File name:

MEMZ.exe

Full analysis: https://app.any.run/tasks/b71871b1-389b-49ea-83d9-2db568ed0063
Verdict: Malicious activity
Analysis date: March 07, 2024, 17:39:25
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

1D5AD9C8D3FEE874D0FEB8BFAC220A11

SHA1:

CA6D3F7E6C784155F664A9179CA64E4034DF9595

SHA256:

3872C12D31FC9825E8661AC01ECEE2572460677AFBC7093F920A8436A42E28FF

SSDEEP:

192:M2WgyvSW8gRc6olcIEiwqZKBkDFR43xWTM3LHf26gFrcx3sNqa:JWgnSmFlcIqq3agmLH+6gF23sNj

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • MEMZ.exe (PID: 4052)

  • SUSPICIOUS

    • Reads the Internet Settings

      • MEMZ.exe (PID: 4052)
      • MEMZ.exe (PID: 3112)
      • sipnotify.exe (PID: 2036)
      • runonce.exe (PID: 340)
      • MEMZ.exe (PID: 3248)
      • MEMZ.exe (PID: 3224)

    • Reads security settings of Internet Explorer

      • MEMZ.exe (PID: 4052)
      • MEMZ.exe (PID: 3112)
      • MEMZ.exe (PID: 3224)
      • MEMZ.exe (PID: 3248)

    • Application launched itself

      • MEMZ.exe (PID: 4052)
      • MEMZ.exe (PID: 3112)
      • WerFault.exe (PID: 2076)
      • MEMZ.exe (PID: 3248)
      • MEMZ.exe (PID: 3224)

    • The process executes via Task Scheduler

      • ctfmon.exe (PID: 2044)
      • sipnotify.exe (PID: 2036)

    • Non-standard symbols in registry

      • WerFault.exe (PID: 2084)

    • Reads settings of System Certificates

      • sipnotify.exe (PID: 2036)

  • INFO

    • Reads the computer name

      • MEMZ.exe (PID: 4052)
      • wmpnscfg.exe (PID: 2752)
      • MEMZ.exe (PID: 3112)
      • IMEKLMG.EXE (PID: 2180)
      • IMEKLMG.EXE (PID: 2192)
      • wmpnscfg.exe (PID: 2580)
      • wmpnscfg.exe (PID: 2600)
      • wmpnscfg.exe (PID: 2800)
      • MEMZ.exe (PID: 3248)
      • MEMZ.exe (PID: 3224)

    • Checks supported languages

      • MEMZ.exe (PID: 4052)
      • MEMZ.exe (PID: 2044)
      • MEMZ.exe (PID: 3972)
      • MEMZ.exe (PID: 3720)
      • MEMZ.exe (PID: 3736)
      • MEMZ.exe (PID: 3708)
      • MEMZ.exe (PID: 3660)
      • MEMZ.exe (PID: 572)
      • MEMZ.exe (PID: 4084)
      • MEMZ.exe (PID: 268)
      • MEMZ.exe (PID: 2028)
      • MEMZ.exe (PID: 752)
      • MEMZ.exe (PID: 2736)
      • MEMZ.exe (PID: 3112)
      • wmpnscfg.exe (PID: 2752)
      • IMEKLMG.EXE (PID: 2180)
      • IMEKLMG.EXE (PID: 2192)
      • wmpnscfg.exe (PID: 2580)
      • wmpnscfg.exe (PID: 2800)
      • MEMZ.exe (PID: 3224)
      • wmpnscfg.exe (PID: 2600)
      • MEMZ.exe (PID: 3348)
      • MEMZ.exe (PID: 3324)
      • MEMZ.exe (PID: 3336)
      • MEMZ.exe (PID: 3388)
      • MEMZ.exe (PID: 3360)
      • MEMZ.exe (PID: 3372)
      • MEMZ.exe (PID: 3428)
      • MEMZ.exe (PID: 3416)
      • MEMZ.exe (PID: 3248)
      • MEMZ.exe (PID: 3440)
      • MEMZ.exe (PID: 3452)
      • MEMZ.exe (PID: 3464)
      • MEMZ.exe (PID: 3480)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 2752)
      • MEMZ.exe (PID: 3112)
      • explorer.exe (PID: 3488)
      • runonce.exe (PID: 340)
      • IMEKLMG.EXE (PID: 2192)
      • IMEKLMG.EXE (PID: 2180)
      • explorer.exe (PID: 2408)
      • wmpnscfg.exe (PID: 2580)
      • wmpnscfg.exe (PID: 2800)
      • wmpnscfg.exe (PID: 2600)
      • MEMZ.exe (PID: 3224)
      • MEMZ.exe (PID: 3248)

    • Reads the machine GUID from the registry

      • MEMZ.exe (PID: 3708)
      • MEMZ.exe (PID: 3736)
      • MEMZ.exe (PID: 3972)
      • MEMZ.exe (PID: 3720)
      • MEMZ.exe (PID: 2044)
      • MEMZ.exe (PID: 3348)
      • MEMZ.exe (PID: 3336)
      • MEMZ.exe (PID: 3372)
      • MEMZ.exe (PID: 3360)
      • MEMZ.exe (PID: 3324)

    • Create files in a temporary directory

      • WerFault.exe (PID: 2084)

    • Reads security settings of Internet Explorer

      • runonce.exe (PID: 340)
      • sipnotify.exe (PID: 2036)

    • Reads the time zone

      • runonce.exe (PID: 340)

    • Process checks whether UAC notifications are on

      • IMEKLMG.EXE (PID: 2192)
      • IMEKLMG.EXE (PID: 2180)

    • Reads the software policy settings

      • sipnotify.exe (PID: 2036)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:03:19 03:33:10+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 3584
InitializedDataSize: 11776
UninitializedDataSize: -
EntryPoint: 0x122d
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
122
Monitored processes
41
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start memz.exe no specs memz.exe no specs memz.exe no specs memz.exe no specs memz.exe no specs memz.exe no specs memz.exe no specs wmpnscfg.exe no specs explorer.exe no specs memz.exe no specs memz.exe no specs memz.exe no specs memz.exe no specs memz.exe no specs memz.exe no specs memz.exe no specs ctfmon.exe no specs sipnotify.exe runonce.exe werfault.exe no specs werfault.exe no specs imeklmg.exe no specs imeklmg.exe no specs explorer.exe no specs wmpnscfg.exe no specs wmpnscfg.exe no specs wmpnscfg.exe no specs memz.exe no specs memz.exe no specs memz.exe no specs memz.exe no specs memz.exe no specs memz.exe no specs memz.exe no specs memz.exe no specs memz.exe no specs memz.exe no specs memz.exe no specs memz.exe no specs memz.exe no specs memz.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
268"C:\Users\admin\AppData\Local\Temp\MEMZ.exe" /watchdogC:\Users\admin\AppData\Local\Temp\MEMZ.exe—MEMZ.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\memz.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
340runonce.exe /ExplorerC:\Windows\System32\runonce.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Run Once Wrapper
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\runonce.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
572"C:\Users\admin\AppData\Local\Temp\MEMZ.exe" /watchdogC:\Users\admin\AppData\Local\Temp\MEMZ.exe—MEMZ.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\memz.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
752"C:\Users\admin\AppData\Local\Temp\MEMZ.exe" /watchdogC:\Users\admin\AppData\Local\Temp\MEMZ.exe—MEMZ.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\memz.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2028"C:\Users\admin\AppData\Local\Temp\MEMZ.exe" /mainC:\Users\admin\AppData\Local\Temp\MEMZ.exe—MEMZ.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
2
Modules
Images
c:\users\admin\appdata\local\temp\memz.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2036C:\Windows\system32\sipnotify.exe -LogonOrUnlockC:\Windows\System32\sipnotify.exe
taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
sipnotify
Exit code:
0
Version:
6.1.7602.20480 (win7sp1_ldr_escrow.191010-1716)
Modules
Images
c:\windows\system32\sipnotify.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2044"C:\Users\admin\AppData\Local\Temp\MEMZ.exe" /watchdogC:\Users\admin\AppData\Local\Temp\MEMZ.exe—MEMZ.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\memz.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2044C:\Windows\System32\ctfmon.exe C:\Windows\System32\ctfmon.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CTF Loader
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ctfmon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msctfmonitor.dll
c:\windows\system32\msctf.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
2076"C:\Windows\System32\WerFault.exe" -k -rqC:\Windows\System32\WerFault.exe—runonce.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2084C:\Windows\System32\WerFault.exe -k -qC:\Windows\System32\WerFault.exe—WerFault.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
18 736
Read events
18 493
Write events
224
Delete events
19

Modification events

(PID) Process:(4052) MEMZ.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(4052) MEMZ.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(4052) MEMZ.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(4052) MEMZ.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3112) MEMZ.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3112) MEMZ.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3112) MEMZ.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3112) MEMZ.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2044) ctfmon.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:internat.exe
Value:
(PID) Process:(340) runonce.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Operation:delete valueName:*WerKernelReporting
Value:
%SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq
Executable files
0
Suspicious files
3
Text files
6
Unknown types
5

Dropped files

PID
Process
Filename
Type
2084WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_0_0_cab_0824c301\Report.wer —
MD5:—
SHA256:—
2084WerFault.exeC:\Users\admin\AppData\Local\Temp\WERC268.tmp.cab.tmpbinary
MD5:AC8BA5B8ECE239CF5E4B823C9924DEE0
SHA256:812539C2428107C09717F65551501CC7B8D5501165980B29E4957EB74E1C4D42
2084WerFault.exeC:\Users\admin\AppData\Local\Temp\WER-9359-0.sysdata.xmlxml
MD5:B7E38B5A83FC38998EEA25968B42554E
SHA256:5CB3B571D015C8DF84D1842C2D5E5F872829FBEF998EE36BC67C4A38342B95DF
2036sipnotify.exeC:\Users\admin\AppData\Local\microsoft\windows\SipNotify\eoscontent\metadata.jsonbinary
MD5:E8A970BA6CE386EED9A5E724F26212A6
SHA256:7E06107D585D8FC7870998F3856DCC3E35800AA97E4406AAB83BC8444B6CBDE3
2084WerFault.exeC:\Users\admin\AppData\Local\Temp\WERC266.tmp.cab.tmpbinary
MD5:B3AD2AF6B76A8761B60714F1C8218E94
SHA256:D7669FBA75B0063667F8ABD913DCD9A68EE39DAE86CC5FE0E419043422F31163
2036sipnotify.exeC:\Users\admin\AppData\Local\microsoft\windows\SipNotify\eoscontent\en-us.htmlhtml
MD5:9752942B57692148B9F614CF4C119A36
SHA256:E31B834DD53FA6815F396FC09C726636ABF98F3367F0CF1590EF5EB3801C75D1
2036sipnotify.exeC:\Users\admin\AppData\Local\microsoft\windows\SipNotify\eoscontent\main.jpgimage
MD5:B342ACE63F77961249A084C61EABC884
SHA256:E5067BBA2095B5DA7C3171EC116E9A92337E24E471339B0860A160076EFE49B9
2036sipnotify.exeC:\Users\admin\AppData\Local\microsoft\windows\SipNotify\eoscontent\microsoft-logo.pngimage
MD5:B7C73A0CFBA68CC70C35EF9C63703CE4
SHA256:1D8B27A0266FF526CF95447F3701592A908848467D37C09A00A2516C1F29A013
340runonce.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etlbinary
MD5:8EBD0309064A329953F9906437346799
SHA256:100E53615285D98BD8819572885B841613704C5E6DD062F0CCC7FA04ADE22C3C
2036sipnotify.exeC:\Users\admin\AppData\Local\microsoft\windows\SipNotify\eoscontent\script.jstext
MD5:A2682382967C351F7ED21762F9E5DE9E
SHA256:36B1D26F1EC69685648C0528C2FCE95A3C2DBECF828CDFA4A8B4239A15B644A2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
9
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2036
sipnotify.exe
HEAD
200
2.23.65.216:80
http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=133543069887340000
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1132
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2036
sipnotify.exe
2.23.65.216:80
query.prod.cms.rt.microsoft.com
AKAMAI-AS
DE
unknown

DNS requests

Domain
IP
Reputation
query.prod.cms.rt.microsoft.com
  • 2.23.65.216
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
MEMZ.exe