Analysis
-
max time kernel
841s -
max time network
846s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
08/07/2024, 16:24
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/Dfmaaa/MEMZ-virus
Resource
win10v2004-20240704-en
General
-
Target
https://github.com/Dfmaaa/MEMZ-virus
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3848 msedge.exe 3848 msedge.exe 3356 msedge.exe 3356 msedge.exe 2064 identity_helper.exe 2064 identity_helper.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3356 msedge.exe 3356 msedge.exe 3356 msedge.exe 3356 msedge.exe 3356 msedge.exe 3356 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3356 msedge.exe 3356 msedge.exe 3356 msedge.exe 3356 msedge.exe 3356 msedge.exe 3356 msedge.exe 3356 msedge.exe 3356 msedge.exe 3356 msedge.exe 3356 msedge.exe 3356 msedge.exe 3356 msedge.exe 3356 msedge.exe 3356 msedge.exe 3356 msedge.exe 3356 msedge.exe 3356 msedge.exe 3356 msedge.exe 3356 msedge.exe 3356 msedge.exe 3356 msedge.exe 3356 msedge.exe 3356 msedge.exe 3356 msedge.exe 3356 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3356 msedge.exe 3356 msedge.exe 3356 msedge.exe 3356 msedge.exe 3356 msedge.exe 3356 msedge.exe 3356 msedge.exe 3356 msedge.exe 3356 msedge.exe 3356 msedge.exe 3356 msedge.exe 3356 msedge.exe 3356 msedge.exe 3356 msedge.exe 3356 msedge.exe 3356 msedge.exe 3356 msedge.exe 3356 msedge.exe 3356 msedge.exe 3356 msedge.exe 3356 msedge.exe 3356 msedge.exe 3356 msedge.exe 3356 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3356 wrote to memory of 3076 3356 msedge.exe 82 PID 3356 wrote to memory of 3076 3356 msedge.exe 82 PID 3356 wrote to memory of 2872 3356 msedge.exe 83 PID 3356 wrote to memory of 2872 3356 msedge.exe 83 PID 3356 wrote to memory of 2872 3356 msedge.exe 83 PID 3356 wrote to memory of 2872 3356 msedge.exe 83 PID 3356 wrote to memory of 2872 3356 msedge.exe 83 PID 3356 wrote to memory of 2872 3356 msedge.exe 83 PID 3356 wrote to memory of 2872 3356 msedge.exe 83 PID 3356 wrote to memory of 2872 3356 msedge.exe 83 PID 3356 wrote to memory of 2872 3356 msedge.exe 83 PID 3356 wrote to memory of 2872 3356 msedge.exe 83 PID 3356 wrote to memory of 2872 3356 msedge.exe 83 PID 3356 wrote to memory of 2872 3356 msedge.exe 83 PID 3356 wrote to memory of 2872 3356 msedge.exe 83 PID 3356 wrote to memory of 2872 3356 msedge.exe 83 PID 3356 wrote to memory of 2872 3356 msedge.exe 83 PID 3356 wrote to memory of 2872 3356 msedge.exe 83 PID 3356 wrote to memory of 2872 3356 msedge.exe 83 PID 3356 wrote to memory of 2872 3356 msedge.exe 83 PID 3356 wrote to memory of 2872 3356 msedge.exe 83 PID 3356 wrote to memory of 2872 3356 msedge.exe 83 PID 3356 wrote to memory of 2872 3356 msedge.exe 83 PID 3356 wrote to memory of 2872 3356 msedge.exe 83 PID 3356 wrote to memory of 2872 3356 msedge.exe 83 PID 3356 wrote to memory of 2872 3356 msedge.exe 83 PID 3356 wrote to memory of 2872 3356 msedge.exe 83 PID 3356 wrote to memory of 2872 3356 msedge.exe 83 PID 3356 wrote to memory of 2872 3356 msedge.exe 83 PID 3356 wrote to memory of 2872 3356 msedge.exe 83 PID 3356 wrote to memory of 2872 3356 msedge.exe 83 PID 3356 wrote to memory of 2872 3356 msedge.exe 83 PID 3356 wrote to memory of 2872 3356 msedge.exe 83 PID 3356 wrote to memory of 2872 3356 msedge.exe 83 PID 3356 wrote to memory of 2872 3356 msedge.exe 83 PID 3356 wrote to memory of 2872 3356 msedge.exe 83 PID 3356 wrote to memory of 2872 3356 msedge.exe 83 PID 3356 wrote to memory of 2872 3356 msedge.exe 83 PID 3356 wrote to memory of 2872 3356 msedge.exe 83 PID 3356 wrote to memory of 2872 3356 msedge.exe 83 PID 3356 wrote to memory of 2872 3356 msedge.exe 83 PID 3356 wrote to memory of 2872 3356 msedge.exe 83 PID 3356 wrote to memory of 3848 3356 msedge.exe 84 PID 3356 wrote to memory of 3848 3356 msedge.exe 84 PID 3356 wrote to memory of 1256 3356 msedge.exe 85 PID 3356 wrote to memory of 1256 3356 msedge.exe 85 PID 3356 wrote to memory of 1256 3356 msedge.exe 85 PID 3356 wrote to memory of 1256 3356 msedge.exe 85 PID 3356 wrote to memory of 1256 3356 msedge.exe 85 PID 3356 wrote to memory of 1256 3356 msedge.exe 85 PID 3356 wrote to memory of 1256 3356 msedge.exe 85 PID 3356 wrote to memory of 1256 3356 msedge.exe 85 PID 3356 wrote to memory of 1256 3356 msedge.exe 85 PID 3356 wrote to memory of 1256 3356 msedge.exe 85 PID 3356 wrote to memory of 1256 3356 msedge.exe 85 PID 3356 wrote to memory of 1256 3356 msedge.exe 85 PID 3356 wrote to memory of 1256 3356 msedge.exe 85 PID 3356 wrote to memory of 1256 3356 msedge.exe 85 PID 3356 wrote to memory of 1256 3356 msedge.exe 85 PID 3356 wrote to memory of 1256 3356 msedge.exe 85 PID 3356 wrote to memory of 1256 3356 msedge.exe 85 PID 3356 wrote to memory of 1256 3356 msedge.exe 85 PID 3356 wrote to memory of 1256 3356 msedge.exe 85 PID 3356 wrote to memory of 1256 3356 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Dfmaaa/MEMZ-virus1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xe0,0xe4,0xd8,0xdc,0x108,0x7ffa428c46f8,0x7ffa428c4708,0x7ffa428c47182⤵PID:3076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,6077096942785841903,4269941469821509969,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:22⤵PID:2872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,6077096942785841903,4269941469821509969,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,6077096942785841903,4269941469821509969,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:82⤵PID:1256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6077096942785841903,4269941469821509969,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:12⤵PID:2360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6077096942785841903,4269941469821509969,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:12⤵PID:5108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,6077096942785841903,4269941469821509969,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:82⤵PID:4428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,6077096942785841903,4269941469821509969,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6077096942785841903,4269941469821509969,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:12⤵PID:536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6077096942785841903,4269941469821509969,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:12⤵PID:2904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6077096942785841903,4269941469821509969,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:12⤵PID:1528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6077096942785841903,4269941469821509969,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:12⤵PID:3424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,6077096942785841903,4269941469821509969,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4904 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1068
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3768
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1420
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5de1d175f3af722d1feb1c205f4e92d1e
SHA1019cf8527a9b94bd0b35418bf7be8348be5a1c39
SHA2561b99cae942ebf99c31795fa279d51b1a2379ca0af7b27bd3c58ea6c78a033924
SHA512f0dcd08afd3c6a761cc1afa2846ec23fb5438d6127ebd535a754498debabd0b1ebd04858d1b98be92faf14b512f982b1f3dcbb702860e96877eb835f763f9734
-
Filesize
152B
MD506b496d28461d5c01fc81bc2be6a9978
SHA136e7a9d9c7a924d5bb448d68038c7fe5e6cbf5aa
SHA256e4a2d1395627095b0fa55e977e527ccb5b71dff3cd2d138df498f50f9f5ab507
SHA5126488a807c978d38d65010583c1e5582548ab8102ebd68ee827e603c9bdfcdbb9f98a488d31414a829409f6edca8bd2eb4aadd4ff31b144de41249fa63a26bc91
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize2KB
MD54d5e17063081a95d46155c3436be07cf
SHA1f91a744eac51ac6892c8a5f0da20ad92f9a7e412
SHA25637b37799ff895418494dfaf97fb565fdfb3a70448ea3b58c333d70413a22cee4
SHA51291007a3d615789f64d753fdc85e0b6614dad404fd714593d4be5866f6cd5f8aed5de5c7c1ec127722fe9dae7cf1bf943427397cb9a2f55a41c46ee098f0c3b4c
-
Filesize
496B
MD57df1a20d1dccadda213182dd9dba6a75
SHA14a526da0ddc95c285a895f70203dfd2178d24b33
SHA256715cb6a928b115cdff9977761b45db4751eaa015d46f3e99aed4f90ea2cd8fee
SHA5127a89dbb0a928e31dfe117e144e23555befd1c5a499128f651ee1ddf96b4e9e5112303e5c6c73439ae99bfcd894ded94b91e7d732f477d3a93864324e46083766
-
Filesize
6KB
MD5c38f057a3c1098a7fb7f53adc1198887
SHA1eddb27243f49df3c7cbbc7ec2912737023a2bad4
SHA2562f8c0b98e18cc5117e6140ab6075491cca4e23a76c71b4cc24986c48bdf65e8f
SHA512419c2efd3b8209437afe277d5af3898c597f32108d808cb3117fa77796525f5fd12a51f9fdc587d0c4b9897856db462b990c13a018beb0e83c68edc1dbf85451
-
Filesize
6KB
MD5077fb7b78f2af844a20263fa5acf44ee
SHA16ddf4ca8a0c6c934866bf18691ce4e6c830269d2
SHA256c72fd37daee616b42f367c495b4acb9de65b6dea16768c588e02b33de8e810ee
SHA5124fb52ecd8be24e7104e29c2a4a7101fdc1dec0355ff91ef62931592d299184f3509373c989b0861d96707294228a6370e2a38dac574705e99456239c290458f4
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5de04075b754e4e742b87968472aa6e35
SHA10505a9ba3a434fb55929eeebec51aa18c1f4b23b
SHA256c45b295912f2eff3e371f904b78c8535fe0d3ab3de8efe3a00312e0248565575
SHA512322f7414a223d965cf4029a690b31ae1f0abc83a51f493ebffe9b396a8213ae29f0604e3105950ff3851266a151912b6e3199a6f358ec14312c203e45ff18490