umbral | hxxps://mega[.]nz/file/E9dkGYjQ#72JvqGL1cLWg8XIiOR5Yoe9tYq3texD4ubT5e0locM8

Resubmissions

12/08/2023, 12:16

230812-pfsfdabg37 10

12/08/2023, 12:15

230812-pe7tnsdg3x 10

Analysis

max time kernel
1800s
max time network
1773s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
12/08/2023, 12:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/file/E9dkGYjQ#72JvqGL1cLWg8XIiOR5Yoe9tYq3texD4ubT5e0locM8

Score

10^/10

umbral stealer

Malware Config

Extracted

Family

umbral

https://discord.com/api/webhooks/1139059592492490775/RfVme7UpS__l5d8CXAj8MEIFt3HBkn0_lBq7XL5xiiexXn-HuNN2OuyCPuWzXZev1fhW

Signatures

Detect Umbral payload 4 IoCs

resource	yara_rule
behavioral1/files/0x0006000000023251-308.dat	family_umbral
behavioral1/files/0x0006000000023251-343.dat	family_umbral
behavioral1/files/0x0006000000023251-344.dat	family_umbral
behavioral1/memory/5012-345-0x0000021B75D70000-0x0000021B75DB0000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

Executes dropped EXE 1 IoCs

pid	Process
5012	GtaAccGen.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings	taskmgr.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 755898.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3924	msedge.exe
3924	msedge.exe
4676	msedge.exe
4676	msedge.exe
3980	identity_helper.exe
3980	identity_helper.exe
2128	msedge.exe
2128	msedge.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1320	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: 33	4316	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4316	AUDIODG.EXE
Token: SeDebugPrivilege	5012	GtaAccGen.exe
Token: SeIncreaseQuotaPrivilege	324	wmic.exe
Token: SeSecurityPrivilege	324	wmic.exe
Token: SeTakeOwnershipPrivilege	324	wmic.exe
Token: SeLoadDriverPrivilege	324	wmic.exe
Token: SeSystemProfilePrivilege	324	wmic.exe
Token: SeSystemtimePrivilege	324	wmic.exe
Token: SeProfSingleProcessPrivilege	324	wmic.exe
Token: SeIncBasePriorityPrivilege	324	wmic.exe
Token: SeCreatePagefilePrivilege	324	wmic.exe
Token: SeBackupPrivilege	324	wmic.exe
Token: SeRestorePrivilege	324	wmic.exe
Token: SeShutdownPrivilege	324	wmic.exe
Token: SeDebugPrivilege	324	wmic.exe
Token: SeSystemEnvironmentPrivilege	324	wmic.exe
Token: SeRemoteShutdownPrivilege	324	wmic.exe
Token: SeUndockPrivilege	324	wmic.exe
Token: SeManageVolumePrivilege	324	wmic.exe
Token: 33	324	wmic.exe
Token: 34	324	wmic.exe
Token: 35	324	wmic.exe
Token: 36	324	wmic.exe
Token: SeIncreaseQuotaPrivilege	324	wmic.exe
Token: SeSecurityPrivilege	324	wmic.exe
Token: SeTakeOwnershipPrivilege	324	wmic.exe
Token: SeLoadDriverPrivilege	324	wmic.exe
Token: SeSystemProfilePrivilege	324	wmic.exe
Token: SeSystemtimePrivilege	324	wmic.exe
Token: SeProfSingleProcessPrivilege	324	wmic.exe
Token: SeIncBasePriorityPrivilege	324	wmic.exe
Token: SeCreatePagefilePrivilege	324	wmic.exe
Token: SeBackupPrivilege	324	wmic.exe
Token: SeRestorePrivilege	324	wmic.exe
Token: SeShutdownPrivilege	324	wmic.exe
Token: SeDebugPrivilege	324	wmic.exe
Token: SeSystemEnvironmentPrivilege	324	wmic.exe
Token: SeRemoteShutdownPrivilege	324	wmic.exe
Token: SeUndockPrivilege	324	wmic.exe
Token: SeManageVolumePrivilege	324	wmic.exe
Token: 33	324	wmic.exe
Token: 34	324	wmic.exe
Token: 35	324	wmic.exe
Token: 36	324	wmic.exe
Token: SeDebugPrivilege	1320	taskmgr.exe
Token: SeSystemProfilePrivilege	1320	taskmgr.exe
Token: SeCreateGlobalPrivilege	1320	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe
1320	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3924 wrote to memory of 2776	3924	msedge.exe	83
PID 3924 wrote to memory of 2776	3924	msedge.exe	83
PID 3924 wrote to memory of 4712	3924	msedge.exe	86
PID 3924 wrote to memory of 4712	3924	msedge.exe	86
PID 3924 wrote to memory of 4712	3924	msedge.exe	86
PID 3924 wrote to memory of 4712	3924	msedge.exe	86
PID 3924 wrote to memory of 4712	3924	msedge.exe	86
PID 3924 wrote to memory of 4712	3924	msedge.exe	86
PID 3924 wrote to memory of 4712	3924	msedge.exe	86
PID 3924 wrote to memory of 4712	3924	msedge.exe	86
PID 3924 wrote to memory of 4712	3924	msedge.exe	86
PID 3924 wrote to memory of 4712	3924	msedge.exe	86
PID 3924 wrote to memory of 4712	3924	msedge.exe	86
PID 3924 wrote to memory of 4712	3924	msedge.exe	86
PID 3924 wrote to memory of 4712	3924	msedge.exe	86
PID 3924 wrote to memory of 4712	3924	msedge.exe	86
PID 3924 wrote to memory of 4712	3924	msedge.exe	86
PID 3924 wrote to memory of 4712	3924	msedge.exe	86
PID 3924 wrote to memory of 4712	3924	msedge.exe	86
PID 3924 wrote to memory of 4712	3924	msedge.exe	86
PID 3924 wrote to memory of 4712	3924	msedge.exe	86
PID 3924 wrote to memory of 4712	3924	msedge.exe	86
PID 3924 wrote to memory of 4712	3924	msedge.exe	86
PID 3924 wrote to memory of 4712	3924	msedge.exe	86
PID 3924 wrote to memory of 4712	3924	msedge.exe	86
PID 3924 wrote to memory of 4712	3924	msedge.exe	86
PID 3924 wrote to memory of 4712	3924	msedge.exe	86
PID 3924 wrote to memory of 4712	3924	msedge.exe	86
PID 3924 wrote to memory of 4712	3924	msedge.exe	86
PID 3924 wrote to memory of 4712	3924	msedge.exe	86
PID 3924 wrote to memory of 4712	3924	msedge.exe	86
PID 3924 wrote to memory of 4712	3924	msedge.exe	86
PID 3924 wrote to memory of 4712	3924	msedge.exe	86
PID 3924 wrote to memory of 4712	3924	msedge.exe	86
PID 3924 wrote to memory of 4712	3924	msedge.exe	86
PID 3924 wrote to memory of 4712	3924	msedge.exe	86
PID 3924 wrote to memory of 4712	3924	msedge.exe	86
PID 3924 wrote to memory of 4712	3924	msedge.exe	86
PID 3924 wrote to memory of 4712	3924	msedge.exe	86
PID 3924 wrote to memory of 4712	3924	msedge.exe	86
PID 3924 wrote to memory of 4712	3924	msedge.exe	86
PID 3924 wrote to memory of 4712	3924	msedge.exe	86
PID 3924 wrote to memory of 4676	3924	msedge.exe	85
PID 3924 wrote to memory of 4676	3924	msedge.exe	85
PID 3924 wrote to memory of 3892	3924	msedge.exe	87
PID 3924 wrote to memory of 3892	3924	msedge.exe	87
PID 3924 wrote to memory of 3892	3924	msedge.exe	87
PID 3924 wrote to memory of 3892	3924	msedge.exe	87
PID 3924 wrote to memory of 3892	3924	msedge.exe	87
PID 3924 wrote to memory of 3892	3924	msedge.exe	87
PID 3924 wrote to memory of 3892	3924	msedge.exe	87
PID 3924 wrote to memory of 3892	3924	msedge.exe	87
PID 3924 wrote to memory of 3892	3924	msedge.exe	87
PID 3924 wrote to memory of 3892	3924	msedge.exe	87
PID 3924 wrote to memory of 3892	3924	msedge.exe	87
PID 3924 wrote to memory of 3892	3924	msedge.exe	87
PID 3924 wrote to memory of 3892	3924	msedge.exe	87
PID 3924 wrote to memory of 3892	3924	msedge.exe	87
PID 3924 wrote to memory of 3892	3924	msedge.exe	87
PID 3924 wrote to memory of 3892	3924	msedge.exe	87
PID 3924 wrote to memory of 3892	3924	msedge.exe	87
PID 3924 wrote to memory of 3892	3924	msedge.exe	87
PID 3924 wrote to memory of 3892	3924	msedge.exe	87
PID 3924 wrote to memory of 3892	3924	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mega.nz/file/E9dkGYjQ#72JvqGL1cLWg8XIiOR5Yoe9tYq3texD4ubT5e0locM8
1⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb7f3f46f8,0x7ffb7f3f4708,0x7ffb7f3f4718
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,16813037713042364005,648477820983466197,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,16813037713042364005,648477820983466197,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,16813037713042364005,648477820983466197,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16813037713042364005,648477820983466197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16813037713042364005,648477820983466197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,16813037713042364005,648477820983466197,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,16813037713042364005,648477820983466197,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16813037713042364005,648477820983466197,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16813037713042364005,648477820983466197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16813037713042364005,648477820983466197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16813037713042364005,648477820983466197,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2112,16813037713042364005,648477820983466197,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16813037713042364005,648477820983466197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2112,16813037713042364005,648477820983466197,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4708 /prefetch:8
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2112,16813037713042364005,648477820983466197,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6368 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2112,16813037713042364005,648477820983466197,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2128
- C:\Users\Admin\Downloads\GtaAccGen.exe
  "C:\Users\Admin\Downloads\GtaAccGen.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5012
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,16813037713042364005,648477820983466197,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3712 /prefetch:2
  2⤵
  PID:4636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4208

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x508 0x4fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4316

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1320

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4796

C:\Windows\System32\irvi83.exe
"C:\Windows\System32\irvi83.exe"
1⤵
PID:3828

C:\Windows\System32\irvi83.exe
"C:\Windows\System32\irvi83.exe"
1⤵
PID:3908

C:\Windows\System32\irvi83.exe
"C:\Windows\System32\irvi83.exe"
1⤵
PID:4608

C:\Windows\System32\irvi83.exe
"C:\Windows\System32\irvi83.exe"
1⤵
PID:4236

C:\Windows\System32\irvi83.exe
"C:\Windows\System32\irvi83.exe"
1⤵
PID:948

C:\Windows\System32\irvi83.exe
"C:\Windows\System32\irvi83.exe"
1⤵
PID:1376

C:\Windows\System32\irvi83.exe
"C:\Windows\System32\irvi83.exe"
1⤵
PID:1308

C:\Windows\System32\irvi83.exe
"C:\Windows\System32\irvi83.exe"
1⤵
PID:3060

C:\Windows\System32\irvi83.exe
"C:\Windows\System32\irvi83.exe"
1⤵
PID:3000

C:\Windows\System32\irvi83.exe
"C:\Windows\System32\irvi83.exe"
1⤵
PID:4112

C:\Windows\System32\irvi83.exe
"C:\Windows\System32\irvi83.exe"
1⤵
PID:5064

C:\Windows\System32\irvi83.exe
"C:\Windows\System32\irvi83.exe"
1⤵
PID:1336

C:\Windows\System32\irvi83.exe
"C:\Windows\System32\irvi83.exe"
1⤵
PID:2656

C:\Windows\System32\irvi83.exe
"C:\Windows\System32\irvi83.exe"
1⤵
PID:3776

C:\Windows\System32\irvi83.exe
"C:\Windows\System32\irvi83.exe"
1⤵
PID:2488

C:\Windows\System32\irvi83.exe
"C:\Windows\System32\irvi83.exe"
1⤵
PID:472

C:\Windows\System32\irvi83.exe
"C:\Windows\System32\irvi83.exe"
1⤵
PID:4108

C:\Windows\System32\irvi83.exe
"C:\Windows\System32\irvi83.exe"
1⤵
PID:3784

C:\Windows\System32\irvi83.exe
"C:\Windows\System32\irvi83.exe"
1⤵
PID:4636

C:\Windows\System32\irvi83.exe
"C:\Windows\System32\irvi83.exe"
1⤵
PID:4452

C:\Windows\System32\irvi83.exe
"C:\Windows\System32\irvi83.exe"
1⤵
PID:3948

C:\Windows\System32\irvi83.exe
"C:\Windows\System32\irvi83.exe"
1⤵
PID:4028

C:\Windows\System32\irvi83.exe
"C:\Windows\System32\irvi83.exe"
1⤵
PID:8

C:\Windows\System32\irvi83.exe
"C:\Windows\System32\irvi83.exe"
1⤵
PID:4072

C:\Windows\System32\irvi83.exe
"C:\Windows\System32\irvi83.exe"
1⤵
PID:4056

C:\Windows\System32\irvi83.exe
"C:\Windows\System32\irvi83.exe"
1⤵
PID:764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
70e2e6954b953053c0c4f3b6e6ad9330

SHA1
cb61ba67b3bffa1d833bb85cc9547669ec46f62f

SHA256
f6e770a3b88ad3fda592419b6c00553bdadc50d5fb466ef872271389977f2ab4

SHA512
eeacb0e62f68f56285f7605963ca9bb82f542d4e2ccc323266c08c9990cecdebd574e1ab304ae08ea8c6c94c50683180f83562f972e92799ebbcfcd8f503fb5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\06cf111a-18fa-4dd0-b57d-8850d2a943b8.tmp

Filesize
5KB

MD5
b6d4ba19127597fd2ac478ea98945728

SHA1
cc1e12b86349d15e689b45f34da2ba08b0f7c978

SHA256
ef752c2aa59989504a625a5dfb14243221ea977dde1807288d6394590b11571f

SHA512
e28e1a8726f44a5510a30083525805c64481ee23d0e02af4bfca8768124877c06c08c766ebffb56d421fbcf2166dbeedcc5203fb0451f52dbeeeea9954a41c0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
e7b66d9c96d6147b01e23491023e0742

SHA1
021cf5dd973d81c5f67e2c92bb489e76bfb098ab

SHA256
0702661c80e6460f640373db1d9c5d17acf32bd98633fd966bc62fb6c916ef01

SHA512
909c333779d0060540b2bc2fe7313e2c2fd00b76306b665e76afbfadc8ec2c074ce395aae09559dcdee0c3462653aa34e5b58c0169324c43c7e67f82170cd6a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
188B

MD5
03da8e9f1c34251a6a9fc171f9972a58

SHA1
4817ec312c6bd1ce48635f652f4ea8d70a190987

SHA256
08bfcc15479ee1cf404d6d0c9aa3a5a1eba16288f4e432b56b66861d88052451

SHA512
d8df733d82c529cf321cb5ac9db4216b32b6b6904201207600fec3fcd26c92e550520335e02ff423747d3772ab672ad95528f8bc4a15bd70abf6421d6e0ac727

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c0ace7ef0e2a11f7e25df9643dc2ecf2

SHA1
8cae449bc69974b7c8b35974b6a2d003f01701ae

SHA256
8f4546b24fe5707a2a653462f8e29d121510239ad1f1fe74fa7a52c61a80f5d1

SHA512
8dc15d5e45918791499f8692c8c3beeac0f33a8c6323c407781994b5b7b38bee0314454731a46394b7dd28f06edcfd2a8c3b3c59b7e46fab084c6b9a8a9d2ef3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9eb2086fbbfd83f7c8ef70afbe2c78c0

SHA1
0c045dfbf1bc768ba65a45bcc3732a55eb98a536

SHA256
705ac990eb1f4bbc93926ade7513461c342570195f651e0d6f0751d6a4b2640f

SHA512
0bd59daf75689fae188316ff68f985f4ffa13e02b881f6e02df0c26a736f3f6b582de1d84a45b4c5944d04058435b55e5eb2f87efa62f480a292e340c4202121

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5a478f1e08816969e8214f982850b754

SHA1
1cf5e7192f3c6e31c7e27b6cb34ebf89036eec0c

SHA256
665cf5612c61412c9acc928b1e155c8f11ae83905ce614d9a1a7ad72cc0fd489

SHA512
7e7ff60c157841f6f5bb206ebbce29f6df3a6c0c671805415ad7226654e13da49ad76e39a6d0afe28992348f3b5685ecacbfb44178fd61998c54caebbfd97832

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
23f4f5bb3971b46ff806d876f8aec0a8

SHA1
7fb138ae6f5b01cccfbbe0fb0c3e899d0e70d239

SHA256
2afbe6e0066448a4eedb4d047b64f02ace15ecd6e784f2845c0f79896f277a79

SHA512
03fda5425eb5e811f6bd6ce7156a9259091c33bb56152c2e00f71de784a7d8a496646082bfc078e0a559001063368c97eea0e4da0c92a80c1ea4cdbba4e79a28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57e4e2.TMP

Filesize
48B

MD5
c3e016b9f14a43f02fe567fc89e01fa9

SHA1
4f72e9d27309d13e432841391e5c07321a7eb57d

SHA256
3376d53f5aaf4ec0bc1786df9ddbdef85bdcf844fbbaa645d9fc554515aa921f

SHA512
53a7d7a51146e24d9416d10ce228638f3118cfe7c6a3ea10adc62ad86173a43990ca5c38aba655ef7fc180d717b22a97b7bc340489974680c369114eacea3c3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
ea40293ea5470c28d145f05264c1d0d2

SHA1
97395a9afccf6711e382152989d025ea7355fe92

SHA256
d46b9f65b8042527f041da79289f854c78d4c9320d0b0d9168a335d58c5964e4

SHA512
2458c409e336d6eab235a34411347f7a3314d6a513c07d2fde86e8323c57de765c20792e92efee5a33fb230445cb3c4739a22b789993b977c93401b75703bf9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
c343ec3c4f88d8d0d5967f8dd0982b7b

SHA1
23ef984c3c9029fe4ea3412585731bbffcd3ee44

SHA256
f37c754d26944e4e67889797c805324d73a301b3e850d6aec90385c82b2a3049

SHA512
34c2d8920c4631f8c6a6af16a1cfdce0109778b74bffaf4b2e06fd5b3fd1ec8828395794fc5b17e430f7f8752544ecb1cbbfa957dfe200353a035e3f1a8d77a0

Download Submit
C:\Users\Admin\Downloads\GtaAccGen.exe

Filesize
228KB

MD5
05a33ea7d85b6d6b8e33a599ec2faf16

SHA1
97e518884e7b550d0cb602c02a4fc6dd329820d5

SHA256
9b7a87ec1c2e0a52ec50a4ee23eeec7cafa6d6553f96ddd2e30405652a7cb0b6

SHA512
092913f6bd0ca504baa9901a94ac97abd6cc56dedbb4c7d8a3aa5f73e49953cab235620fa4c9bc05f87ba61e04ccc65f41b83c30c59119292fa9ee6f1740a1ef

Download Submit
C:\Users\Admin\Downloads\GtaAccGen.exe

Filesize
228KB

MD5
05a33ea7d85b6d6b8e33a599ec2faf16

SHA1
97e518884e7b550d0cb602c02a4fc6dd329820d5

SHA256
9b7a87ec1c2e0a52ec50a4ee23eeec7cafa6d6553f96ddd2e30405652a7cb0b6

SHA512
092913f6bd0ca504baa9901a94ac97abd6cc56dedbb4c7d8a3aa5f73e49953cab235620fa4c9bc05f87ba61e04ccc65f41b83c30c59119292fa9ee6f1740a1ef

Download Submit
C:\Users\Admin\Downloads\GtaAccGen.exe

Filesize
228KB

MD5
05a33ea7d85b6d6b8e33a599ec2faf16

SHA1
97e518884e7b550d0cb602c02a4fc6dd329820d5

SHA256
9b7a87ec1c2e0a52ec50a4ee23eeec7cafa6d6553f96ddd2e30405652a7cb0b6

SHA512
092913f6bd0ca504baa9901a94ac97abd6cc56dedbb4c7d8a3aa5f73e49953cab235620fa4c9bc05f87ba61e04ccc65f41b83c30c59119292fa9ee6f1740a1ef

Download Submit
memory/1320-360-0x0000021CBC170000-0x0000021CBC171000-memory.dmp

Filesize
4KB

Download
memory/1320-366-0x0000021CBC170000-0x0000021CBC171000-memory.dmp

Filesize
4KB

Download
memory/1320-367-0x0000021CBC170000-0x0000021CBC171000-memory.dmp

Filesize
4KB

Download
memory/1320-359-0x0000021CBC170000-0x0000021CBC171000-memory.dmp

Filesize
4KB

Download
memory/1320-361-0x0000021CBC170000-0x0000021CBC171000-memory.dmp

Filesize
4KB

Download
memory/1320-370-0x0000021CBC170000-0x0000021CBC171000-memory.dmp

Filesize
4KB

Download
memory/1320-365-0x0000021CBC170000-0x0000021CBC171000-memory.dmp

Filesize
4KB

Download
memory/1320-371-0x0000021CBC170000-0x0000021CBC171000-memory.dmp

Filesize
4KB

Download
memory/1320-368-0x0000021CBC170000-0x0000021CBC171000-memory.dmp

Filesize
4KB

Download
memory/1320-369-0x0000021CBC170000-0x0000021CBC171000-memory.dmp

Filesize
4KB

Download
memory/5012-349-0x00007FFB6CA00000-0x00007FFB6D4C1000-memory.dmp

Filesize
10.8MB

Download
memory/5012-346-0x00007FFB6CA00000-0x00007FFB6D4C1000-memory.dmp

Filesize
10.8MB

Download
memory/5012-347-0x0000021B78300000-0x0000021B78310000-memory.dmp

Filesize
64KB

Download
memory/5012-345-0x0000021B75D70000-0x0000021B75DB0000-memory.dmp

Filesize
256KB

Download