umbral | 201a386a234c81aaa41843a793e6cdbd0b0a62d7508c36a503136dabe7fa4936

Analysis

max time kernel
158s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25-03-2024 22:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eebe48.html
Size

9KB
MD5

7ddc48b7cc8870499f6e5aaeab995aa1
SHA1

83f3b9e365d60e8aed3e52919fdb9ebf14b5b2b2
SHA256

201a386a234c81aaa41843a793e6cdbd0b0a62d7508c36a503136dabe7fa4936
SHA512

2fb41f45fe397b07117cb09164418de1171aa47bab92fed5f76ec9d479b1b6cf2ddb21cca690a4949ffd083693dfdcb8d172fa926a9b43dd8e284acdb74d2be2
SSDEEP

192:ouWtT+DWDbSLlLsLxLWq7qLvLvLgTLeLXLPcLbL+LPdQoFnwkjuVfUV/pCL3Gmp5:ouWtT+DWDbSpYV4zTkTKTjc/KDdtnViB

Score

10^/10

umbral stealer

Malware Config

Signatures

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral2/files/0x00070000000232cc-232.dat	family_umbral
behavioral2/memory/5552-272-0x000001A5790B0000-0x000001A57910E000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Downloads MZ/PE file

Executes dropped EXE 7 IoCs

pid	Process
5552	pyinstaller.exe
3424	pyinstaller.exe
1632	pyinstaller.exe
1436	pyinstaller.exe
5880	pyinstaller.exe
5228	pyinstaller.exe
5940	pyinstaller.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 925441.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2840	msedge.exe
2840	msedge.exe
1296	msedge.exe
1296	msedge.exe
4596	identity_helper.exe
4596	identity_helper.exe
60	msedge.exe
60	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	5996	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5996	AUDIODG.EXE
Token: SeDebugPrivilege	5552	pyinstaller.exe
Token: SeIncreaseQuotaPrivilege	2540	wmic.exe
Token: SeSecurityPrivilege	2540	wmic.exe
Token: SeTakeOwnershipPrivilege	2540	wmic.exe
Token: SeLoadDriverPrivilege	2540	wmic.exe
Token: SeSystemProfilePrivilege	2540	wmic.exe
Token: SeSystemtimePrivilege	2540	wmic.exe
Token: SeProfSingleProcessPrivilege	2540	wmic.exe
Token: SeIncBasePriorityPrivilege	2540	wmic.exe
Token: SeCreatePagefilePrivilege	2540	wmic.exe
Token: SeBackupPrivilege	2540	wmic.exe
Token: SeRestorePrivilege	2540	wmic.exe
Token: SeShutdownPrivilege	2540	wmic.exe
Token: SeDebugPrivilege	2540	wmic.exe
Token: SeSystemEnvironmentPrivilege	2540	wmic.exe
Token: SeRemoteShutdownPrivilege	2540	wmic.exe
Token: SeUndockPrivilege	2540	wmic.exe
Token: SeManageVolumePrivilege	2540	wmic.exe
Token: 33	2540	wmic.exe
Token: 34	2540	wmic.exe
Token: 35	2540	wmic.exe
Token: 36	2540	wmic.exe
Token: SeIncreaseQuotaPrivilege	2540	wmic.exe
Token: SeSecurityPrivilege	2540	wmic.exe
Token: SeTakeOwnershipPrivilege	2540	wmic.exe
Token: SeLoadDriverPrivilege	2540	wmic.exe
Token: SeSystemProfilePrivilege	2540	wmic.exe
Token: SeSystemtimePrivilege	2540	wmic.exe
Token: SeProfSingleProcessPrivilege	2540	wmic.exe
Token: SeIncBasePriorityPrivilege	2540	wmic.exe
Token: SeCreatePagefilePrivilege	2540	wmic.exe
Token: SeBackupPrivilege	2540	wmic.exe
Token: SeRestorePrivilege	2540	wmic.exe
Token: SeShutdownPrivilege	2540	wmic.exe
Token: SeDebugPrivilege	2540	wmic.exe
Token: SeSystemEnvironmentPrivilege	2540	wmic.exe
Token: SeRemoteShutdownPrivilege	2540	wmic.exe
Token: SeUndockPrivilege	2540	wmic.exe
Token: SeManageVolumePrivilege	2540	wmic.exe
Token: 33	2540	wmic.exe
Token: 34	2540	wmic.exe
Token: 35	2540	wmic.exe
Token: 36	2540	wmic.exe
Token: SeDebugPrivilege	3424	pyinstaller.exe
Token: SeIncreaseQuotaPrivilege	1512	wmic.exe
Token: SeSecurityPrivilege	1512	wmic.exe
Token: SeTakeOwnershipPrivilege	1512	wmic.exe
Token: SeLoadDriverPrivilege	1512	wmic.exe
Token: SeSystemProfilePrivilege	1512	wmic.exe
Token: SeSystemtimePrivilege	1512	wmic.exe
Token: SeProfSingleProcessPrivilege	1512	wmic.exe
Token: SeIncBasePriorityPrivilege	1512	wmic.exe
Token: SeCreatePagefilePrivilege	1512	wmic.exe
Token: SeBackupPrivilege	1512	wmic.exe
Token: SeRestorePrivilege	1512	wmic.exe
Token: SeShutdownPrivilege	1512	wmic.exe
Token: SeDebugPrivilege	1512	wmic.exe
Token: SeSystemEnvironmentPrivilege	1512	wmic.exe
Token: SeRemoteShutdownPrivilege	1512	wmic.exe
Token: SeUndockPrivilege	1512	wmic.exe
Token: SeManageVolumePrivilege	1512	wmic.exe
Token: 33	1512	wmic.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 3052	1296	msedge.exe	88
PID 1296 wrote to memory of 3052	1296	msedge.exe	88
PID 1296 wrote to memory of 4188	1296	msedge.exe	89
PID 1296 wrote to memory of 4188	1296	msedge.exe	89
PID 1296 wrote to memory of 4188	1296	msedge.exe	89
PID 1296 wrote to memory of 4188	1296	msedge.exe	89
PID 1296 wrote to memory of 4188	1296	msedge.exe	89
PID 1296 wrote to memory of 4188	1296	msedge.exe	89
PID 1296 wrote to memory of 4188	1296	msedge.exe	89
PID 1296 wrote to memory of 4188	1296	msedge.exe	89
PID 1296 wrote to memory of 4188	1296	msedge.exe	89
PID 1296 wrote to memory of 4188	1296	msedge.exe	89
PID 1296 wrote to memory of 4188	1296	msedge.exe	89
PID 1296 wrote to memory of 4188	1296	msedge.exe	89
PID 1296 wrote to memory of 4188	1296	msedge.exe	89
PID 1296 wrote to memory of 4188	1296	msedge.exe	89
PID 1296 wrote to memory of 4188	1296	msedge.exe	89
PID 1296 wrote to memory of 4188	1296	msedge.exe	89
PID 1296 wrote to memory of 4188	1296	msedge.exe	89
PID 1296 wrote to memory of 4188	1296	msedge.exe	89
PID 1296 wrote to memory of 4188	1296	msedge.exe	89
PID 1296 wrote to memory of 4188	1296	msedge.exe	89
PID 1296 wrote to memory of 4188	1296	msedge.exe	89
PID 1296 wrote to memory of 4188	1296	msedge.exe	89
PID 1296 wrote to memory of 4188	1296	msedge.exe	89
PID 1296 wrote to memory of 4188	1296	msedge.exe	89
PID 1296 wrote to memory of 4188	1296	msedge.exe	89
PID 1296 wrote to memory of 4188	1296	msedge.exe	89
PID 1296 wrote to memory of 4188	1296	msedge.exe	89
PID 1296 wrote to memory of 4188	1296	msedge.exe	89
PID 1296 wrote to memory of 4188	1296	msedge.exe	89
PID 1296 wrote to memory of 4188	1296	msedge.exe	89
PID 1296 wrote to memory of 4188	1296	msedge.exe	89
PID 1296 wrote to memory of 4188	1296	msedge.exe	89
PID 1296 wrote to memory of 4188	1296	msedge.exe	89
PID 1296 wrote to memory of 4188	1296	msedge.exe	89
PID 1296 wrote to memory of 4188	1296	msedge.exe	89
PID 1296 wrote to memory of 4188	1296	msedge.exe	89
PID 1296 wrote to memory of 4188	1296	msedge.exe	89
PID 1296 wrote to memory of 4188	1296	msedge.exe	89
PID 1296 wrote to memory of 4188	1296	msedge.exe	89
PID 1296 wrote to memory of 4188	1296	msedge.exe	89
PID 1296 wrote to memory of 2840	1296	msedge.exe	90
PID 1296 wrote to memory of 2840	1296	msedge.exe	90
PID 1296 wrote to memory of 4028	1296	msedge.exe	91
PID 1296 wrote to memory of 4028	1296	msedge.exe	91
PID 1296 wrote to memory of 4028	1296	msedge.exe	91
PID 1296 wrote to memory of 4028	1296	msedge.exe	91
PID 1296 wrote to memory of 4028	1296	msedge.exe	91
PID 1296 wrote to memory of 4028	1296	msedge.exe	91
PID 1296 wrote to memory of 4028	1296	msedge.exe	91
PID 1296 wrote to memory of 4028	1296	msedge.exe	91
PID 1296 wrote to memory of 4028	1296	msedge.exe	91
PID 1296 wrote to memory of 4028	1296	msedge.exe	91
PID 1296 wrote to memory of 4028	1296	msedge.exe	91
PID 1296 wrote to memory of 4028	1296	msedge.exe	91
PID 1296 wrote to memory of 4028	1296	msedge.exe	91
PID 1296 wrote to memory of 4028	1296	msedge.exe	91
PID 1296 wrote to memory of 4028	1296	msedge.exe	91
PID 1296 wrote to memory of 4028	1296	msedge.exe	91
PID 1296 wrote to memory of 4028	1296	msedge.exe	91
PID 1296 wrote to memory of 4028	1296	msedge.exe	91
PID 1296 wrote to memory of 4028	1296	msedge.exe	91
PID 1296 wrote to memory of 4028	1296	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eebe48.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd5a1d46f8,0x7ffd5a1d4708,0x7ffd5a1d4718
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,16734362635020248962,932821382060752045,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,16734362635020248962,932821382060752045,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,16734362635020248962,932821382060752045,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16734362635020248962,932821382060752045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16734362635020248962,932821382060752045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,16734362635020248962,932821382060752045,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,16734362635020248962,932821382060752045,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16734362635020248962,932821382060752045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16734362635020248962,932821382060752045,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16734362635020248962,932821382060752045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16734362635020248962,932821382060752045,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16734362635020248962,932821382060752045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16734362635020248962,932821382060752045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1792 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16734362635020248962,932821382060752045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:5816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2096,16734362635020248962,932821382060752045,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3416 /prefetch:8
  2⤵
  PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16734362635020248962,932821382060752045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2096,16734362635020248962,932821382060752045,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16734362635020248962,932821382060752045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2096,16734362635020248962,932821382060752045,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6736 /prefetch:8
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,16734362635020248962,932821382060752045,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6864 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:60
- C:\Users\Admin\Downloads\pyinstaller.exe
  "C:\Users\Admin\Downloads\pyinstaller.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5552
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2540
- C:\Users\Admin\Downloads\pyinstaller.exe
  "C:\Users\Admin\Downloads\pyinstaller.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3424
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1512
- C:\Users\Admin\Downloads\pyinstaller.exe
  "C:\Users\Admin\Downloads\pyinstaller.exe"
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,16734362635020248962,932821382060752045,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3808 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16734362635020248962,932821382060752045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2600 /prefetch:1
  2⤵
  PID:564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:60

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x154 0x4fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5996

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4496

C:\Users\Admin\Downloads\pyinstaller.exe
"C:\Users\Admin\Downloads\pyinstaller.exe"
1⤵
- Executes dropped EXE
PID:1436
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:4432

C:\Users\Admin\Downloads\pyinstaller.exe
"C:\Users\Admin\Downloads\pyinstaller.exe"
1⤵
- Executes dropped EXE
PID:5880
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:4392

C:\Users\Admin\Downloads\pyinstaller.exe
"C:\Users\Admin\Downloads\pyinstaller.exe"
1⤵
- Executes dropped EXE
PID:5228
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:5952

C:\Users\Admin\Downloads\pyinstaller.exe
"C:\Users\Admin\Downloads\pyinstaller.exe"
1⤵
- Executes dropped EXE
PID:5940
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:5788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\pyinstaller.exe.log

Filesize
1KB

MD5
8094b248fe3231e48995c2be32aeb08c

SHA1
2fe06e000ebec919bf982d033c5d1219c1f916b6

SHA256
136c30d964f4abbb5279bdc86d0e00578333782f15f05f0d2d050730dcb7a9bc

SHA512
bf27a3822008796370e2c506c910a40992b9240606ea1bc19f683b2fee86b81897660ac0cf8e746ca093dae9e408949e2e9002ded75678a69f020d3b0452801f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36bb45cb1262fcfcab1e3e7960784eaa

SHA1
ab0e15841b027632c9e1b0a47d3dec42162fc637

SHA256
7c6b0de6f9b4c3ca1f5d6af23c3380f849825af00b58420b76c72b62cfae44ae

SHA512
02c54c919f8cf3fc28f5f965fe1755955636d7d89b5f0504a02fcd9d94de8c50e046c7c2d6cf349fabde03b0fbbcc61df6e9968f2af237106bf7edd697e07456

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1e3dc6a82a2cb341f7c9feeaf53f466f

SHA1
915decb72e1f86e14114f14ac9bfd9ba198fdfce

SHA256
a56135007f4dadf6606bc237cb75ff5ff77326ba093dff30d6881ce9a04a114c

SHA512
0a5223e8cecce77613b1c02535c79b3795e5ad89fc0a934e9795e488712e02b527413109ad1f94bbd4eb35dd07b86dd6e9f4b57d4d7c8a0a57ec3f7f76c7890a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
98281a57eb8b829d1a02ed79834fa53c

SHA1
e982812889f6a3c40f27f54c643ea8b02fe388cf

SHA256
d17846491cf99ff2be41f9930a89cba6ba3f185b86aa4bdbc8bb5e7f0dced12f

SHA512
8ffbfbbc010d365f139d29a4cbdca234134541aa24c7e928cc8de6bf4046242e71a82a3ff11ac0a5f2fac8f578c286e2e8b69eeca5a86236d20688309ae9b852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
164414460ad4f21690c0f05a99eab7ae

SHA1
86c5472096ce8358cdaa556ea20e2e758e30ab2c

SHA256
cc80d58348b6469260ea9e4d8d4914621dae9e5426260cfd17e6015c642c079c

SHA512
f68226bd37c4d6673ce5fd16d9147286ab05d75a57f836b6b2e0f5daa3ba19e24bc7e5f4b04284a3f0267de4249675458233ff649bd6aa03ac02afec4d6123ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
5a074d49f661a364a7270920a38b2ee9

SHA1
60019d1afc17aa77b2337049daf665053e1fe69e

SHA256
194a270c8c032fbc5633ccda2e35259229020a34725f2c3e7395d12d54d6f747

SHA512
98d628116c3d88a89386b504ce7e305557aaed359a7acd3723f4b46a89b72a47faf47d076e4440d0ed2a05b53928c4c22b6effeb6b895febd4c3c561dc0ad6dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
13442fb09f2764efe4d0040192362c87

SHA1
f8e100220f8da51aa1ab7d02225c7b9f1651587d

SHA256
ff74802f79d431d6ed6375273ee68039e024539b960e7d74e679e5934324544d

SHA512
5d937e5fe3c67604ecdd1ab878b1b9718983677758ed2fbed90f909992bc661c10c79c76a5abddb751395d5d3e89b18e1faf13c6fbb79cd6b89fdd7019760551

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
4e7969eb682ca239e053751963ea233e

SHA1
66d4b2a737527908f23e199dbcde4dc78454a10b

SHA256
f5ceded45e173ac04853dc4acb9c67c5e21092db79b218840ce6df1eefac21f5

SHA512
126f9a268703d9bf0d4e13df12c2539532a5e7dc18d4339735e450767d08dbcbad510e0d17957a6356c2199cd2d856dedee039217ee24f3aa16987635fb9f9a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9a8d8beea228bcb244957a1739f4c3a0

SHA1
458bd811a92db47e5dc5083ef61fd3a3669292fb

SHA256
089c8b3c40ed43c7df0fcb26aae55804e606bd84fbeab0dc529472b4222508f3

SHA512
0621d2b453127dd757eb71c11f0c162f6033072ba72ae58788786e1ab5ce4ac25b49ebec0afa74f3065c727e48e792534948a1dc6fcfc0def7520220e96dbcc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
40bd62b449d3384bdf7076ba0db8b3dd

SHA1
7fafd74003f4caca98e54ddc54cdf117770745cb

SHA256
1eb34dfa005a7a8a2b843c8b812feeb2a5c01f831e7e05eefa7269f0141895ed

SHA512
cf85911fd05ff6736f711e232df61d08e5102b3853fe741b09e5fabc2a53e749057bfd1bca223eaa628b00bed1e5550821df844cd7327570635118ddcc039970

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
ece6e67b90b20ccbfbfe7c53a5410f8e

SHA1
69fbda5670de329b1f4d842159bbe986ae46c661

SHA256
3cbf56ddf9754fdb63cc81f930a1a4f9ff6bfeb56b635bde3fdb15d46c5f4a74

SHA512
3898f04550d7c3e8f656faa1c0ffa5bab0f279a33d0c43c7169722a0936eebd99b2251a345c9aeeb77d9fc44e6334e699ea337f9bca85b4a8d8b3ed7b27cf29c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
393e15426f65624cea2d757f26f171ec

SHA1
1053831d4dd517d0a7048bbc881b5e5fe81475c5

SHA256
d1b5c2c5838ed5ccf39aae33294484dffa60e590657df52ca268e055f5e70b81

SHA512
272f4ebe34075ee0d0b39f1086436579ede975b6fceea916bfc0e3fbd6d49d0885341fa5b155840f9d605185129d6af8eff777bb5ff4c31ddd51118c8f4c749e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe587d88.TMP

Filesize
538B

MD5
9f5887aeccd905573cbe7573c0e52924

SHA1
566fc76ea7de82fa40d05c181febd255949c197b

SHA256
54a327d4c55fa58c9805c72162bddb77268615cfa76e1311612ee3234d7323ca

SHA512
24f70f73f8d2fc0c161f5c4f379f8746fe5dc251ffd1502bbc3e3f7ed1323ab256c2f476a35b65b14b02dcf912f895fe50538d20f98e049ed9eb061d739c81e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
354b438191878fe177554f4aae393462

SHA1
94766a358b015138f8082fc80373fa1919c86f7a

SHA256
e03529f4b4a91d5e613c2a3e274716d6bc22736cf52d8b08f058493885a43ce2

SHA512
660f4c7cef292ca6ee0b808a0f3f0773cbfe1cc4cd546c9596a6050149b2d6e1cb41276ddad5c9a83f9228bc6c57a2dd95f1ec4bcd25afe21b143ecc3ce2a816

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c842ea4ee70e731d4ac81da725ce1865

SHA1
2837b43a59a11aa5f7e872b8e5bf810ccd82143f

SHA256
f4ce9071e6d2819eef5a6f227d2e2b05b3f5b817dc5393371a234f1d7d80b151

SHA512
00946a59e4cd8c78c077e7ec2f96839417eba306acd8c344fa068a2178daf9d159e07c4b6f651523218502cd4720b137f16a2bcbe4a6674766bdae38de442643

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b38ecb40015cd84e5536e6b6e083f65f

SHA1
55013e36bc3871cf8a48600caca6a279cae97fbe

SHA256
967bdb8faf60879a799b3a63e07625b5d8b838c2ec966349f81fdc4accf24f62

SHA512
5b0011b290a236e06e1107ba4c5d76b9b5b15ef4d5b3b6d91f916ed4f07b08a82e660081e2d09cbb8a7f0136a132ca20890a568894d3b901859bc951a7ce324f

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 925441.crdownload

Filesize
357KB

MD5
d014a838bc800b97e4b1ae1ef650b339

SHA1
ef15d1d33a04f335432b850ac14e266fc6055ead

SHA256
cafaa8022c8841200be431b049e04d8cef888ad716ec5aeea9474e050071283b

SHA512
9ed522e9ecd3bd29c8906f48af157febf3e0d62fb56772d47c9bc4930de031b0f87ad14741cd3b53a2e0fd8b967c7b84767e23658768a98a46e4a426e8749269

Download Submit
memory/1436-324-0x00007FFD462D0000-0x00007FFD46D91000-memory.dmp

Filesize
10.8MB

Download
memory/1436-326-0x00007FFD462D0000-0x00007FFD46D91000-memory.dmp

Filesize
10.8MB

Download
memory/1436-325-0x0000019CCF0D0000-0x0000019CCF0E0000-memory.dmp

Filesize
64KB

Download
memory/1632-333-0x00007FFD46380000-0x00007FFD46E41000-memory.dmp

Filesize
10.8MB

Download
memory/1632-321-0x00007FFD46380000-0x00007FFD46E41000-memory.dmp

Filesize
10.8MB

Download
memory/3424-322-0x00007FFD46380000-0x00007FFD46E41000-memory.dmp

Filesize
10.8MB

Download
memory/3424-319-0x000002AF222A0000-0x000002AF222B0000-memory.dmp

Filesize
64KB

Download
memory/3424-318-0x00007FFD46380000-0x00007FFD46E41000-memory.dmp

Filesize
10.8MB

Download
memory/5228-336-0x00007FFD462D0000-0x00007FFD46D91000-memory.dmp

Filesize
10.8MB

Download
memory/5228-334-0x00007FFD462D0000-0x00007FFD46D91000-memory.dmp

Filesize
10.8MB

Download
memory/5228-335-0x000001D5291A0000-0x000001D5291B0000-memory.dmp

Filesize
64KB

Download
memory/5552-285-0x00007FFD462D0000-0x00007FFD46D91000-memory.dmp

Filesize
10.8MB

Download
memory/5552-274-0x000001A57B750000-0x000001A57B760000-memory.dmp

Filesize
64KB

Download
memory/5552-273-0x00007FFD462D0000-0x00007FFD46D91000-memory.dmp

Filesize
10.8MB

Download
memory/5552-272-0x000001A5790B0000-0x000001A57910E000-memory.dmp

Filesize
376KB

Download
memory/5880-331-0x00007FFD462D0000-0x00007FFD46D91000-memory.dmp

Filesize
10.8MB

Download
memory/5880-328-0x00007FFD462D0000-0x00007FFD46D91000-memory.dmp

Filesize
10.8MB

Download
memory/5940-341-0x00007FFD46380000-0x00007FFD46E41000-memory.dmp

Filesize
10.8MB

Download
memory/5940-355-0x00007FFD46380000-0x00007FFD46E41000-memory.dmp

Filesize
10.8MB

Download