2ca4803498d7d375a61bfab2a3a4cf7e0eec41d116e50a838791a55b164e0f8c

Resubmissions

17-01-2025 20:14

250117-yz7h3s1qfw 10

17-01-2025 20:12

17-01-2025 17:25

17-01-2025 17:21

17-01-2025 14:16

17-01-2025 14:12

16-01-2025 12:52

16-01-2025 12:50

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-01-2025 17:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Malware-1-master/MEMZ-Destructive.exe
Size

14KB
MD5

19dbec50735b5f2a72d4199c4e184960
SHA1

6fed7732f7cb6f59743795b2ab154a3676f4c822
SHA256

a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
SHA512

aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
SSDEEP

192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj

Score

7^/10

bootkit discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	MEMZ-Destructive.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	MEMZ-Destructive.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ-Destructive.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ-Destructive.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ-Destructive.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mmc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	calc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3616	MEMZ-Destructive.exe
3616	MEMZ-Destructive.exe
3616	MEMZ-Destructive.exe
1056	MEMZ-Destructive.exe
3616	MEMZ-Destructive.exe
1056	MEMZ-Destructive.exe
1056	MEMZ-Destructive.exe
1056	MEMZ-Destructive.exe
3616	MEMZ-Destructive.exe
3616	MEMZ-Destructive.exe
3616	MEMZ-Destructive.exe
740	MEMZ-Destructive.exe
3616	MEMZ-Destructive.exe
740	MEMZ-Destructive.exe
1056	MEMZ-Destructive.exe
1056	MEMZ-Destructive.exe
1056	MEMZ-Destructive.exe
1056	MEMZ-Destructive.exe
740	MEMZ-Destructive.exe
740	MEMZ-Destructive.exe
3616	MEMZ-Destructive.exe
3616	MEMZ-Destructive.exe
4704	MEMZ-Destructive.exe
4704	MEMZ-Destructive.exe
4704	MEMZ-Destructive.exe
3616	MEMZ-Destructive.exe
4704	MEMZ-Destructive.exe
3616	MEMZ-Destructive.exe
740	MEMZ-Destructive.exe
1056	MEMZ-Destructive.exe
740	MEMZ-Destructive.exe
1056	MEMZ-Destructive.exe
1632	MEMZ-Destructive.exe
1632	MEMZ-Destructive.exe
4704	MEMZ-Destructive.exe
4704	MEMZ-Destructive.exe
3616	MEMZ-Destructive.exe
3616	MEMZ-Destructive.exe
1056	MEMZ-Destructive.exe
1056	MEMZ-Destructive.exe
740	MEMZ-Destructive.exe
740	MEMZ-Destructive.exe
740	MEMZ-Destructive.exe
740	MEMZ-Destructive.exe
1056	MEMZ-Destructive.exe
1056	MEMZ-Destructive.exe
3616	MEMZ-Destructive.exe
3616	MEMZ-Destructive.exe
4704	MEMZ-Destructive.exe
4704	MEMZ-Destructive.exe
1632	MEMZ-Destructive.exe
1632	MEMZ-Destructive.exe
4704	MEMZ-Destructive.exe
4704	MEMZ-Destructive.exe
3616	MEMZ-Destructive.exe
3616	MEMZ-Destructive.exe
1056	MEMZ-Destructive.exe
1056	MEMZ-Destructive.exe
740	MEMZ-Destructive.exe
740	MEMZ-Destructive.exe
740	MEMZ-Destructive.exe
740	MEMZ-Destructive.exe
1056	MEMZ-Destructive.exe
1056	MEMZ-Destructive.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

pid	Process
1096	mmc.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: 33	928	mmc.exe
Token: SeIncBasePriorityPrivilege	928	mmc.exe
Token: 33	928	mmc.exe
Token: SeIncBasePriorityPrivilege	928	mmc.exe
Token: 33	928	mmc.exe
Token: SeIncBasePriorityPrivilege	928	mmc.exe
Token: 33	1096	mmc.exe
Token: SeIncBasePriorityPrivilege	1096	mmc.exe
Token: 33	1096	mmc.exe
Token: SeIncBasePriorityPrivilege	1096	mmc.exe
Token: 33	1096	mmc.exe
Token: SeIncBasePriorityPrivilege	1096	mmc.exe
Token: 33	4020	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4020	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1424	MEMZ-Destructive.exe
2544	OpenWith.exe
2256	mmc.exe
928	mmc.exe
928	mmc.exe
4388	mmc.exe
1096	mmc.exe
1096	mmc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3332 wrote to memory of 3616	3332	MEMZ-Destructive.exe	90
PID 3332 wrote to memory of 3616	3332	MEMZ-Destructive.exe	90
PID 3332 wrote to memory of 3616	3332	MEMZ-Destructive.exe	90
PID 3332 wrote to memory of 1056	3332	MEMZ-Destructive.exe	91
PID 3332 wrote to memory of 1056	3332	MEMZ-Destructive.exe	91
PID 3332 wrote to memory of 1056	3332	MEMZ-Destructive.exe	91
PID 3332 wrote to memory of 740	3332	MEMZ-Destructive.exe	92
PID 3332 wrote to memory of 740	3332	MEMZ-Destructive.exe	92
PID 3332 wrote to memory of 740	3332	MEMZ-Destructive.exe	92
PID 3332 wrote to memory of 4704	3332	MEMZ-Destructive.exe	93
PID 3332 wrote to memory of 4704	3332	MEMZ-Destructive.exe	93
PID 3332 wrote to memory of 4704	3332	MEMZ-Destructive.exe	93
PID 3332 wrote to memory of 1632	3332	MEMZ-Destructive.exe	94
PID 3332 wrote to memory of 1632	3332	MEMZ-Destructive.exe	94
PID 3332 wrote to memory of 1632	3332	MEMZ-Destructive.exe	94
PID 3332 wrote to memory of 1424	3332	MEMZ-Destructive.exe	95
PID 3332 wrote to memory of 1424	3332	MEMZ-Destructive.exe	95
PID 3332 wrote to memory of 1424	3332	MEMZ-Destructive.exe	95
PID 1424 wrote to memory of 1460	1424	MEMZ-Destructive.exe	98
PID 1424 wrote to memory of 1460	1424	MEMZ-Destructive.exe	98
PID 1424 wrote to memory of 1460	1424	MEMZ-Destructive.exe	98
PID 1424 wrote to memory of 2004	1424	MEMZ-Destructive.exe	108
PID 1424 wrote to memory of 2004	1424	MEMZ-Destructive.exe	108
PID 1424 wrote to memory of 2004	1424	MEMZ-Destructive.exe	108
PID 1424 wrote to memory of 2256	1424	MEMZ-Destructive.exe	111
PID 1424 wrote to memory of 2256	1424	MEMZ-Destructive.exe	111
PID 1424 wrote to memory of 2256	1424	MEMZ-Destructive.exe	111
PID 2256 wrote to memory of 928	2256	mmc.exe	112
PID 2256 wrote to memory of 928	2256	mmc.exe	112
PID 1424 wrote to memory of 4388	1424	MEMZ-Destructive.exe	114
PID 1424 wrote to memory of 4388	1424	MEMZ-Destructive.exe	114
PID 1424 wrote to memory of 4388	1424	MEMZ-Destructive.exe	114
PID 4388 wrote to memory of 1096	4388	mmc.exe	115
PID 4388 wrote to memory of 1096	4388	mmc.exe	115
PID 1424 wrote to memory of 5056	1424	MEMZ-Destructive.exe	117
PID 1424 wrote to memory of 5056	1424	MEMZ-Destructive.exe	117
PID 5056 wrote to memory of 1868	5056	msedge.exe	118
PID 5056 wrote to memory of 1868	5056	msedge.exe	118
PID 5056 wrote to memory of 1580	5056	msedge.exe	119
PID 5056 wrote to memory of 1580	5056	msedge.exe	119
PID 5056 wrote to memory of 1580	5056	msedge.exe	119
PID 5056 wrote to memory of 1580	5056	msedge.exe	119
PID 5056 wrote to memory of 1580	5056	msedge.exe	119
PID 5056 wrote to memory of 1580	5056	msedge.exe	119
PID 5056 wrote to memory of 1580	5056	msedge.exe	119
PID 5056 wrote to memory of 1580	5056	msedge.exe	119
PID 5056 wrote to memory of 1580	5056	msedge.exe	119
PID 5056 wrote to memory of 1580	5056	msedge.exe	119
PID 5056 wrote to memory of 1580	5056	msedge.exe	119
PID 5056 wrote to memory of 1580	5056	msedge.exe	119
PID 5056 wrote to memory of 1580	5056	msedge.exe	119
PID 5056 wrote to memory of 1580	5056	msedge.exe	119
PID 5056 wrote to memory of 1580	5056	msedge.exe	119
PID 5056 wrote to memory of 1580	5056	msedge.exe	119
PID 5056 wrote to memory of 1580	5056	msedge.exe	119
PID 5056 wrote to memory of 1580	5056	msedge.exe	119
PID 5056 wrote to memory of 1580	5056	msedge.exe	119
PID 5056 wrote to memory of 1580	5056	msedge.exe	119
PID 5056 wrote to memory of 1580	5056	msedge.exe	119
PID 5056 wrote to memory of 1580	5056	msedge.exe	119
PID 5056 wrote to memory of 1580	5056	msedge.exe	119
PID 5056 wrote to memory of 1580	5056	msedge.exe	119
PID 5056 wrote to memory of 1580	5056	msedge.exe	119
PID 5056 wrote to memory of 1580	5056	msedge.exe	119

C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe
"C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3332
- C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3616
- C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1056
- C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:740
- C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4704
- C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1632
- C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe" /main
  2⤵
  - Checks computer location settings
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1424
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1460
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\System32\calc.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2004
- - C:\Windows\SysWOW64\mmc.exe
    "C:\Windows\System32\mmc.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2256
  - - C:\Windows\system32\mmc.exe
      "C:\Windows\system32\mmc.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:928
- - C:\Windows\SysWOW64\mmc.exe
    "C:\Windows\System32\mmc.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4388
  - - C:\Windows\system32\mmc.exe
      "C:\Windows\system32\mmc.exe"
      4⤵
      Suspicious behavior: SetClipboardViewer
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=best+way+to+kill+yourself
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:5056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9180046f8,0x7ff918004708,0x7ff918004718
      4⤵
      PID:1868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,14227162902919473824,18005475450186116157,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
      4⤵
      PID:1580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1940,14227162902919473824,18005475450186116157,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:3
      4⤵
      PID:920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1940,14227162902919473824,18005475450186116157,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
      4⤵
      PID:4428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,14227162902919473824,18005475450186116157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
      4⤵
      PID:4400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,14227162902919473824,18005475450186116157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
      4⤵
      PID:4788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,14227162902919473824,18005475450186116157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2872 /prefetch:1
      4⤵
      PID:8
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,14227162902919473824,18005475450186116157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
      4⤵
      PID:2332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1940,14227162902919473824,18005475450186116157,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:8
      4⤵
      PID:3860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1940,14227162902919473824,18005475450186116157,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:8
      4⤵
      PID:4640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,14227162902919473824,18005475450186116157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
      4⤵
      PID:1616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,14227162902919473824,18005475450186116157,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
      4⤵
      PID:4464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,14227162902919473824,18005475450186116157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
      4⤵
      PID:760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,14227162902919473824,18005475450186116157,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
      4⤵
      PID:1560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,14227162902919473824,18005475450186116157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
      4⤵
      PID:720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,14227162902919473824,18005475450186116157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
      4⤵
      PID:1012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=g3t+r3kt
    3⤵
    PID:2148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9180046f8,0x7ff918004708,0x7ff918004718
      4⤵
      PID:4788

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5004

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x404 0x410
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
215KB

MD5
d474ec7f8d58a66420b6daa0893a4874

SHA1
4314642571493ba983748556d0e76ec6704da211

SHA256
553a19b6f44f125d9594c02231e4217e9d74d92b7065dc996d92f1e53f6bcb69

SHA512
344062d1be40db095abb7392b047b16f33ea3043158690cf66a2fa554aa2db79c4aa68de1308f1eddf6b9140b9ac5de70aad960b4e8e8b91f105213c4aace348

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
879cbe7bdc357c51648971e920bc9ca5

SHA1
8937ff120c0a564adfbba6a0070cae6ee2a77bb1

SHA256
56d1c93c1a2db86c3c0f44f189e8cd54bf56560a11aac71add0bbb057b2f3a90

SHA512
deaaef33770a1be0bc21b828e1ff6d4f750679a6bf3950916e4419052aea87017c42135db9cafdb830f8f2b041683bcad7630eb75f8eee83446ddad1f99f86b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c151980590253f19fe5265c6ec023f4c

SHA1
ed83b8e87cc1e6ac053ce29d16d50b8ee2bec303

SHA256
88f71b447006c8d6640a84e5a81099b780a5741ba967ee8e5cebac39f3465bd7

SHA512
cf7fd56e0b58152178b3f10504513121a32b767caee7575741cbcafd72eaa7bd9879615ac304fb685b23cd5f22c590b11fc4aa8a845d19e0653aba3321907733

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a93e3f252a70df640ad115a2d2300bc6

SHA1
c8d6336647f3a6093155dd3915c774d46863265d

SHA256
904a921401bcaa628b5f8ec1b62fbd54c413c023036e6137d8268830526d2ca2

SHA512
03c1d5064afedb10bbacff9113b77ad1227f959aaea3670aadd1fcb05b811883174a6cae8547e4b9b35b014b5cc41ab6ef3ff5295f65200c06cef569d958c35c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8a52eca0f85ddb829661de11afd62049

SHA1
455da1bd1dc1c85e97a8b776fc718b2ce0503b38

SHA256
dcdf57de58ab6c52c7c5d3a7a2d355702712a0a5e5a96510236d09e784ca5fc1

SHA512
97402cc7e8c417d92bc1be571f0568f33b4b6918122c068a13e6b609fe566cc7f38ad9f9261f7421eda3ed243718b040c69e5c08b7cbb5ec7a42150dec88f8cd

Download Submit
C:\note.txt

Filesize
218B

MD5
afa6955439b8d516721231029fb9ca1b

SHA1
087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

SHA256
8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

SHA512
5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

Download Submit