2ca4803498d7d375a61bfab2a3a4cf7e0eec41d116e50a838791a55b164e0f8c

max time kernel
899s
max time network
844s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16/01/2025, 12:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Malware-1-master/MEMZ-Clean.bat
Size 9KB
Sample250116-p2cbaasjam
SHA256 5c3fde60c178ed0306dd3e396032acdc9bc55c690e27a926923dd18238bbd64c
MD5 bbae81b88416d8fba76dd3145a831d19
SHA1 42fa0e1b90ad49f66d4ab96c8cca02f81248da8b
SHA512 f03ac63bbb504cb53dc896c2bec8666257034b1c4a5827a4ad75c434af05f1cd631a814cc8689e60210e4ca757e61390db8d222f05bf9f3a0fa7026bdf8c4368
SSDEEP 192:XBOTDzoOgdlf7MAdTyQuHq2b1vXei2SLca5icrLJlz3:ss/tDyQuHZddL5Jlz3
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
964	MEMZ.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
964	MEMZ.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
964	MEMZ.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3052	cscript.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 3052	2528	cmd.exe	31
PID 2528 wrote to memory of 3052	2528	cmd.exe	31
PID 2528 wrote to memory of 3052	2528	cmd.exe	31
PID 2528 wrote to memory of 964	2528	cmd.exe	32
PID 2528 wrote to memory of 964	2528	cmd.exe	32
PID 2528 wrote to memory of 964	2528	cmd.exe	32
PID 2528 wrote to memory of 964	2528	cmd.exe	32

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Clean.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Windows\system32\cscript.exe
  cscript x.js
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:3052
- C:\Users\Admin\AppData\Roaming\MEMZ.exe
  "C:\Users\Admin\AppData\Roaming\MEMZ.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious behavior: GetForegroundWindowSpam
  PID:964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

z.zip

Path C:\Users\Admin\AppData\Local\Temp\MALWAR~1\z.zip
Size 5KB
SHA256 39df3364a3af6f7d360aa7e1345e27befc4be960e0e7e7e060b20f3389b80e76
MD5 d2ea024b943caa1361833885b832d20b
SHA1 1e17c27a3260862645bdaff5cf82c44172d4df9a
SHA512 7b7cfb5e689feed6a52eedf36b89a7b5cc411191571c0af5e5d704b5f24bfa04afa62d1daab159a7e5702d80e56f3946bf32db0551d256419ca12cd3c57dcecb
SSDEEP 96:cCfNDkKYP0EaCl4Nmw3oEpQGgRSYFJffDoWYISIwnCAeTghpGPFCmN:bfVkVCC0mw3pxgdrjpYISDKg+t
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\Malware-1-master\x
Size 8KB
SHA256 0557ea4c5e309b16458ca32ac617b76d1a55f5f0103e368d05c0f0386b7a0a43
MD5 5ce1a2162bf5e16485f5e263b3cc5cf5
SHA1 e9ec3e06bef08fcf29be35c6a4b2217a8328133c
SHA512 ceb5e270bdbcab5be645e50705e3111a5c4751a7a865580d53fa86580025201264a49dd0ea9135b10cff28d7bb21b767ac5d4aff40e880a866ab35df273b5de1
SSDEEP 192:T4KX0Tg44AQsHkuxaWJOnJjWv07iVKmWynWmFr+E:BKu+xawOdFtmHWs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\Malware-1-master\x
Size 2KB
SHA256 7dcca73265244536ed51ebf02a2c796dd5cbf44dfc47ead0e9954b33573eb2bf
MD5 0239b91e1b75433f4ecb9a4689390fa9
SHA1 761e8f090d196da10c116785eb7e89145ac5d4d1
SHA512 0653ff85126b46a8a6c48509ac77e668d3f6a3b3f35eb64e2f8669a4e92e6c8bdee0661b361a305878b5c2d69b6428300d40be67f46587b1a49e0b85695b0a1d
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\Malware-1-master\x
Size 4KB
SHA256 88339750431112ed60cdf9bdb7697434ba9b38e2d15ad604c4462705bc1bdfcf
MD5 20e335859ff991575cf1ddf538e5817c
SHA1 1e81b804d67d6c0e22c0cef7e1cb9f86ce0ef5ee
SHA512 012251b342722cf35ebec2c7d071db505a992d81fc4b3492cd87640b5c955dc084825fc5e72edc821f4c481867183f21d26cd904fe7f0373d1156332f87b031d
SSDEEP 96:Tm/Ldo2g0Tg4JlIAQ5uJ80JyunrOTCC1WJPmZ:T4KX0Tg44AQsHkuxaWJOZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

x.js

Path C:\Users\Admin\AppData\Local\Temp\Malware-1-master\x.js
Size 448B
SHA256 aa01b8864b43e92077a106ed3d4656a511f3ba1910fba40c78a32ee6a621d596
MD5 8eec8704d2a7bc80b95b7460c06f4854
SHA1 1b34585c1fa7ec0bd0505478ac9dbb8b8d19f326
SHA512 e274b92810e9a30627a65f87448d784967a2fcfbf49858cbe6ccb841f09e0f53fde253ecc1ea0c7de491d8cc56a6cf8c79d1b7c657e72928cfb0479d11035210
MD5 SHA1 SHA512

Submit Download

MEMZ.exe

Path C:\Users\Admin\AppData\Roaming\MEMZ.exe
Size 12KB
SHA256 4bbf7589615ebdb6c769d6d2e7bdcb26072bac0cda6e225a4133ba8819e688d5
MD5 9c642c5b111ee85a6bccffc7af896a51
SHA1 eca8571b994fd40e2018f48c214fab6472a98bab
SHA512 23cc74b5a7bdf70ba789d1730a0009414cfb9c780544e3d8d841be58782b9a9a089969c4295a0da25d07285505992386486d6ff0524e75605b96bb99cd3aaa1c
SSDEEP 192:BCMfc/GinpRBueYDw4+kEeN4FRrfMFFp3+f2dvGhT59uay:AMfceinpOeRENYhfOj+eGdKa
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3052-120-0x0000000001EE0000-0x0000000001EE1000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads