	83
PID 1280 wrote to memory of 3224	1280	msedge.exe	83
PID 1280 wrote to memory of 3224	1280	msedge.exe	83
PID 1280 wrote to memory of 3224	1280	msedge.exe	83
PID 1280 wrote to memory of 3224	1280	msedge.exe	83
PID 1280 wrote to memory of 3224	1280	msedge.exe	83
PID 1280 wrote to memory of 3224	1280	msedge.exe	83
PID 1280 wrote to memory of 3224	1280	msedge.exe	83
PID 1280 wrote to memory of 3224	1280	msedge.exe	83
PID 1280 wrote to memory of 3224	1280	msedge.exe	83
PID 1280 wrote to memory of 3224	1280	msedge.exe	83
PID 1280 wrote to memory of 3224	1280	msedge.exe	83
PID 1280 wrote to memory of 3224	1280	msedge.exe	83
PID 1280 wrote to memory of 3224	1280	msedge.exe	83
PID 1280 wrote to memory of 3224	1280	msedge.exe	83
PID 1280 wrote to memory of 3224	1280	msedge.exe	83
PID 1280 wrote to memory of 3224	1280	msedge.exe	83
PID 1280 wrote to memory of 3224	1280	msedge.exe	83
PID 1280 wrote to memory of 3224	1280	msedge.exe	83
PID 1280 wrote to memory of 3224	1280	msedge.exe	83
PID 1280 wrote to memory of 3224	1280	msedge.exe	83
PID 1280 wrote to memory of 3224	1280	msedge.exe	83
PID 1280 wrote to memory of 3224	1280	msedge.exe	83
PID 1280 wrote to memory of 3224	1280	msedge.exe	83
PID 1280 wrote to memory of 3224	1280	msedge.exe	83
PID 1280 wrote to memory of 3224	1280	msedge.exe	83
PID 1280 wrote to memory of 3224	1280	msedge.exe	83
PID 1280 wrote to memory of 3224	1280	msedge.exe	83
PID 1280 wrote to memory of 3224	1280	msedge.exe	83
PID 1280 wrote to memory of 3224	1280	msedge.exe	83
PID 1280 wrote to memory of 3224	1280	msedge.exe	83
PID 1280 wrote to memory of 3224	1280	msedge.exe	83
PID 1280 wrote to memory of 3224	1280	msedge.exe	83
PID 1280 wrote to memory of 2068	1280	msedge.exe	84
PID 1280 wrote to memory of 2068	1280	msedge.exe	84
PID 1280 wrote to memory of 896	1280	msedge.exe	85
PID 1280 wrote to memory of 896	1280	msedge.exe	85
PID 1280 wrote to memory of 896	1280	msedge.exe	85
PID 1280 wrote to memory of 896	1280	msedge.exe	85
PID 1280 wrote to memory of 896	1280	msedge.exe	85
PID 1280 wrote to memory of 896	1280	msedge.exe	85
PID 1280 wrote to memory of 896	1280	msedge.exe	85
PID 1280 wrote to memory of 896	1280	msedge.exe	85
PID 1280 wrote to memory of 896	1280	msedge.exe	85
PID 1280 wrote to memory of 896	1280	msedge.exe	85
PID 1280 wrote to memory of 896	1280	msedge.exe	85
PID 1280 wrote to memory of 896	1280	msedge.exe	85
PID 1280 wrote to memory of 896	1280	msedge.exe	85

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MEMZ 4.0 Clean\MEMZ-Clean.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Windows\system32\cscript.exe
  cscript x.js
  2⤵
  PID:4944
- C:\Users\Admin\AppData\Roaming\MEMZ.exe
  "C:\Users\Admin\AppData\Roaming\MEMZ.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=half+life+3+release+date
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff1e493cb8,0x7fff1e493cc8,0x7fff1e493cd8
      4⤵
      PID:2332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,17762533436644551244,3390904214575110429,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2016 /prefetch:2
      4⤵
      PID:3224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1996,17762533436644551244,3390904214575110429,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1996,17762533436644551244,3390904214575110429,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2572 /prefetch:8
      4⤵
      PID:896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,17762533436644551244,3390904214575110429,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
      4⤵
      PID:2628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,17762533436644551244,3390904214575110429,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
      4⤵
      PID:4924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,17762533436644551244,3390904214575110429,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
      4⤵
      PID:4648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,17762533436644551244,3390904214575110429,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
      4⤵
      PID:2820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1996,17762533436644551244,3390904214575110429,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,17762533436644551244,3390904214575110429,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5712 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,17762533436644551244,3390904214575110429,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
      4⤵
      PID:2664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,17762533436644551244,3390904214575110429,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
      4⤵
      PID:1312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,17762533436644551244,3390904214575110429,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:1
      4⤵
      PID:464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,17762533436644551244,3390904214575110429,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
      4⤵
      PID:1152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,17762533436644551244,3390904214575110429,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
      4⤵
      PID:4460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,17762533436644551244,3390904214575110429,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
      4⤵
      PID:852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=dank+memz
    3⤵
    PID:704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff1e493cb8,0x7fff1e493cc8,0x7fff1e493cd8
      4⤵
      PID:1728

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D0 0x00000000000004E8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2604

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39f8055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 59db861ff42f39a5f777bd9b8a167b7b15c96e60ed148ea875a9f1f0d4caaa6f
MD5 11b22949a84a750056bef0aa6ea4fc45
SHA1 c3d49da0344a2bb3cebbce6569b1fd223aa2ebd8
SHA512 01bbc38a4b8fb8a53c3897d63d3362c8a980fcb395986671cfd13e0fa893a68ab3e45379127da69565e0b1e4125a41834c62b06b8d9b852c6b71a1ec68a930b0
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 7980e988f80ffc29a79b2d13c0d4160ad1d1f77fb6ddd95b7ec263b7421a0c91
MD5 9b1f20c797906f82fd003270485ceaef
SHA1 51ee0859382d77aba329e0ec2dad81b383c534ed
SHA512 7b8f859ffa55759a1e90540754bc80a4218ddf2ee953736865ba4c5c9aa33556bd8ac45da1dce7426c75c5d754268c450054f875927cbba800ad665f09941cde
MD5 SHA1 SHA512

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002
Size 24KB
SHA256 e664eef3d68ac6336a28be033165d4780e8a5ab28f0d90df1b148ef86babb610
MD5 c594a826934b9505d591d0f7a7df80b7
SHA1 c04b8637e686f71f3fc46a29a86346ba9b04ae18
SHA512 04a1dfdb8ee2f5fefa101d5e3ff36e87659fd774e96aa8c5941d3353ccc268a125822cf01533c74839e5f1c54725da9cc437d3d69b88e5bf3f99caccd4d75961
SSDEEP 384:WVO9Au5n8w8JCE3z7e7Ttbu5+Esl5fnOPoOj53OqYRotc+44:fWkn0RSdu59s3nOPo8NOqdtX
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003
Size 211KB
SHA256 043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed
MD5 151fb811968eaf8efb840908b89dc9d4
SHA1 7ec811009fd9b0e6d92d12d78b002275f2f1bee1
SHA512 83aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674
SSDEEP 6144:U1jkj9l1xrxCD7bj/M3QiwUwTLo2xZ/gKep:U1uxxNQ7PMATU8o2xZ/jep
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 f2277b6866f9f9294763a7444b8c3d0d251f8dd9cce45c6f9e81f5d1e20b99f4
MD5 9281c329a55549c10fe954b82f307e30
SHA1 a11e43aacd23ca4168ac5db579b21442ae93e11e
SHA512 e762caa63027cb89244fb5fdcda441f800c0abc3317cf784d937a2264ebe85f639f55aca9491a10c7c044bb58a4c8717399d19d02c4de77472bca2505b3a6a8b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 76dac4d155e469a6369e2c7e717189ced3623f153d106531f29c2a6dddf679c6
MD5 01ec74c2dc3f5ba9f473004caae780bf
SHA1 4156c67ad6d9cae4bf49c529e170cbad725a56b8
SHA512 bf09fa6e75724c4793cb82f38a987bca78c5caa7ab03be8a6c67375ee41b93a892d128b1bdebe6cf96301b5336f1860535f1f6fcbc2f1ac20cdb8aca3a341c65
SSDEEP 96:nok3Yw7LtkiemPwSv0MoiVmdHI4J2ec0WQyV+VpziX3wI3:nok3xLtknWv0MAIercLx93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 7bb2c5ce5461ca29a0a3e618e4b27fab3e049efb7b67b1faa3ebec34a046f10f
MD5 80f940d5b05fb3e25f3f29caf4f4478e
SHA1 c1cf44c81df1e242c6a3bee011d45f8c101e1291
SHA512 7a03e9490bf728742b1dd08632301dc4a4785e9f6e147fb65d995633e63506b14707bc229fea4e331a6cdbc99cc883debe20fef88e36eebd116bdccd7912a646
SSDEEP 96:nok3mw7Ltkie8PwSv0MoiVmdXuH1jI/Jjec0WQyV+VpAiX3wI3:nok3/LtknQv0M+uHhIRKcLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c9d955d6e241adb4be8b9463845660899483a4ce6e97c515e50b8b421adbba62
MD5 f830ddff412845fdcd7ebfb9f2a05950
SHA1 83b770dc7883e0e939c1df27f05b4452494d28fe
SHA512 905b5fe3569ad321ef04e1a7c2c06dc9a90be1034ff499b883ebe1448e5f1193f3380c8d7e0aaf486e5dd2c589c4d88c86c9dde87a86614a47e6622324f55962
SSDEEP 96:nok3mw7LtkietPwSv0MoiVmdSY7MkdeYv6JqeL0WQyV+VpAiX3wI3:nok3/LtknZv0MXY7BeYvQPLLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 d46c5fb3207d7b6701a47edb1e53d7e528b26e58980db5a6463eff72fac8f281
MD5 ff26e1b6550340aca51dd17ebd510b0a
SHA1 b1ab46dfec8e06cbf494d3b14f6fc1bd6ab75a0c
SHA512 a4d50fb2c03d4878ac6d0891c590a4986652b8c16ce1088bc9a584a71ab19a8b0e27d0b2c161033ffc2b540d872fe67b5b6e1d12b6900e763341448efc91faab
SSDEEP 192:AoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGHf3Te2RUc6RusIYXC1FxTTrV:49iIxuERzA83h09RZxASG/TV7sIYXC1l
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 686779589a3b56997dd29c9abbb10035372abb933e045c6bc877ab6769735426
MD5 fae301d9e67206ec96f02f8b94d676ce
SHA1 1e9f68a43e827b86a197266764a188984a2de13a
SHA512 f2e24775e09c5a780f00adc838b8fb572d280c3fa136ba6d089e5d03feb305b88ad704b4a1b76fcc93d2fb20d34673d138ebe9674b94d9ac3b55b3aa7f1a8480
SSDEEP 192:QoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASG2f3Te2RUccSOusYYXC1FxTTp:I9iIxuERzA83h09RZxASGqTVcssYYXCr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\MEMZ 4.0 Clean\x
Size 8KB
SHA256 0557ea4c5e309b16458ca32ac617b76d1a55f5f0103e368d05c0f0386b7a0a43
MD5 5ce1a2162bf5e16485f5e263b3cc5cf5
SHA1 e9ec3e06bef08fcf29be35c6a4b2217a8328133c
SHA512 ceb5e270bdbcab5be645e50705e3111a5c4751a7a865580d53fa86580025201264a49dd0ea9135b10cff28d7bb21b767ac5d4aff40e880a866ab35df273b5de1
SSDEEP 192:T4KX0Tg44AQsHkuxaWJOnJjWv07iVKmWynWmFr+E:BKu+xawOdFtmHWs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\MEMZ 4.0 Clean\x
Size 4KB
SHA256 88339750431112ed60cdf9bdb7697434ba9b38e2d15ad604c4462705bc1bdfcf
MD5 20e335859ff991575cf1ddf538e5817c
SHA1 1e81b804d67d6c0e22c0cef7e1cb9f86ce0ef5ee
SHA512 012251b342722cf35ebec2c7d071db505a992d81fc4b3492cd87640b5c955dc084825fc5e72edc821f4c481867183f21d26cd904fe7f0373d1156332f87b031d
SSDEEP 96:Tm/Ldo2g0Tg4JlIAQ5uJ80JyunrOTCC1WJPmZ:T4KX0Tg44AQsHkuxaWJOZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

x.js

Path C:\Users\Admin\AppData\Local\Temp\MEMZ 4.0 Clean\x.js
Size 448B
SHA256 aa01b8864b43e92077a106ed3d4656a511f3ba1910fba40c78a32ee6a621d596
MD5 8eec8704d2a7bc80b95b7460c06f4854
SHA1 1b34585c1fa7ec0bd0505478ac9dbb8b8d19f326
SHA512 e274b92810e9a30627a65f87448d784967a2fcfbf49858cbe6ccb841f09e0f53fde253ecc1ea0c7de491d8cc56a6cf8c79d1b7c657e72928cfb0479d11035210
MD5 SHA1 SHA512

Submit Download

z.zip

Path C:\Users\Admin\AppData\Local\Temp\MEMZ 4.0 Clean\z.zip
Size 5KB
SHA256 39df3364a3af6f7d360aa7e1345e27befc4be960e0e7e7e060b20f3389b80e76
MD5 d2ea024b943caa1361833885b832d20b
SHA1 1e17c27a3260862645bdaff5cf82c44172d4df9a
SHA512 7b7cfb5e689feed6a52eedf36b89a7b5cc411191571c0af5e5d704b5f24bfa04afa62d1daab159a7e5702d80e56f3946bf32db0551d256419ca12cd3c57dcecb
SSDEEP 96:cCfNDkKYP0EaCl4Nmw3oEpQGgRSYFJffDoWYISIwnCAeTghpGPFCmN:bfVkVCC0mw3pxgdrjpYISDKg+t
MD5 SHA1 SHA512 SSDEEP

Submit Download

MEMZ.exe

Path C:\Users\Admin\AppData\Roaming\MEMZ.exe
Size 12KB
SHA256 4bbf7589615ebdb6c769d6d2e7bdcb26072bac0cda6e225a4133ba8819e688d5
MD5 9c642c5b111ee85a6bccffc7af896a51
SHA1 eca8571b994fd40e2018f48c214fab6472a98bab
SHA512 23cc74b5a7bdf70ba789d1730a0009414cfb9c780544e3d8d841be58782b9a9a089969c4295a0da25d07285505992386486d6ff0524e75605b96bb99cd3aaa1c
SSDEEP 192:BCMfc/GinpRBueYDw4+kEeN4FRrfMFFp3+f2dvGhT59uay:AMfceinpOeRENYhfOj+eGdKa
MD5 SHA1 SHA512 SSDEEP

Submit Download