hxxps://github[.]com/Thathip/Memz-Download/releases/download/v[.]1[.]0/MEMZ[.]4[.]0[.]Clean[.]zip

Resubmissions

22/03/2025, 22:58

250322-2yaz9swqw7 3

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 22:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Thathip/Memz-Download/releases/download/v.1.0/MEMZ.4.0.Clean.zip

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 906829057e9bdb01	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "448846210"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3F5BB131-0771-11F0-B578-7A9F8CACAEA3} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2556	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2556	iexplore.exe
2556	iexplore.exe
1500	IEXPLORE.EXE
1500	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 2556	2296	explorer.exe	31
PID 2296 wrote to memory of 2556	2296	explorer.exe	31
PID 2296 wrote to memory of 2556	2296	explorer.exe	31
PID 2556 wrote to memory of 1500	2556	iexplore.exe	32
PID 2556 wrote to memory of 1500	2556	iexplore.exe	32
PID 2556 wrote to memory of 1500	2556	iexplore.exe	32
PID 2556 wrote to memory of 1500	2556	iexplore.exe	32

C:\Windows\explorer.exe
explorer https://github.com/Thathip/Memz-Download/releases/download/v.1.0/MEMZ.4.0.Clean.zip
1⤵
PID:2552

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" https://github.com/Thathip/Memz-Download/releases/download/v.1.0/MEMZ.4.0.Clean.zip
  2⤵
  - Modifies Internet Explorer Phishing Filter
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2556 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
71KB

MD5
83142242e97b8953c386f988aa694e4a

SHA1
833ed12fc15b356136dcdd27c61a50f59c5c7d50

SHA256
d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

SHA512
bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
9690038cc05b9e87c3ba08b5f3e3941c

SHA1
652e0e68d72955a08d0bb9e8d5da39055582f50c

SHA256
d6fd79539b829114b8bcfc43eab0bfa8777a36c318650df9bc67a8e500212f88

SHA512
bc780deda7d0bfe12982fdb3a8730a7be9ca257d6c6a9a5622cd98bae31fe8928e5c6b07941fa98156384627a0628337a66a5a117a318e56d266456d46edc75a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b00c39eae7d29cfeaa226987e95fe841

SHA1
9be205c1fcd0334ec07e0244f2b51b30033ee488

SHA256
7ff7bbe4028e179808ba67857b03cadd2a02a9689247e0af63eb3d6131390994

SHA512
1d37bbd1b2ea03563cbf887193f881ec2518fbb6763befd169ec47365793acbd6e0abfdaf4e66f41230ff5ae19432bbabe3d0d3e291b94446b2d56a560d5aed6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53e0f2ae456a59989120835094929d35

SHA1
50039c664e0aee681cbaa4a674004db5c9e16cf9

SHA256
745aec409e978215a537607e395542c3c9846b70be453fba8ba1a1cf894f6824

SHA512
fe26719cdae5274f339f0b51dcd7354786312a454ef45512f0b81bb4a7f66f457dfa9b04ef0008aa39d1682253b2d306c476a40e8dec99a787613324e59954a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ed2d56c7cf1165caad541607232d904

SHA1
bc5e8391a4dcc5e58f76914b91f5d46a7b562b3b

SHA256
4648ae17bac66a5757c7ef1b89166e087a8f308e596157af6d5331ec9deba70d

SHA512
dfbe430a4976e46662d30450b46dde381ac9ddb16733f6ca085ed86f6021a7451c2d14dd9c54a76d3036b3082956fe3e6c034dfbc5556f175aaec2c6eb163f1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41e62d1cfbc446e2ead59548366ce426

SHA1
5e76c61bbeb0d37ab7337d17f51ae0384024a53b

SHA256
51c694e43ce5a74ccb81af9a6f495960073c05f6b26691a865cf1c4e00002fa8

SHA512
063508ca27b6c865381b8230fa4b421ceee63d9c7085cfd7011845a47d411ffa91d705bbc6e1f3fcc731c59de930220a97ac8053e3155f1486084db1ff2e1de5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d2149afea24ee9d270023a9779455da

SHA1
e5c91aa8c4b371a96058e2758003beb092bdaa71

SHA256
53f21b637eec8557c1f1aa0e95ae52f29e24fbb1b396dc79c33137f296ee51f7

SHA512
5d61889588fd83c7ffaf41ee788bb288ce39b823f25a1af599b0220ac18027e30a76a89a69aa89970ea688a873b0a63f458f1590e2971ad55ea7a65a34d84139

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
611ae93becf7e745da82a93d9e000f5c

SHA1
1cd46b733b033cc7ccbac6fe2c2817a84435bcd9

SHA256
28f355a450b74f0a577c07c1b7220480d6599a88211738ad97e490e0349cbd97

SHA512
9bb475c78a7ccd5821779d023c231d3f96fe4a9927b8e9f0e0ccdec2145c580765095b6ea155db31b19f1a70645b8945818515e9d489971cc89303d0b2004e2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e012fa8509bb022d1c270e97f3a1d63e

SHA1
b959052fdb981a4c5e875944cc019a2c74ca894a

SHA256
089b8eac772e764d591859d5b5c0ece2a067e9e98ba97b815d9ca696325a3e93

SHA512
7dfceeea5789f450ca415a96891d3b63e44014c696fdca1d6e3658a6ef91cc8f6e82ea5303eeaeea87955a0cb4598bbf7cd1e6db4c2ed1fbed78c3ae68e17695

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c7ef7f9ec05d86d49f5a373a8ae9538

SHA1
bf9ada3c8952f28028ba832e64fc47ae156d6087

SHA256
cb6920a8bca75ff9ff48684ac101cfc7f75aabd40fcadf34f612ec5da8b3c113

SHA512
3c1e4d341c470054ee812d68152afded1ffb80a570db52e715da75878f34696a50870eb074a73b962ee025293902aa294a2b2f3a065489c7f87e4fde5d00654c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53d91fc9fb29fc0d76f00e340c2ad659

SHA1
38eb062aa907e61710364d9e194ad03c5afbfb66

SHA256
32e71beb0d6537212a30f4bd239db36f5d4a7b5abf2800cb9d5ac63ee215bfb6

SHA512
a1de77ccc7795f545bbc533933dfc7043c658d4863aafb88d6da74d6601cdb228fd716cfa52bb6ef7081367f0f3d60cb772c414185e0217fe247bd4857949184

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0413a717591ea5c3aeb2858af5b6b9aa

SHA1
0874128384b2d2271b39d7d418963ac6ce6818eb

SHA256
b339c0866865ed81431d04b521f5cf5815b538d33536a90ae6fb7bb8c24e1784

SHA512
4f7f10a4d4f1657ef7e4385bdc88f87d99d32b4f77dbfa9abbd8dcfe581205b6a8860261b7dd8f8846b5d1eef170938fa32cb89778b24929b38cfcded52b2490

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2fb92b37fc5c0ff15fb2e46dd93c0d98

SHA1
c85f90d185db1d4f9db68d044752a94f6c07bcac

SHA256
23751da6c30dcd4221ac075f3c03c55c43388a58e2f0990987c521d94395344b

SHA512
0eef55ee36cdd1765f58c7969d11562a9f5e3c66cdd9bb166726b212a3427dcf6b06e50a03966904c0cb17e5e7f6cd04655da23b8596986db578486bec2ab732

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45e5529197d99046f9488d67eed13f99

SHA1
71453a9ca4b97418fafddcbeb4cc9d1693d9a230

SHA256
10a05f1725750ed7a4c2a869bb9a0f4f5fbcf880b79069ce27834d80e1cd5777

SHA512
2178533f93a5fb004ac5638dec170e50bb0749a792e276ea6c72840aa5342332a3b413e3e46a36e6e5dd2eacedee9a4d6835b9f580cacbdd7f247f8a8534ff6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
6a5d6b41365e9fb9345843e35e61d7ec

SHA1
a094c3f1924f326b64a997e1ef1a06aeaa1c0cad

SHA256
abc7572efd7fa6fbbd31f8f7e551d48e7c9e6fdb50dc57e86104bf77b5424596

SHA512
6197f33962b5b21fb2c593b6816252db0df3c057282cb1ff0dbeac43e15584fbe402ab13e526d66e2877d4e8a201d4734fb6aa81743e9b8c017e161c9934a327

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD192.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD69C.tmp

Filesize
183KB

MD5
109cab5505f5e065b63d01361467a83b

SHA1
4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

SHA256
ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

SHA512
753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads