2ca4803498d7d375a61bfab2a3a4cf7e0eec41d116e50a838791a55b164e0f8c

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-01-2025 20:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Malware-1-master/MEMZ-Destructive.exe
Size

14KB
MD5

19dbec50735b5f2a72d4199c4e184960
SHA1

6fed7732f7cb6f59743795b2ab154a3676f4c822
SHA256

a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
SHA512

aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
SSDEEP

192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj

Score

7^/10

bootkit discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	MEMZ-Destructive.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	MEMZ-Destructive.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ-Destructive.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ-Destructive.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ-Destructive.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2568	MEMZ-Destructive.exe
2568	MEMZ-Destructive.exe
2568	MEMZ-Destructive.exe
2568	MEMZ-Destructive.exe
2568	MEMZ-Destructive.exe
376	MEMZ-Destructive.exe
2568	MEMZ-Destructive.exe
376	MEMZ-Destructive.exe
2656	MEMZ-Destructive.exe
2656	MEMZ-Destructive.exe
2656	MEMZ-Destructive.exe
2656	MEMZ-Destructive.exe
376	MEMZ-Destructive.exe
376	MEMZ-Destructive.exe
2568	MEMZ-Destructive.exe
2568	MEMZ-Destructive.exe
2568	MEMZ-Destructive.exe
2568	MEMZ-Destructive.exe
376	MEMZ-Destructive.exe
376	MEMZ-Destructive.exe
2656	MEMZ-Destructive.exe
2656	MEMZ-Destructive.exe
4760	MEMZ-Destructive.exe
4760	MEMZ-Destructive.exe
5096	MEMZ-Destructive.exe
5096	MEMZ-Destructive.exe
2656	MEMZ-Destructive.exe
2656	MEMZ-Destructive.exe
4760	MEMZ-Destructive.exe
4760	MEMZ-Destructive.exe
376	MEMZ-Destructive.exe
376	MEMZ-Destructive.exe
2568	MEMZ-Destructive.exe
2568	MEMZ-Destructive.exe
376	MEMZ-Destructive.exe
2568	MEMZ-Destructive.exe
376	MEMZ-Destructive.exe
2568	MEMZ-Destructive.exe
4760	MEMZ-Destructive.exe
4760	MEMZ-Destructive.exe
2656	MEMZ-Destructive.exe
2656	MEMZ-Destructive.exe
5096	MEMZ-Destructive.exe
5096	MEMZ-Destructive.exe
2656	MEMZ-Destructive.exe
2656	MEMZ-Destructive.exe
5096	MEMZ-Destructive.exe
4760	MEMZ-Destructive.exe
5096	MEMZ-Destructive.exe
4760	MEMZ-Destructive.exe
376	MEMZ-Destructive.exe
376	MEMZ-Destructive.exe
2568	MEMZ-Destructive.exe
2568	MEMZ-Destructive.exe
2568	MEMZ-Destructive.exe
2568	MEMZ-Destructive.exe
376	MEMZ-Destructive.exe
376	MEMZ-Destructive.exe
4760	MEMZ-Destructive.exe
4760	MEMZ-Destructive.exe
5096	MEMZ-Destructive.exe
2656	MEMZ-Destructive.exe
5096	MEMZ-Destructive.exe
2656	MEMZ-Destructive.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4156	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4156	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1252	MEMZ-Destructive.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 2568	3144	MEMZ-Destructive.exe	89
PID 3144 wrote to memory of 2568	3144	MEMZ-Destructive.exe	89
PID 3144 wrote to memory of 2568	3144	MEMZ-Destructive.exe	89
PID 3144 wrote to memory of 2656	3144	MEMZ-Destructive.exe	90
PID 3144 wrote to memory of 2656	3144	MEMZ-Destructive.exe	90
PID 3144 wrote to memory of 2656	3144	MEMZ-Destructive.exe	90
PID 3144 wrote to memory of 376	3144	MEMZ-Destructive.exe	91
PID 3144 wrote to memory of 376	3144	MEMZ-Destructive.exe	91
PID 3144 wrote to memory of 376	3144	MEMZ-Destructive.exe	91
PID 3144 wrote to memory of 5096	3144	MEMZ-Destructive.exe	92
PID 3144 wrote to memory of 5096	3144	MEMZ-Destructive.exe	92
PID 3144 wrote to memory of 5096	3144	MEMZ-Destructive.exe	92
PID 3144 wrote to memory of 4760	3144	MEMZ-Destructive.exe	93
PID 3144 wrote to memory of 4760	3144	MEMZ-Destructive.exe	93
PID 3144 wrote to memory of 4760	3144	MEMZ-Destructive.exe	93
PID 3144 wrote to memory of 1252	3144	MEMZ-Destructive.exe	94
PID 3144 wrote to memory of 1252	3144	MEMZ-Destructive.exe	94
PID 3144 wrote to memory of 1252	3144	MEMZ-Destructive.exe	94
PID 1252 wrote to memory of 3852	1252	MEMZ-Destructive.exe	97
PID 1252 wrote to memory of 3852	1252	MEMZ-Destructive.exe	97
PID 1252 wrote to memory of 3852	1252	MEMZ-Destructive.exe	97
PID 1252 wrote to memory of 2852	1252	MEMZ-Destructive.exe	107
PID 1252 wrote to memory of 2852	1252	MEMZ-Destructive.exe	107
PID 2852 wrote to memory of 1856	2852	msedge.exe	108
PID 2852 wrote to memory of 1856	2852	msedge.exe	108
PID 2852 wrote to memory of 1708	2852	msedge.exe	109
PID 2852 wrote to memory of 1708	2852	msedge.exe	109
PID 2852 wrote to memory of 1708	2852	msedge.exe	109
PID 2852 wrote to memory of 1708	2852	msedge.exe	109
PID 2852 wrote to memory of 1708	2852	msedge.exe	109
PID 2852 wrote to memory of 1708	2852	msedge.exe	109
PID 2852 wrote to memory of 1708	2852	msedge.exe	109
PID 2852 wrote to memory of 1708	2852	msedge.exe	109
PID 2852 wrote to memory of 1708	2852	msedge.exe	109
PID 2852 wrote to memory of 1708	2852	msedge.exe	109
PID 2852 wrote to memory of 1708	2852	msedge.exe	109
PID 2852 wrote to memory of 1708	2852	msedge.exe	109
PID 2852 wrote to memory of 1708	2852	msedge.exe	109
PID 2852 wrote to memory of 1708	2852	msedge.exe	109
PID 2852 wrote to memory of 1708	2852	msedge.exe	109
PID 2852 wrote to memory of 1708	2852	msedge.exe	109
PID 2852 wrote to memory of 1708	2852	msedge.exe	109
PID 2852 wrote to memory of 1708	2852	msedge.exe	109
PID 2852 wrote to memory of 1708	2852	msedge.exe	109
PID 2852 wrote to memory of 1708	2852	msedge.exe	109
PID 2852 wrote to memory of 1708	2852	msedge.exe	109
PID 2852 wrote to memory of 1708	2852	msedge.exe	109
PID 2852 wrote to memory of 1708	2852	msedge.exe	109
PID 2852 wrote to memory of 1708	2852	msedge.exe	109
PID 2852 wrote to memory of 1708	2852	msedge.exe	109
PID 2852 wrote to memory of 1708	2852	msedge.exe	109
PID 2852 wrote to memory of 1708	2852	msedge.exe	109
PID 2852 wrote to memory of 1708	2852	msedge.exe	109
PID 2852 wrote to memory of 1708	2852	msedge.exe	109
PID 2852 wrote to memory of 1708	2852	msedge.exe	109
PID 2852 wrote to memory of 1708	2852	msedge.exe	109
PID 2852 wrote to memory of 1708	2852	msedge.exe	109
PID 2852 wrote to memory of 1708	2852	msedge.exe	109
PID 2852 wrote to memory of 1708	2852	msedge.exe	109
PID 2852 wrote to memory of 1708	2852	msedge.exe	109
PID 2852 wrote to memory of 1708	2852	msedge.exe	109
PID 2852 wrote to memory of 1708	2852	msedge.exe	109
PID 2852 wrote to memory of 1708	2852	msedge.exe	109
PID 2852 wrote to memory of 1708	2852	msedge.exe	109

C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe
"C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2568
- C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2656
- C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:376
- C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5096
- C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4760
- C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe" /main
  2⤵
  - Checks computer location settings
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1252
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=john+cena+midi+legit+not+converted
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff33c046f8,0x7fff33c04708,0x7fff33c04718
      4⤵
      PID:1856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,16911959820202478270,4813504773946862045,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
      4⤵
      PID:1708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,16911959820202478270,4813504773946862045,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
      4⤵
      PID:4644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,16911959820202478270,4813504773946862045,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
      4⤵
      PID:2872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16911959820202478270,4813504773946862045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
      4⤵
      PID:4340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16911959820202478270,4813504773946862045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
      4⤵
      PID:4356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16911959820202478270,4813504773946862045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:1
      4⤵
      PID:4108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16911959820202478270,4813504773946862045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
      4⤵
      PID:3392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,16911959820202478270,4813504773946862045,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:8
      4⤵
      PID:3660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,16911959820202478270,4813504773946862045,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:8
      4⤵
      PID:2672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16911959820202478270,4813504773946862045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
      4⤵
      PID:2816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16911959820202478270,4813504773946862045,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
      4⤵
      PID:1592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16911959820202478270,4813504773946862045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
      4⤵
      PID:3156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16911959820202478270,4813504773946862045,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
      4⤵
      PID:1532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16911959820202478270,4813504773946862045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
      4⤵
      PID:1920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16911959820202478270,4813504773946862045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
      4⤵
      PID:2300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16911959820202478270,4813504773946862045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
      4⤵
      PID:4852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16911959820202478270,4813504773946862045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3688 /prefetch:1
      4⤵
      PID:4876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16911959820202478270,4813504773946862045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
      4⤵
      PID:4164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16911959820202478270,4813504773946862045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6300 /prefetch:1
      4⤵
      PID:1464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+remove+memz+trojan+virus
    3⤵
    PID:3196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff33c046f8,0x7fff33c04708,0x7fff33c04718
      4⤵
      PID:1548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+create+your+own+ransomware
    3⤵
    PID:916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff33c046f8,0x7fff33c04708,0x7fff33c04718
      4⤵
      PID:4940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=virus+builder+legit+free+download
    3⤵
    PID:2316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff33c046f8,0x7fff33c04708,0x7fff33c04718
      4⤵
      PID:3924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4592

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f4 0x4dc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
215KB

MD5
d474ec7f8d58a66420b6daa0893a4874

SHA1
4314642571493ba983748556d0e76ec6704da211

SHA256
553a19b6f44f125d9594c02231e4217e9d74d92b7065dc996d92f1e53f6bcb69

SHA512
344062d1be40db095abb7392b047b16f33ea3043158690cf66a2fa554aa2db79c4aa68de1308f1eddf6b9140b9ac5de70aad960b4e8e8b91f105213c4aace348

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
42911bdfcc23d6d35c88643dcf6702d2

SHA1
30750013410a6a450d775e686c42a587a08753db

SHA256
1833528d597f80da2d2c90ad4c5672ecd76a37fef9ffd63e0cea9993bfa3050b

SHA512
5600c12d7cc029a61bc8691f0d5869a0b2f2f7e4f206481454742910560720cec398607a587343ef008ed8fcfb2312c21395b49ea2684e87b504a212c6e2dc9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
6bdfcffcd31f024a82ae6cf1a0d3f5bb

SHA1
b0ccf1f0e92ab1be4b0b605aafe1318d73171d15

SHA256
264f2ab3aba84709cb98b1932bd5825f16febea7c440e4450a39fba58c9fa075

SHA512
8d3c804cab062066ef8af21803f764e6c15afb92d697301a64ec3317ff274cc5f929dfaae6b88982e473f0a6e0a86f3e57f4033e370f56dea3e4d2869c8d942e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
f6d89ee7ba6839da06d63f977ffb7685

SHA1
711f8c8d479a8c398692ae993a41dc5ab7b5a30a

SHA256
7e6bcd617ca6e220991256d2a2d25e87d1154cbce2e6054bf4ae1da83a00f9c7

SHA512
6ea0b397feba9d2d3f478a10b556b8167ccef4f261074a6f94eefde186d996799ef37bfcf1f9e391a99c3a7fb97fa1de41f0828d8c5e9b6bed3541c0d83e5d56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
1bdf0563ac1161a2842b1eeaf1eb7f01

SHA1
574ea754b38346df3f99ace49db48eaa6b4567c7

SHA256
eca8637c07a9160c4b422ca5d16507b35db4dc9cd43c5d59d2346337dc2247bc

SHA512
5a6a5132aeb265d902d338389e27591860a126136b0bbbfbb45c62b8bb0bde616a532f48193ab16ced0c32ec2de2d8ae4620df55034dce8f8bc31ff2b03e0b05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
783B

MD5
b58880764628c5fcda2dca42fbcd7351

SHA1
146af3c7ddbfd6e2c0d07cfeb8ac36be01d28cf2

SHA256
d92d2261019c6226b93d7434e107cacb52b41279812fda7d491b8acdffd3844c

SHA512
e68d678d0bbf2aa8a6f28d716634dfbd83bd2a28dcfba84a782aa8e83034bbcef5f72a2f4965eb4639f8fc801a586a0bc5d1cac3fcec9d554746a168e3d89e7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
210ef91753c10067a5aa5e0e4110eadd

SHA1
63903f4ad72f1a69b2767b53d9785055d02db89e

SHA256
113c4c320db5ee021b61efd3290a998aae0863e91287c340a0d4370ef879dd45

SHA512
7fc6fb6aabf291205f60c062a7d40bd88ab9f0b92a4be579af8d8c6382073b663b7a0178db925f14287513673567f5085f5cbbf122c797805a850dd9235eae0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
38241e0da898b8296cff67264ac1a46d

SHA1
44ad57aee3e00ebcd21f842416e144915c0db353

SHA256
905f2fb96701ba51385eef4c8a0f2d5178c040bb9ba5fa31dad33c6ae2146aed

SHA512
bdfbe075da8fa960861bba18e47f283f9e6c2843028d7a2bb6a3557ce80c9765046476b74b298d19e08bb635e28f20e5736d9e08f1a8277eebf48c42aa944b86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
439b1a9e932b1610fe6e16a17c3ca04b

SHA1
558732e5f180ba6ce4b74fde65dabd27e9511443

SHA256
610a7c2e35a6669630911c87c97d63fa1d6f8d708bd68f55976bc7629739b356

SHA512
beeaf1d07d4f84e2314010ba12462afa8ea430f0669dc51a6a74f45908be9ba17159a8ce31f8828d3addb0e61d7681df4cc4be9138b33952d27e021a40f86f7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
40aee4700440ad966a039dc4fcb7f39a

SHA1
2c73ff2fe9aeef272a0bc19900008641c0654907

SHA256
aa84a9b52497a2f0e2432d04c8fde28eeec8a3b8c88f801cfca97bfe7e717843

SHA512
e110d0cb28cb646b1553a058ab7f1d1c58f19d3b66c2a2775cb7b91b64965ff49e7beb211d831ea23c0336fa76a4a981bf84099144d044b407bf7ef3a0705f17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fd1a108d67e363190957a7d49f0b89d6

SHA1
e32a24f3130ca302effedef1291f692350cfe2e8

SHA256
afee464545b5e23dc79699c0dc7adac19fd3801786dc6da2e296bf70efcc8575

SHA512
70b231c9a3e2cb563eeba79d01e3d7cf27184f8fd7a58ae8f752eb21df2db1eeefd8d5dea61c9d8d323112e1483928d0712276051027a109a210bda4aa0c794e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
664933cb8830082be96ee568a017ce80

SHA1
3c8387e5a8732eb7302d8fa75624e7ffc3dcde2b

SHA256
b8572d137eccafc4d37e91e1dd2d0a6a43289fcbe4d75fc71a8fe7dcbee3fa95

SHA512
db59678b0356a80bd132ef49721f19daca3e5e5eae7ea95cdcb9835b1b7930c295a6cb3e3bc6dbecfae4d9d2858770525816703fd0ecff459167133c03014317

Download Submit
C:\note.txt

Filesize
218B

MD5
afa6955439b8d516721231029fb9ca1b

SHA1
087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

SHA256
8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

SHA512
5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

Download Submit