Analysis
-
max time kernel
1499s -
max time network
1446s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
25-02-2024 18:29
Static task
static1
URLScan task
urlscan1
Malware Config
Extracted
lumma
https://turkeyunlikelyofw.shop/api
https://associationokeo.shop/api
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
HManager.exeHManager.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\Control Panel\International\Geo\Nation HManager.exe Key value queried \REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\Control Panel\International\Geo\Nation HManager.exe -
Executes dropped EXE 4 IoCs
Processes:
HManager.exeRepublic.pifHManager.exeRepublic.pifpid process 4352 HManager.exe 1568 Republic.pif 1716 HManager.exe 888 Republic.pif -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe -
Enumerates processes with tasklist 1 TTPs 4 IoCs
Processes:
tasklist.exetasklist.exetasklist.exetasklist.exepid process 1964 tasklist.exe 4664 tasklist.exe 1064 tasklist.exe 1324 tasklist.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 2 IoCs
Processes:
msedge.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings msedge.exe Key created \REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings OpenWith.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 4032 NOTEPAD.EXE -
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exeRepublic.piftaskmgr.exepid process 1372 msedge.exe 1372 msedge.exe 4016 msedge.exe 4016 msedge.exe 4480 identity_helper.exe 4480 identity_helper.exe 3308 msedge.exe 3308 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 1568 Republic.pif 1568 Republic.pif 1568 Republic.pif 1568 Republic.pif 1568 Republic.pif 1568 Republic.pif 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
OpenWith.exetaskmgr.exepid process 5016 OpenWith.exe 3736 taskmgr.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
7zG.exetasklist.exetasklist.exetaskmgr.exetasklist.exetasklist.exedescription pid process Token: SeRestorePrivilege 1900 7zG.exe Token: 35 1900 7zG.exe Token: SeSecurityPrivilege 1900 7zG.exe Token: SeSecurityPrivilege 1900 7zG.exe Token: SeDebugPrivilege 1964 tasklist.exe Token: SeDebugPrivilege 4664 tasklist.exe Token: SeDebugPrivilege 3736 taskmgr.exe Token: SeSystemProfilePrivilege 3736 taskmgr.exe Token: SeCreateGlobalPrivilege 3736 taskmgr.exe Token: SeDebugPrivilege 1064 tasklist.exe Token: SeDebugPrivilege 1324 tasklist.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
msedge.exepid process 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
msedge.exeRepublic.piftaskmgr.exepid process 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 1568 Republic.pif 1568 Republic.pif 1568 Republic.pif 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 5016 OpenWith.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 4016 wrote to memory of 1988 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 1988 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 2752 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 2752 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 2752 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 2752 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 2752 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 2752 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 2752 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 2752 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 2752 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 2752 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 2752 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 2752 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 2752 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 2752 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 2752 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 2752 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 2752 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 2752 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 2752 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 2752 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 2752 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 2752 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 2752 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 2752 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 2752 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 2752 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 2752 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 2752 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 2752 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 2752 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 2752 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 2752 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 2752 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 2752 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 2752 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 2752 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 2752 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 2752 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 2752 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 2752 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 1372 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 1372 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 3604 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 3604 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 3604 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 3604 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 3604 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 3604 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 3604 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 3604 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 3604 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 3604 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 3604 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 3604 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 3604 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 3604 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 3604 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 3604 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 3604 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 3604 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 3604 4016 msedge.exe msedge.exe PID 4016 wrote to memory of 3604 4016 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://rebrand.ly/HwidManager1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb20d646f8,0x7ffb20d64708,0x7ffb20d647182⤵PID:1988
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,5563986815270098273,16986455277987045921,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:22⤵PID:2752
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,5563986815270098273,16986455277987045921,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1372 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,5563986815270098273,16986455277987045921,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:82⤵PID:3604
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5563986815270098273,16986455277987045921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:12⤵PID:4336
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5563986815270098273,16986455277987045921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:12⤵PID:3272
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,5563986815270098273,16986455277987045921,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:82⤵PID:1692
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,5563986815270098273,16986455277987045921,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4480 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5563986815270098273,16986455277987045921,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:12⤵PID:3680
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5563986815270098273,16986455277987045921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:12⤵PID:1604
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5563986815270098273,16986455277987045921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:12⤵PID:2016
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2112,5563986815270098273,16986455277987045921,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5900 /prefetch:82⤵PID:3924
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5563986815270098273,16986455277987045921,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:12⤵PID:3292
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5563986815270098273,16986455277987045921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:12⤵PID:4932
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2112,5563986815270098273,16986455277987045921,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6652 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3308 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,5563986815270098273,16986455277987045921,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6720 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3040
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3924
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1036
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1468
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap3041:82:7zEvent229801⤵
- Suspicious use of AdjustPrivilegeToken
PID:1900
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\RegisterUndo.txt1⤵
- Opens file in notepad (likely ransom note)
PID:4032
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5016
-
C:\Users\Admin\Downloads\HManager.exe"C:\Users\Admin\Downloads\HManager.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
PID:4352 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k move Inc Inc.bat & Inc.bat & exit2⤵PID:468
-
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1964 -
C:\Windows\SysWOW64\findstr.exefindstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"3⤵PID:2008
-
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4664 -
C:\Windows\SysWOW64\findstr.exefindstr /I "wrsa.exe opssvc.exe"3⤵PID:1048
-
C:\Windows\SysWOW64\cmd.execmd /c md 139743⤵PID:228
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b Mapping + Comedy + Arrived + Cheat + Automation 13974\Republic.pif3⤵PID:4048
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b Books 13974\p3⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\13974\Republic.pif13974\Republic.pif 13974\p3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
PID:1568 -
C:\Windows\SysWOW64\PING.EXEping -n 5 localhost3⤵
- Runs ping.exe
PID:1608
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:3736
-
C:\Users\Admin\Downloads\HManager.exe"C:\Users\Admin\Downloads\HManager.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
PID:1716 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k move Inc Inc.bat & Inc.bat & exit2⤵PID:2520
-
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1064 -
C:\Windows\SysWOW64\findstr.exefindstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"3⤵PID:1096
-
C:\Windows\SysWOW64\findstr.exefindstr /I "wrsa.exe opssvc.exe"3⤵PID:2168
-
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1324 -
C:\Windows\SysWOW64\cmd.execmd /c md 141443⤵PID:2404
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b Mapping + Comedy + Arrived + Cheat + Automation 14144\Republic.pif3⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\14144\Republic.pif14144\Republic.pif 14144\p3⤵
- Executes dropped EXE
PID:888 -
C:\Windows\SysWOW64\cmd.execmd /c copy /b Books 14144\p3⤵PID:3272
-
C:\Windows\SysWOW64\PING.EXEping -n 5 localhost3⤵
- Runs ping.exe
PID:4604
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD51af9fbc1d4655baf2df9e8948103d616
SHA1c58d5c208d0d5aab5b6979b64102b0086799b0bf
SHA256e83daa7b2af963dbb884d82919710164e2337f0f9f5e5c56ee4b7129d160c135
SHA512714d0ff527a8a24ec5d32a0a2b74e402ee933ea86e42d3e2fb5615c8345e6c09aa1c2ddf2dea53d71c5a666483a3b494b894326fea0cc1d8a06d3b32ec9397d3
-
Filesize
152B
MD5aa6f46176fbc19ccf3e361dc1135ece0
SHA1cb1f8c693b88331e9513b77efe47be9e43c43b12
SHA2562f5ba493c7c4192e9310cea3a96cfec4fd14c6285af6e3659627ab177e560819
SHA5125d26fdffebeb1eb5adde9f7da19fe7069e364d3f68670013cb0cc3e2b40bf1fbcb9bdebbfe999747caf141c88ccd53bd4acf2074283e4bde46b8c28fbae296f5
-
Filesize
310B
MD55d746c5fb7aa573ca743af62df0ea739
SHA1c762b896320ada86c045c22f03d866dc1093122b
SHA256c9760b2f76f8d6f0bc6d185ddaa5a12de6b291d4aee54d3f42a7cbcdf7fb23bd
SHA512049cdf7e039dde2adc54b0dcd91856bc7982cdd48a66d8750380f451fb3ffb06f02bbd03314def1ec32a385ad9c960bd2b196406a4cd663683facd42dd2ef949
-
Filesize
6KB
MD59305dd7c9c83808683b4c6c1b4d6ed1d
SHA12ffdc8575aed38cd9ffd29e5f3783d8a5b33c29d
SHA2565e4a90727bd4ab2e2e40896ef99b91dba92cb7e5767f9395f7a7b198074197b0
SHA512904e7c3cdee148c300e615167f3c96cd52ec8c3fb213b4853cfbb982bd27dfe5271506b62d51bfd6bafbd486f226a699e40f57a674323e8cc121ef86cb34a8ca
-
Filesize
6KB
MD52aa0f12279621ec5efd12a5c9ea97e22
SHA1f88cfd0ffb692a36bb61fcf5c2a238a80faa686a
SHA256a7b7c83a2fbe6cc1c1988e34a698149f50bdeedc5ae4f26aea6972a414b245c2
SHA512edd206415d5a4662e560c02f16142a241356aa24ff22d20fb2ee458820bc34fd581c425b5c00c1699538820f385c64338e369dedf92b6171f425669ef25492f5
-
Filesize
6KB
MD5d8e4187a5d1142af459fc1a1ca6ef917
SHA179afbdbb40d5ca3c0deb2d4771cdf6bc4cf5add2
SHA256364e530f0f5013ec13ee5375394e5bb7d73f5a7e872b2a2edbf3f93fcb89b62c
SHA512ca6311a84d9de59904a730d81495d774838a4b8d1dd23742850fc37dfcfdcaa0ef57ab00ca1a18f5f5106fc0955216a2b1b59e55120f2e1b832f81745063f903
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5bea00ad127eb72308ad657bfd16106d1
SHA1c0239ace90b8dbc7070d661d22e50c2a7b22a1fc
SHA256f06b08e03fa1d99bf50bf0f0c2593b823fda11cd55aa346735470cd62104ffdf
SHA51208d361561030f8a4bd0443f0a85e7cb76097164f7d91ffefa79a746640392d6193e56cc5357be03add815eafbe19ff76d9a85de8e826906b43c2079a139aafda
-
Filesize
12KB
MD5de234e43113d3bb6ebc4f60576887346
SHA131f4cd0bfd78d71ba24efd541b341e8378b8e2ab
SHA256af59248ad66f6b7a9bb99a600843c679127c968ac513398d25f309c4e741c794
SHA5122693e3af7439f8d2d31a0aca8db7a6568b259cc153621ecaf64f10093214da92d07c7b8410bcd2fbff8b6810f6de4b44781e71cb166d26b51dbfe3963c486585
-
Filesize
12KB
MD521ec83709f31999e8aca0c60e53da193
SHA12e5b169bc35aef6c53cf49363d529c2c9f430e7f
SHA25614d654339961be7f48cadcdbf0e267edf1613cbd46a2f963256797b847af91ff
SHA512c4dd1c096bb1c7071654c04ff4ba32da2a21c35233e29b2947e580533b5b2d1cb49f3a5736823033c1e27980e459e0470b24370d8e7c84caee547907cefd83e4
-
Filesize
924KB
MD5848164d084384c49937f99d5b894253e
SHA13055ef803eeec4f175ebf120f94125717ee12444
SHA256f58d3a4b2f3f7f10815c24586fae91964eeed830369e7e0701b43895b0cefbd3
SHA512aabe1cf076f48f32542f49a92e4ca9f054b31d5a9949119991b897b9489fe775d8009896408ba49ac43ec431c87c0d385daead9dbbde7ef6309b0c97bbaf852a
-
Filesize
189KB
MD5adaa3e9345a5644550f8c95d4ab9eba3
SHA1b471fd5ef36800d0f594f34f02e96ef2f7cbe8a3
SHA25661e1b4014a95d9a5868c09a97dc0c985b02cc88066299623933849d6b9a21ba3
SHA512bc37259d92dc56345e913b53777c0796741ed3c93e74ba59507a420a9c706e14f7e59035cd9b225f44e175bae1748d4683a8cfcd23f87e6beeff937cabec67fa
-
Filesize
153KB
MD5ecd16ed788078d8cf91bd427b9739a18
SHA1a17b528532a4b3154febda47d5a6d746b942a27b
SHA256830eb87335692e6ad866430f2d668870f238a5e7ebbdcba2072ee1276c7e2d38
SHA512e73011a841aa4113c28f9a4676b8a771b942c82ad5717dff11fb11c6f525c1e22e517f90e5009751b1436380c305efd459d3cebc302781199ecdd8c8a165c7d7
-
Filesize
795KB
MD5b1e54bbe902188fb38fa469d7655ffc3
SHA1205989ff551d5d3197ce6d9a8734cb6e6b659d3d
SHA256cb087d44317a0017057b5ffd33c31f38fadd45f1ebb9affafddc4bfea3721e7e
SHA51285f6298b38da5d34017691d073fede246d05fa9a7194a6539e6e91d9a5d0154c0fc4f513c5d2c7c62586cead61ad2eb84b72228df0cbec954f1edd9451db8e53
-
Filesize
147KB
MD5ed93aa85c89f05eaa63aeea04ceeceaf
SHA1861f2be2f33557dd47256a0a2e057fad4139c2a9
SHA256062b93af7598e9b3fd076ae10e18cf5bcd19c45a6e04c845c181c89c026d42e5
SHA51266601259a8420ea5551e0b90dbad17d6ada8e4a848387668e742a2329f8e3ff8d57436d5ed1878918aa9c4a43d79469fa564bf965b1b3f652bf2025056b775b6
-
Filesize
254KB
MD585c5b5f54e8d918efa87636275645e0b
SHA1af79045c5d62883d02fc0ccf8e558fd3b7ad4a23
SHA256caead60155d1e2a6e1334a4e770c06c1d1efcb7639877dbcf09a6fa2776168cd
SHA512d1849e7d8413c18ee85cf44a244ac96c03c60f15f7549ba52db263b7110ef1356e2d6f620983dccc4fa289799017b2301a19b6650a8df921b36347a0a224af25
-
Filesize
11KB
MD5623a43a8bff93300e77926ac164245ac
SHA1a8d4d0ab27170961d2f238b8a6f335727a70c91f
SHA2563a353e9b3e8d7d1d2965847f682e05c2d9f95a38adac530111b463991954f1c8
SHA5126d58d9571da22b331d9ddf2d8220f0d8a8cd45ede0037130bc160a9886469b4cf1038bba7312d736d370f9180ab79c91654e4f010ab8020b4831fc9229132cd4
-
Filesize
181KB
MD5af33e74c3c58fb10fc6e312f963087d3
SHA190aa37a6233e0b432b09a502019a0fe4b8230e6d
SHA25658243a55625ddec54c56fd57cd53a7662635960f11460a0fb34075885b7a492e
SHA512e871a80327f363c9547e001dd63a61f796f769b48717cdd10f837fc403e11cc9ece976762dbef3f9d02ab3086a5cea85729f347c87a33b4cc805acacb866a635
-
Filesize
945KB
MD5241b2fe38c819f11f2e719e5b8452fb1
SHA1751c294d3a51984a451bfd8108899ec849f034c0
SHA256e85c7ed526919f9c41a02204f2818054ad710553ff4b277a2478d418296097f7
SHA5126368ab600ac9c85f186c779470b13220deda49bf048aca4c1d7531f8606fe24b183ffeb3556edd71353a24661941ea5f5518b5675193375a3d8ef1e8ff5816b0
-
Filesize
21.9MB
MD5cf31a0de06659289a74e54a9dfe59ef7
SHA1eaf66ed13043a69c6c226d8ec7d01abb4d1e011f
SHA25606309214de76bdb04ff3e9b6791c0d582708b0922b7391b9445aa546aab5aafd
SHA512132e08dbb48393a92733294f373d7cfb78d6d2c62ffcdd78d2bb4015920ec085d77ec1bad97a756def5f94ee6ce548ad5412df07aa96c59fd5335c9a2ba7d8bd
-
Filesize
15.6MB
MD5d3cc49ca40d22fff1ae015751a1fcb85
SHA1377de74db32bcabed9f4fc1701c68c5092b674d0
SHA25691d8c628229104ac96acd76bbfd29d5db9c16e9c4cd65bae61b217e906e4798f
SHA51212cfb7b812776f6cce6d36eb2f822c259da927e6f099733c51771e18abd58faba86ed734f5ce68939d28a6c2d3462e32facace227a3de88437c8b2e19bd677d7
-
Filesize
64.9MB
MD5944bc1c9c412d278438ebbf0a81c7a55
SHA18a607044c9210b97972d08929cef2c1779378fcb
SHA2562bc34322c191767fbca1dd4d6e51e316fd8b55933d41babab897d0df93457430
SHA5128f22220b4d4ef8e407abd4971b692e77cf4f60b9885c3040519925f6a8bcafd13aea0e95fdddf4206389e8a234aee582ad31640f9b1e3ad888c0eb008a15bc29
-
Filesize
52.2MB
MD537dae62cd2296c98aee90cd21b8299d9
SHA1fd0818f23eb6a11f819016ba9e6f0722503c9109
SHA256355dfeee114071ed8481f6958499cc7700f5494fe7827da08ee96dafbd61771b
SHA5126fb0bd9a3e53a2df0f59e436e7e44b7dd8d51ca527bff6473d074154571fdb9560f8b1022fd142e1f9b290930798d0cc876e352ac68188e8af101f51ee896319
-
Filesize
153B
MD51e9d8f133a442da6b0c74d49bc84a341
SHA1259edc45b4569427e8319895a444f4295d54348f
SHA2561a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b
SHA51263d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e