hxxps://github[.]com/Dfmaaa/MEMZ-virus/blob/main/MEMZ[.]exe

Resubmissions

19/08/2024, 06:39

240819-hel4mssfln 8

19/08/2024, 04:02

240819-elvgtawhnp 8

Analysis

max time kernel
43s
max time network
44s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 06:39

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://github.com/Dfmaaa/MEMZ-virus/blob/main/MEMZ.exe

Score

8^/10

bootkit discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	MEMZ (1).exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	MEMZ (1).exe

Executes dropped EXE 9 IoCs

pid	Process
4416	MEMZ (1).exe
1872	MEMZ (1).exe
2716	MEMZ (1).exe
3680	MEMZ (1).exe
5128	MEMZ (1).exe
5156	MEMZ (1).exe
5180	MEMZ (1).exe
5204	MEMZ (1).exe
5228	MEMZ (1).exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
55	raw.githubusercontent.com
56	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ (1).exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ (1).exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 706734.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 916606.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
228	msedge.exe
228	msedge.exe
412	msedge.exe
412	msedge.exe
1132	identity_helper.exe
1132	identity_helper.exe
4992	msedge.exe
4992	msedge.exe
3680	MEMZ (1).exe
5128	MEMZ (1).exe
3680	MEMZ (1).exe
5128	MEMZ (1).exe
5156	MEMZ (1).exe
5156	MEMZ (1).exe
5156	MEMZ (1).exe
5180	MEMZ (1).exe
5156	MEMZ (1).exe
5180	MEMZ (1).exe
5128	MEMZ (1).exe
5128	MEMZ (1).exe
3680	MEMZ (1).exe
3680	MEMZ (1).exe
5128	MEMZ (1).exe
3680	MEMZ (1).exe
3680	MEMZ (1).exe
5128	MEMZ (1).exe
5180	MEMZ (1).exe
5156	MEMZ (1).exe
5180	MEMZ (1).exe
5156	MEMZ (1).exe
5204	MEMZ (1).exe
5204	MEMZ (1).exe
3680	MEMZ (1).exe
3680	MEMZ (1).exe
5128	MEMZ (1).exe
5128	MEMZ (1).exe
3680	MEMZ (1).exe
5128	MEMZ (1).exe
3680	MEMZ (1).exe
5128	MEMZ (1).exe
5204	MEMZ (1).exe
5204	MEMZ (1).exe
5156	MEMZ (1).exe
5156	MEMZ (1).exe
5180	MEMZ (1).exe
5180	MEMZ (1).exe
5180	MEMZ (1).exe
5180	MEMZ (1).exe
5156	MEMZ (1).exe
5156	MEMZ (1).exe
5204	MEMZ (1).exe
5204	MEMZ (1).exe
5128	MEMZ (1).exe
5128	MEMZ (1).exe
3680	MEMZ (1).exe
3680	MEMZ (1).exe
5204	MEMZ (1).exe
5128	MEMZ (1).exe
5204	MEMZ (1).exe
5128	MEMZ (1).exe
5156	MEMZ (1).exe
5156	MEMZ (1).exe
5180	MEMZ (1).exe
5180	MEMZ (1).exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5712	taskmgr.exe
Token: SeSystemProfilePrivilege	5712	taskmgr.exe
Token: SeCreateGlobalPrivilege	5712	taskmgr.exe

Suspicious use of FindShellTrayWindow 63 IoCs

pid	Process
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
5712	taskmgr.exe
5712	taskmgr.exe
5712	taskmgr.exe
5712	taskmgr.exe
5712	taskmgr.exe
5712	taskmgr.exe
5712	taskmgr.exe
5712	taskmgr.exe
5712	taskmgr.exe
5712	taskmgr.exe
5712	taskmgr.exe
5712	taskmgr.exe
5712	taskmgr.exe
5712	taskmgr.exe
5712	taskmgr.exe
5712	taskmgr.exe
5712	taskmgr.exe
5712	taskmgr.exe
5712	taskmgr.exe
5712	taskmgr.exe
5712	taskmgr.exe

Suspicious use of SendNotifyMessage 45 IoCs

pid	Process
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
5712	taskmgr.exe
5712	taskmgr.exe
5712	taskmgr.exe
5712	taskmgr.exe
5712	taskmgr.exe
5712	taskmgr.exe
5712	taskmgr.exe
5712	taskmgr.exe
5712	taskmgr.exe
5712	taskmgr.exe
5712	taskmgr.exe
5712	taskmgr.exe
5712	taskmgr.exe
5712	taskmgr.exe
5712	taskmgr.exe
5712	taskmgr.exe
5712	taskmgr.exe
5712	taskmgr.exe
5712	taskmgr.exe
5712	taskmgr.exe
5712	taskmgr.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
5128	MEMZ (1).exe
5156	MEMZ (1).exe
3680	MEMZ (1).exe
5180	MEMZ (1).exe
5204	MEMZ (1).exe
5204	MEMZ (1).exe
5156	MEMZ (1).exe
5180	MEMZ (1).exe
3680	MEMZ (1).exe
5128	MEMZ (1).exe
5128	MEMZ (1).exe
5156	MEMZ (1).exe
3680	MEMZ (1).exe
5204	MEMZ (1).exe
5180	MEMZ (1).exe
5204	MEMZ (1).exe
5180	MEMZ (1).exe
5156	MEMZ (1).exe
3680	MEMZ (1).exe
5128	MEMZ (1).exe
5128	MEMZ (1).exe
3680	MEMZ (1).exe
5156	MEMZ (1).exe
5204	MEMZ (1).exe
5180	MEMZ (1).exe
5180	MEMZ (1).exe
5204	MEMZ (1).exe
5156	MEMZ (1).exe
5128	MEMZ (1).exe
3680	MEMZ (1).exe
5156	MEMZ (1).exe
3680	MEMZ (1).exe
5180	MEMZ (1).exe
5204	MEMZ (1).exe
5128	MEMZ (1).exe
5204	MEMZ (1).exe
5180	MEMZ (1).exe
5128	MEMZ (1).exe
3680	MEMZ (1).exe
5156	MEMZ (1).exe
5128	MEMZ (1).exe
3680	MEMZ (1).exe
5156	MEMZ (1).exe
5204	MEMZ (1).exe
5180	MEMZ (1).exe
5204	MEMZ (1).exe
5180	MEMZ (1).exe
3680	MEMZ (1).exe
5128	MEMZ (1).exe
5156	MEMZ (1).exe
5156	MEMZ (1).exe
3680	MEMZ (1).exe
5128	MEMZ (1).exe
5204	MEMZ (1).exe
5180	MEMZ (1).exe
5204	MEMZ (1).exe
5128	MEMZ (1).exe
3680	MEMZ (1).exe
5180	MEMZ (1).exe
5156	MEMZ (1).exe
5204	MEMZ (1).exe
3680	MEMZ (1).exe
5128	MEMZ (1).exe
5180	MEMZ (1).exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 412 wrote to memory of 3264	412	msedge.exe	85
PID 412 wrote to memory of 3264	412	msedge.exe	85
PID 412 wrote to memory of 5084	412	msedge.exe	86
PID 412 wrote to memory of 5084	412	msedge.exe	86
PID 412 wrote to memory of 5084	412	msedge.exe	86
PID 412 wrote to memory of 5084	412	msedge.exe	86
PID 412 wrote to memory of 5084	412	msedge.exe	86
PID 412 wrote to memory of 5084	412	msedge.exe	86
PID 412 wrote to memory of 5084	412	msedge.exe	86
PID 412 wrote to memory of 5084	412	msedge.exe	86
PID 412 wrote to memory of 5084	412	msedge.exe	86
PID 412 wrote to memory of 5084	412	msedge.exe	86
PID 412 wrote to memory of 5084	412	msedge.exe	86
PID 412 wrote to memory of 5084	412	msedge.exe	86
PID 412 wrote to memory of 5084	412	msedge.exe	86
PID 412 wrote to memory of 5084	412	msedge.exe	86
PID 412 wrote to memory of 5084	412	msedge.exe	86
PID 412 wrote to memory of 5084	412	msedge.exe	86
PID 412 wrote to memory of 5084	412	msedge.exe	86
PID 412 wrote to memory of 5084	412	msedge.exe	86
PID 412 wrote to memory of 5084	412	msedge.exe	86
PID 412 wrote to memory of 5084	412	msedge.exe	86
PID 412 wrote to memory of 5084	412	msedge.exe	86
PID 412 wrote to memory of 5084	412	msedge.exe	86
PID 412 wrote to memory of 5084	412	msedge.exe	86
PID 412 wrote to memory of 5084	412	msedge.exe	86
PID 412 wrote to memory of 5084	412	msedge.exe	86
PID 412 wrote to memory of 5084	412	msedge.exe	86
PID 412 wrote to memory of 5084	412	msedge.exe	86
PID 412 wrote to memory of 5084	412	msedge.exe	86
PID 412 wrote to memory of 5084	412	msedge.exe	86
PID 412 wrote to memory of 5084	412	msedge.exe	86
PID 412 wrote to memory of 5084	412	msedge.exe	86
PID 412 wrote to memory of 5084	412	msedge.exe	86
PID 412 wrote to memory of 5084	412	msedge.exe	86
PID 412 wrote to memory of 5084	412	msedge.exe	86
PID 412 wrote to memory of 5084	412	msedge.exe	86
PID 412 wrote to memory of 5084	412	msedge.exe	86
PID 412 wrote to memory of 5084	412	msedge.exe	86
PID 412 wrote to memory of 5084	412	msedge.exe	86
PID 412 wrote to memory of 5084	412	msedge.exe	86
PID 412 wrote to memory of 5084	412	msedge.exe	86
PID 412 wrote to memory of 228	412	msedge.exe	87
PID 412 wrote to memory of 228	412	msedge.exe	87
PID 412 wrote to memory of 5092	412	msedge.exe	88
PID 412 wrote to memory of 5092	412	msedge.exe	88
PID 412 wrote to memory of 5092	412	msedge.exe	88
PID 412 wrote to memory of 5092	412	msedge.exe	88
PID 412 wrote to memory of 5092	412	msedge.exe	88
PID 412 wrote to memory of 5092	412	msedge.exe	88
PID 412 wrote to memory of 5092	412	msedge.exe	88
PID 412 wrote to memory of 5092	412	msedge.exe	88
PID 412 wrote to memory of 5092	412	msedge.exe	88
PID 412 wrote to memory of 5092	412	msedge.exe	88
PID 412 wrote to memory of 5092	412	msedge.exe	88
PID 412 wrote to memory of 5092	412	msedge.exe	88
PID 412 wrote to memory of 5092	412	msedge.exe	88
PID 412 wrote to memory of 5092	412	msedge.exe	88
PID 412 wrote to memory of 5092	412	msedge.exe	88
PID 412 wrote to memory of 5092	412	msedge.exe	88
PID 412 wrote to memory of 5092	412	msedge.exe	88
PID 412 wrote to memory of 5092	412	msedge.exe	88
PID 412 wrote to memory of 5092	412	msedge.exe	88
PID 412 wrote to memory of 5092	412	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Dfmaaa/MEMZ-virus/blob/main/MEMZ.exe
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffc81d46f8,0x7fffc81d4708,0x7fffc81d4718
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,7041044877136596805,14734011779323612311,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,7041044877136596805,14734011779323612311,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,7041044877136596805,14734011779323612311,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7041044877136596805,14734011779323612311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7041044877136596805,14734011779323612311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,7041044877136596805,14734011779323612311,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,7041044877136596805,14734011779323612311,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2032,7041044877136596805,14734011779323612311,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5640 /prefetch:8
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7041044877136596805,14734011779323612311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2032,7041044877136596805,14734011779323612311,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2032,7041044877136596805,14734011779323612311,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2032,7041044877136596805,14734011779323612311,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4992
- C:\Users\Admin\Downloads\MEMZ (1).exe
  "C:\Users\Admin\Downloads\MEMZ (1).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4416
- C:\Users\Admin\Downloads\MEMZ (1).exe
  "C:\Users\Admin\Downloads\MEMZ (1).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1872
- C:\Users\Admin\Downloads\MEMZ (1).exe
  "C:\Users\Admin\Downloads\MEMZ (1).exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2716
- - C:\Users\Admin\Downloads\MEMZ (1).exe
    "C:\Users\Admin\Downloads\MEMZ (1).exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:3680
- - C:\Users\Admin\Downloads\MEMZ (1).exe
    "C:\Users\Admin\Downloads\MEMZ (1).exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:5128
- - C:\Users\Admin\Downloads\MEMZ (1).exe
    "C:\Users\Admin\Downloads\MEMZ (1).exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:5156
- - C:\Users\Admin\Downloads\MEMZ (1).exe
    "C:\Users\Admin\Downloads\MEMZ (1).exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:5180
- - C:\Users\Admin\Downloads\MEMZ (1).exe
    "C:\Users\Admin\Downloads\MEMZ (1).exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:5204
- - C:\Users\Admin\Downloads\MEMZ (1).exe
    "C:\Users\Admin\Downloads\MEMZ (1).exe" /main
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    PID:5228
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe" \note.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7041044877136596805,14734011779323612311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:5492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4596

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4076

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
b870c0a7bbe8d8e86f21a7ebb961a729

SHA1
4bd22ff97fda35d657182711276754c0995e4f16

SHA256
f9449b5ac257b6af3ddb45218f055087bf687a6bfcf6875129e0686a6dafd313

SHA512
b2b75f3c219eae4fc74f24a819144caeb357e189471a411b4cbe890579ad6ced52ecc694e0ed2859384248844bd456c0500e3715a19dee8f390db4fbdb664a0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dcfd7e49873907ee6e0a8083cf58c81d

SHA1
08f84559260dc2a9072662c2ce60fd1f7aaef15b

SHA256
2096d2b7ebc7b494b3f6ed6c6c2a29cd14da06ef3ee9938f98cfcbd0e22a1a54

SHA512
a1ec4b414a1eda00baaa94ea096ecc968059ea4cc46f79583654980996ee4771056f5f4e6292f1287e4a5069081d72596ce49b44637155a89e77e3a3e819ecea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e9aadfba2987b8f9636b0bdb68db695f

SHA1
611144cb75a79bd08edf4830599b28209c864070

SHA256
b8db4eab644725bd30a6f6945552798322085a1f42310e2f0aceff3bc1303fcf

SHA512
8a0fd193538c12fbc1876a6c456cd81330ee04138c9225a606b60d81c76f5f4b2aa5affb9bce5917a3267b9ba60d3daa4d9a0ced5e2c42b0f214b96b38418bc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
44bcb7974930458e1d93af9b8c11f694

SHA1
01c4cee9700fc5e182d9948e7dafc3415c86c556

SHA256
69007502c48f560ef134dc69b15415465cc01447066e8373b9ef8efe082f1b07

SHA512
9f410d8d29a2645a4d052c86f1614829b4ff835e97d6b0e0163eb9d0eb9e617c090a4c3deca72024a9ce396774363b6d886299bde8c16ea0eb99c50cb1062e23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9d75973ddd1e834648abc0bc00e1a953

SHA1
eac6bedb4b9555e1b490d6e4c4aabe23acb06eda

SHA256
d045708208aaedd7bce86f9f5e1d7434a7d40423136dcd6d93266fb5b5cfda16

SHA512
b3b72b0b6778aac57f21040c3aeee1763d8074f9faeb3f76f70e06c870f0d9df37dd71ea461b49715d37df559e5eeabf5f3ff4373ac0f933dd67162e4f9734de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9fed19e1f114c8b566dd5992dcc86580

SHA1
af3a4f760c31666501fdbe59af8bdb35be02a8ba

SHA256
dde5dff8a2ac8ab940134c39cad871b90378b7f792b1b8e7e25d063d91b54c05

SHA512
f3ff693f313d7407acbfc6f4a14cd5db83bc1bdb1aa7295b19dc2f3e8450e6726f2cff0e986c57ea40d5ebc4e0539c95e7e26df1ab25cb49933810aef06bacc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8dde92f993c004df56249a613db737ba

SHA1
b045954461fe9f925a05a801a226386fdf662110

SHA256
b348639992f5afd59f7394a6230394da5dc56edd8b9fe0adc5944a7cf7d1d864

SHA512
d0e96d1f12a4035268a86a39b973db022e51b53d3b7099d09e8564d0649146d391e5082debe7a56284f2dc7ab47b4076fdef9cbe2bb0cdeb219752ccd61cbb1b

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 706734.crdownload

Filesize
16KB

MD5
1d5ad9c8d3fee874d0feb8bfac220a11

SHA1
ca6d3f7e6c784155f664a9179ca64e4034df9595

SHA256
3872c12d31fc9825e8661ac01ecee2572460677afbc7093f920a8436a42e28ff

SHA512
c8246f4137416be33b6d1ac89f2428b7c44d9376ac8489a9fbf65ef128a6c53fb50479e1e400c8e201c8611992ab1d6c1bd3d6cece89013edb4d35cdd22305b1

Download Submit
C:\note.txt

Filesize
218B

MD5
afa6955439b8d516721231029fb9ca1b

SHA1
087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

SHA256
8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

SHA512
5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

Download Submit
memory/5712-245-0x000001B7199E0000-0x000001B7199E1000-memory.dmp

Filesize
4KB

Download
memory/5712-244-0x000001B7199E0000-0x000001B7199E1000-memory.dmp

Filesize
4KB

Download
memory/5712-246-0x000001B7199E0000-0x000001B7199E1000-memory.dmp

Filesize
4KB

Download
memory/5712-265-0x000001B7199E0000-0x000001B7199E1000-memory.dmp

Filesize
4KB

Download
memory/5712-264-0x000001B7199E0000-0x000001B7199E1000-memory.dmp

Filesize
4KB

Download
memory/5712-263-0x000001B7199E0000-0x000001B7199E1000-memory.dmp

Filesize
4KB

Download
memory/5712-262-0x000001B7199E0000-0x000001B7199E1000-memory.dmp

Filesize
4KB

Download
memory/5712-261-0x000001B7199E0000-0x000001B7199E1000-memory.dmp

Filesize
4KB

Download
memory/5712-260-0x000001B7199E0000-0x000001B7199E1000-memory.dmp

Filesize
4KB

Download
memory/5712-259-0x000001B7199E0000-0x000001B7199E1000-memory.dmp

Filesize
4KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads