f38c426db4d86cb1ba9ad4c7b4e76ecc05c31f9259ff1a99d0c73d723df2085d

Resubmissions

29-08-2024 16:07

240829-tkq6bszdpa 10

29-08-2024 15:58

240829-terjxa1hkq 6

Analysis

max time kernel
463s
max time network
443s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
29-08-2024 15:58

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Copy of Code.Org Express Course JOURNAL - HEADPHONES! (F24) (1).docx
Size

18KB
MD5

17134e9f6e31ef3c53db6e3a24a66e4f
SHA1

04db173e3b73f77e75ceaa0a0caa9f46b1911962
SHA256

f38c426db4d86cb1ba9ad4c7b4e76ecc05c31f9259ff1a99d0c73d723df2085d
SHA512

894119cfed7846068945ece2a0ded183bbf3746fb22111035207c6e13453de0e2d0cc63ebaa63bd2f224a56423e5aad26ff0aaf5c51dd0755244d1b4eba69228
SSDEEP

384:t8xuk1eihiO/Plp3VlgvQvoBQY8SiFhkTU8p7Icfp7neEn9lfida:iuseihislplmvMoaY8joU8p7XfpKE+4

Score

6^/10

bootkit discovery persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

MEMZ.exe

description ioc process

File opened for modification \??\PhysicalDrive0 MEMZ.exe
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

description	ioc	process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

MEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exenotepad.exeMEMZ.exeMEMZ.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXEmsedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

Processes:

msedge.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-661032028-162657920-1226909816-1000\{1CF08C85-14B9-4862-A342-5E68B586B21A}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

Processes:

msedge.exe

description ioc process

File opened for modification C:\Users\Admin\Downloads\The-MALWARE-Repo-master.zip:Zone.Identifier msedge.exe
Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

2228 WINWORD.EXE
2228 WINWORD.EXE

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\The-MALWARE-Repo-master.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exeMEMZ.exe

pid	process
3280	msedge.exe
3280	msedge.exe
3104	msedge.exe
3104	msedge.exe
5052	msedge.exe
5052	msedge.exe
5068	identity_helper.exe
5068	identity_helper.exe
2292	msedge.exe
2292	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
2228	msedge.exe
2228	msedge.exe
4368	MEMZ.exe
4368	MEMZ.exe
4368	MEMZ.exe
4368	MEMZ.exe
4368	MEMZ.exe
4368	MEMZ.exe
4368	MEMZ.exe
4368	MEMZ.exe
4368	MEMZ.exe
4368	MEMZ.exe
4368	MEMZ.exe
4368	MEMZ.exe
4368	MEMZ.exe
4368	MEMZ.exe
4368	MEMZ.exe
4368	MEMZ.exe
4368	MEMZ.exe
4368	MEMZ.exe
4368	MEMZ.exe
4368	MEMZ.exe
4368	MEMZ.exe
4368	MEMZ.exe
4368	MEMZ.exe
4368	MEMZ.exe
4368	MEMZ.exe
4368	MEMZ.exe
4368	MEMZ.exe
4368	MEMZ.exe
4368	MEMZ.exe
4368	MEMZ.exe
4368	MEMZ.exe
4368	MEMZ.exe
4368	MEMZ.exe
4368	MEMZ.exe
4368	MEMZ.exe
4368	MEMZ.exe
4368	MEMZ.exe
4368	MEMZ.exe
4368	MEMZ.exe
4368	MEMZ.exe
4368	MEMZ.exe
4368	MEMZ.exe
4368	MEMZ.exe
4368	MEMZ.exe
4368	MEMZ.exe
4368	MEMZ.exe
4368	MEMZ.exe
4368	MEMZ.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

Processes:

msedge.exe

pid	process
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe

pid	process
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe

Suspicious use of SetWindowsHookEx 27 IoCs

Processes:

WINWORD.EXEMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exe

pid	process
2228	WINWORD.EXE
2228	WINWORD.EXE
2228	WINWORD.EXE
2228	WINWORD.EXE
2228	WINWORD.EXE
2228	WINWORD.EXE
2228	WINWORD.EXE
2228	WINWORD.EXE
380	MEMZ.exe
4368	MEMZ.exe
3600	MEMZ.exe
2664	MEMZ.exe
4408	MEMZ.exe
2656	MEMZ.exe
2344	MEMZ.exe
4408	MEMZ.exe
4368	MEMZ.exe
2664	MEMZ.exe
3600	MEMZ.exe
4368	MEMZ.exe
4408	MEMZ.exe
2664	MEMZ.exe
3600	MEMZ.exe
4408	MEMZ.exe
4368	MEMZ.exe
2664	MEMZ.exe
3600	MEMZ.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3104 wrote to memory of 1328	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 1328	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3572	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3572	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3572	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3572	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3572	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3572	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3572	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3572	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3572	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3572	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3572	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3572	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3572	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3572	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3572	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3572	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3572	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3572	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3572	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3572	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3572	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3572	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3572	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3572	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3572	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3572	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3572	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3572	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3572	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3572	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3572	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3572	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3572	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3572	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3572	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3572	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3572	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3572	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3572	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3572	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3280	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3280	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3416	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3416	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3416	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3416	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3416	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3416	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3416	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3416	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3416	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3416	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3416	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3416	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3416	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3416	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3416	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3416	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3416	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3416	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3416	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 3416	3104	msedge.exe	msedge.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Copy of Code.Org Express Course JOURNAL - HEADPHONES! (F24) (1).docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9fa123cb8,0x7ff9fa123cc8,0x7ff9fa123cd8
2⤵
PID:1328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,18228560776513427736,15068186522305606852,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
2⤵
PID:3572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,18228560776513427736,15068186522305606852,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,18228560776513427736,15068186522305606852,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2572 /prefetch:8
2⤵
PID:3416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18228560776513427736,15068186522305606852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
2⤵
PID:3620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18228560776513427736,15068186522305606852,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
2⤵
PID:3336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18228560776513427736,15068186522305606852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
2⤵
PID:2052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18228560776513427736,15068186522305606852,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
2⤵
PID:4348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18228560776513427736,15068186522305606852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
2⤵
PID:3184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18228560776513427736,15068186522305606852,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
2⤵
PID:720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18228560776513427736,15068186522305606852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
2⤵
PID:3624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,18228560776513427736,15068186522305606852,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4760 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5052

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,18228560776513427736,15068186522305606852,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18228560776513427736,15068186522305606852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
2⤵
PID:2956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18228560776513427736,15068186522305606852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
2⤵
PID:4924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1904,18228560776513427736,15068186522305606852,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4888 /prefetch:8
2⤵
PID:3912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1904,18228560776513427736,15068186522305606852,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3804 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18228560776513427736,15068186522305606852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
2⤵
PID:3176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18228560776513427736,15068186522305606852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
2⤵
PID:4796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18228560776513427736,15068186522305606852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
2⤵
PID:4624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18228560776513427736,15068186522305606852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6448 /prefetch:1
2⤵
PID:4916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18228560776513427736,15068186522305606852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
2⤵
PID:2664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18228560776513427736,15068186522305606852,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
2⤵
PID:868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18228560776513427736,15068186522305606852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
2⤵
PID:3536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18228560776513427736,15068186522305606852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:1
2⤵
PID:2080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,18228560776513427736,15068186522305606852,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1020 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1904,18228560776513427736,15068186522305606852,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3584 /prefetch:8
2⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:2228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1968

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3084

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\MEMZ.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\MEMZ.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:380

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\MEMZ.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\MEMZ.exe" /watchdog
2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4368

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\MEMZ.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\MEMZ.exe" /watchdog
2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3600

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\MEMZ.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\MEMZ.exe" /watchdog
2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2664

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\MEMZ.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\MEMZ.exe" /watchdog
2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4408

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\MEMZ.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\MEMZ.exe" /watchdog
2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2656

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\MEMZ.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\MEMZ.exe" /main
2⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2344

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\System32\notepad.exe" \note.txt
3⤵
- System Location Discovery: System Language Discovery
PID:452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A

Filesize
471B

MD5
1a1e7a6d7e1ca8dfcc8813ce085a4f2e

SHA1
3a57d18553419c1a0a1257df945327f2452b6d29

SHA256
4a0fcb6a4c0c5adaad6527ee4f8b284b144266c9c4c419b215c8bf36bf7c5396

SHA512
abe96f4a62972a1e0bf6caba75c1ba88a8f25a0c9ffb64d5947cb010d81fdbffcbaac6c777023e52d7a2d6458471ec312aa875b69265b8b2cc30e61539b69e5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A

Filesize
412B

MD5
32ceca06058e6438c40e80a0684019e9

SHA1
a38993c8721e61fb9a9b0b9dc01b6b57fa024e6d

SHA256
1e1e61d17e75df728ee67a2bc3add5de6cc9acecbe88645ed358a3085d41670a

SHA512
c82e4311a86c808924b39186548398634703f018120f4bfeb7e6717e02183164ab0449c25176d437cedab120fcf89fb6b3e43c682382a0c117a71af0fbb24b6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b0177afa818e013394b36a04cb111278

SHA1
dbc5c47e7a7df24259d67edf5fbbfa1b1fae3fe5

SHA256
ffc2c53bfd37576b435309c750a5b81580a076c83019d34172f6635ff20c2a9d

SHA512
d3b9e3a0a99f191edcf33f3658abd3c88afbb12d7b14d3b421b72b74d551b64d2a13d07db94c90b85606198ee6c9e52072e1017f8c8c6144c03acf509793a9db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9af507866fb23dace6259791c377531f

SHA1
5a5914fc48341ac112bfcd71b946fc0b2619f933

SHA256
5fb3ec65ce1e6f47694e56a07c63e3b8af9876d80387a71f1917deae690d069f

SHA512
c58c963ecd2c53f0c427f91dc41d9b2a9b766f2e04d7dae5236cb3c769d1f048e4a342ea75e4a690f3a207baa1d3add672160c1f317abfe703fd1d2216b1baf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\62bc2d57-7a66-487a-b7ba-97b6d0cb9946.tmp

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
ac11ba8812168033c8a9f2be15cc7790

SHA1
506f6265cd16c19edfdd230e8c8131050e02145b

SHA256
d9cd6bae2f3cde55d99c69185884298b841cde1257bfd708a7de8bfd2383db01

SHA512
aafcf976ecf7adfe459b30202174de365ce5d37d996b1a397f2deb90d5d01003e853724e2db60de3403ab1b599d4e7b84387b3227f132c8bafae8712bd666ce8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
942B

MD5
00b3caaf283864d540b1de6543b09e2c

SHA1
9e9c5725a54eb9e311a5389cee7d8501a36eb086

SHA256
43eb5ed71d29795d0175dfce57ddd18b6bbc20196963ffc6331b51d89704528d

SHA512
cfed740fc5615f6e8b07433e4cec88386020647ca849c152cf57418b5f9e0a1a3c4addf514e91ee3e52b5c267b8127bd2f059fcf46300e0411350c56308ad1f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ad8dce0d35ad3bbd8be2255ac30e5e49

SHA1
cd807839495bdc015ce50ed7b61831473b160f5b

SHA256
abe7d9353b4a662d85d0bc0863ea4a80c791b1cf31b423b340537e2588c7c8b8

SHA512
eec2be5c3d77d00c388d2e9a60c1a570da6d443c2156bca030bf91ffb01c19c4b0be04e92445f4514318a469d16104ce02e43bbc11403866898d234d4d9f9642

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
79b1319864d7c00dd3cf483553d4ca27

SHA1
b8bd882ae87c5111a49701f26271097f53ec8b30

SHA256
ab204dfa8f3605d61e9288d025c4508f98ef172b610b2843e92509e3bfbda26d

SHA512
858d576b08bec9923418907aff7958c335cc8bd5e1fcf34e091897046e10325fb08fd0b376599b1d30c9923d2b4fa08c4da7d6086db9ff4a7eee9449332b144f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
57e1678d308172cbf4b4186f739e36ed

SHA1
b54e11ba8b313afd686b3838ce2ab931e0e306ab

SHA256
205aef04cf8e29f536b543b12867dc0b9cd5a1e654e24b4f4a75b5e56e6df447

SHA512
63ec73030d2daa9225224060a4020b9ffc8a4a1148281edddb176f193b768e5840a92b8fdcc5f724b8fe11e3415c0fa87b77c8a972c1edd002d624e06ac08d43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0fab236b127a50460680dae782e3ad01

SHA1
1116b55c6846e6df774708c40346f8103d748859

SHA256
115cac8f36711dd469137f2dd18eb7d5a733cf32a03d899b0c0a2725c4c3f47f

SHA512
de72a4bb01118907739de39a26f101718f4e63483939bbfe4b340689b5bb801b2309e8d74f53f06198212fa8892725db9a030165788bf0e4430b85321d148f98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e26142444c5d84f2c27ff438320bbf02

SHA1
d968443396540f84bd9e655bddfdd173e6b57a1c

SHA256
422a723bdcf293d44555f2def2a257f683a5a0df83e4d8e55f55134a1359cd8c

SHA512
3d358140bee14845c33d21296791f85c5a5084acf48619ff7e75303dcc74e50718ecb073de86aee482a2b3cefb33ef15aa981b2e0d203a69dc398dfa67109f75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4601d0a2418e090fc6879b9d644c7077

SHA1
23aff370e9cf5fd349bbee559dfa39ebfa6fd39f

SHA256
89b0c26a8c7de32e55d5fd8a91aa24e576ca55ad6412b23a6cd861c84a3246d6

SHA512
c0badc878e4895e0865663dc376c139f3083c6f4807d0be2278327de63dfe7f63caff2eb377adcae16f6c41d8dddd8e26e2e171241c83028992d0c681e90e30e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58ccf0.TMP

Filesize
1KB

MD5
4d3530ddb2df8e871e5bf2ede70af478

SHA1
3beaee34b1195daa140db15df651ae989fc3c975

SHA256
7b1d975c7726491363eab8bd4fc8e98e56183056f2fbbb7799a0511db2616398

SHA512
b3f62ca1d688a885966a2aef190e0491730c061b6980910063170f23aca888438db54ee3522111f7d08d952b612673dfc0505044dc616f1642f2ea61ff3e0286

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d8959a1ea27eab6bc6404f425d2049eb

SHA1
dba553503ff269bd9bdbebeb794d76edb5860ef9

SHA256
a332392f7cdf096dc1edf23689d4c5acf5c7dab348034a40dad020eb4c8b6994

SHA512
2b30e4478d687deeae112173e92f97e977323977a7270374c61440b82ab4535183938bfe1eb6f55c4e91c4038cbf39f88e3188e08838c879ac325d6e0ad955db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2f290e793f17e2c5188d9ef23d3b6afe

SHA1
230578531984028725f044068d2bd1cfea76b1b4

SHA256
c5b584ff747865aa91c3c38789a68355c6bcaaffee4fd7675b4caf5a518a1d51

SHA512
bae5249c43cafebf6cdd9d1ed714ed5a96a7d73788f1c67a89771ce4fc20d72579f39958809cd0868f9e924b047171e2ca7098696fc9908f5fa7d625f01df46b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0212ec191c80587c3a365def9dc3c7e0

SHA1
224f9a069b9b14ec65d848827cfbcc60789aec62

SHA256
d388ff7dcedcdb5f14b94f16bc2cddf0db2ddb033807c18139d6306d693fa60c

SHA512
3c422fa4aa779c0a0184fc5cf4815f5cbac690d2ba2d6e6385e34ffabe62ba79d8d398c18cbe6d3e8941c97324075c05d6c8ad6a8d9707026c1ede2887012264

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\note.txt

Filesize
218B

MD5
afa6955439b8d516721231029fb9ca1b

SHA1
087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

SHA256
8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

SHA512
5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

Download Submit
\??\pipe\LOCAL\crashpad_3104_GXPYLMAXGFEUBXTT

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2228-14-0x00007FF9C7390000-0x00007FF9C73A0000-memory.dmp

Filesize
64KB

Download
memory/2228-20-0x00007FFA09C60000-0x00007FFA09E69000-memory.dmp

Filesize
2.0MB

Download
memory/2228-36-0x00007FFA09C60000-0x00007FFA09E69000-memory.dmp

Filesize
2.0MB

Download
memory/2228-53-0x00007FFA09C60000-0x00007FFA09E69000-memory.dmp

Filesize
2.0MB

Download
memory/2228-64-0x00007FF9C9CF0000-0x00007FF9C9D00000-memory.dmp

Filesize
64KB

Download
memory/2228-63-0x00007FF9C9CF0000-0x00007FF9C9D00000-memory.dmp

Filesize
64KB

Download
memory/2228-61-0x00007FF9C9CF0000-0x00007FF9C9D00000-memory.dmp

Filesize
64KB

Download
memory/2228-62-0x00007FF9C9CF0000-0x00007FF9C9D00000-memory.dmp

Filesize
64KB

Download
memory/2228-65-0x00007FFA09C60000-0x00007FFA09E69000-memory.dmp

Filesize
2.0MB

Download
memory/2228-34-0x00007FFA09C60000-0x00007FFA09E69000-memory.dmp

Filesize
2.0MB

Download
memory/2228-12-0x00007FFA09C60000-0x00007FFA09E69000-memory.dmp

Filesize
2.0MB

Download
memory/2228-13-0x00007FFA09C60000-0x00007FFA09E69000-memory.dmp

Filesize
2.0MB

Download
memory/2228-16-0x00007FFA09C60000-0x00007FFA09E69000-memory.dmp

Filesize
2.0MB

Download
memory/2228-17-0x00007FFA09C60000-0x00007FFA09E69000-memory.dmp

Filesize
2.0MB

Download
memory/2228-19-0x00007FFA09C60000-0x00007FFA09E69000-memory.dmp

Filesize
2.0MB

Download
memory/2228-35-0x00007FFA09D03000-0x00007FFA09D04000-memory.dmp

Filesize
4KB

Download
memory/2228-21-0x00007FFA09C60000-0x00007FFA09E69000-memory.dmp

Filesize
2.0MB

Download
memory/2228-18-0x00007FFA09C60000-0x00007FFA09E69000-memory.dmp

Filesize
2.0MB

Download
memory/2228-1-0x00007FFA09D03000-0x00007FFA09D04000-memory.dmp

Filesize
4KB

Download
memory/2228-15-0x00007FFA09C60000-0x00007FFA09E69000-memory.dmp

Filesize
2.0MB

Download
memory/2228-11-0x00007FF9C7390000-0x00007FF9C73A0000-memory.dmp

Filesize
64KB

Download
memory/2228-10-0x00007FFA09C60000-0x00007FFA09E69000-memory.dmp

Filesize
2.0MB

Download
memory/2228-9-0x00007FFA09C60000-0x00007FFA09E69000-memory.dmp

Filesize
2.0MB

Download
memory/2228-8-0x00007FFA09C60000-0x00007FFA09E69000-memory.dmp

Filesize
2.0MB

Download
memory/2228-6-0x00007FFA09C60000-0x00007FFA09E69000-memory.dmp

Filesize
2.0MB

Download
memory/2228-7-0x00007FFA09C60000-0x00007FFA09E69000-memory.dmp

Filesize
2.0MB

Download
memory/2228-5-0x00007FF9C9CF0000-0x00007FF9C9D00000-memory.dmp

Filesize
64KB

Download
memory/2228-4-0x00007FF9C9CF0000-0x00007FF9C9D00000-memory.dmp

Filesize
64KB

Download
memory/2228-2-0x00007FF9C9CF0000-0x00007FF9C9D00000-memory.dmp

Filesize
64KB

Download
memory/2228-3-0x00007FF9C9CF0000-0x00007FF9C9D00000-memory.dmp

Filesize
64KB

Download
memory/2228-0-0x00007FF9C9CF0000-0x00007FF9C9D00000-memory.dmp

Filesize
64KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads