lumma | hxxps://blackmagicpartners[.]com/

Resubmissions

25-04-2024 08:41

240425-klw9ashb87 10

25-04-2024 08:38

240425-kjprfahb71 7

Analysis

max time kernel
295s
max time network
278s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
25-04-2024 08:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://blackmagicpartners.com/

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://surpriserangeloggypo.fun/api

https://productivelookewr.shop/api

https://tolerateilusidjukl.shop/api

https://shatterbreathepsw.shop/api

https://shortsvelventysjo.shop/api

https://incredibleextedwj.shop/api

https://alcojoldwograpciw.shop/api

https://liabilitynighstjsko.shop/api

https://demonstationfukewko.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Executes dropped EXE 12 IoCs

Processes:

䕅瘵㍮㜷癸x䕅瘵㍮㜷癸x.exe䕅瘵㍮㜷癸x.exe䕅瘵㍮㜷癸x.exe䕅瘵㍮㜷癸x䕅瘵㍮㜷癸xvirus.exevirus.exevirus.exevirus.exevirus.exe䕅瘵㍮㜷癸x

pid	process
1868	䕅瘵㍮㜷癸x
3100	䕅瘵㍮㜷癸x.exe
5276	䕅瘵㍮㜷癸x.exe
1352	䕅瘵㍮㜷癸x.exe
1468	䕅瘵㍮㜷癸x
5516	䕅瘵㍮㜷癸x
5260	virus.exe
3100	virus.exe
4036	virus.exe
3048	virus.exe
4524	virus.exe
4768	䕅瘵㍮㜷癸x

Suspicious use of SetThreadContext 4 IoCs

Processes:

Davinci Contract.pdf.exeDavinci Contract.pdf.exeDavinci Contract.pdf.exeDavinci Contract.pdf.exe

description	pid	process	target process
PID 5372 set thread context of 1868	5372	Davinci Contract.pdf.exe	䕅瘵㍮㜷癸x
PID 5552 set thread context of 1468	5552	Davinci Contract.pdf.exe	䕅瘵㍮㜷癸x
PID 1092 set thread context of 5516	1092	Davinci Contract.pdf.exe	䕅瘵㍮㜷癸x
PID 5144 set thread context of 4768	5144	Davinci Contract.pdf.exe	䕅瘵㍮㜷癸x

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5972 1868 WerFault.exe 䕅瘵㍮㜷癸x

pid	pid_target	process	target process
5972	1868	WerFault.exe	䕅瘵㍮㜷癸x

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000_Classes\Local Settings msedge.exe
Suspicious behavior: AddClipboardFormatListener 4 IoCs

Processes:

Davinci Contract.pdf.exeDavinci Contract.pdf.exeDavinci Contract.pdf.exeDavinci Contract.pdf.exe

pid process

5372 Davinci Contract.pdf.exe
5552 Davinci Contract.pdf.exe
1092 Davinci Contract.pdf.exe
5144 Davinci Contract.pdf.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000_Classes\Local Settings	msedge.exe

pid	process
5372	Davinci Contract.pdf.exe
5552	Davinci Contract.pdf.exe
1092	Davinci Contract.pdf.exe
5144	Davinci Contract.pdf.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exetaskmgr.exe

pid	process
4180	msedge.exe
4180	msedge.exe
2204	msedge.exe
2204	msedge.exe
4108	identity_helper.exe
4108	identity_helper.exe
4064	msedge.exe
4064	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 5 IoCs

Processes:

Davinci Contract.pdf.exeDavinci Contract.pdf.exeDavinci Contract.pdf.exetaskmgr.exeDavinci Contract.pdf.exe

pid process

5372 Davinci Contract.pdf.exe
5552 Davinci Contract.pdf.exe
1092 Davinci Contract.pdf.exe
5808 taskmgr.exe
5144 Davinci Contract.pdf.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

2204 msedge.exe
2204 msedge.exe
2204 msedge.exe
2204 msedge.exe
2204 msedge.exe
2204 msedge.exe
2204 msedge.exe
2204 msedge.exe

pid	process
5372	Davinci Contract.pdf.exe
5552	Davinci Contract.pdf.exe
1092	Davinci Contract.pdf.exe
5808	taskmgr.exe
5144	Davinci Contract.pdf.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

taskmgr.exe

description	pid	process
Token: SeDebugPrivilege	5808	taskmgr.exe
Token: SeSystemProfilePrivilege	5808	taskmgr.exe
Token: SeCreateGlobalPrivilege	5808	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exeDavinci Contract.pdf.exetaskmgr.exe

pid	process
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
5372	Davinci Contract.pdf.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

msedge.exetaskmgr.exe

pid	process
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe
5808	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2204 wrote to memory of 1504	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 1504	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 5072	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 5072	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 5072	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 5072	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 5072	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 5072	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 5072	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 5072	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 5072	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 5072	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 5072	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 5072	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 5072	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 5072	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 5072	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 5072	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 5072	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 5072	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 5072	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 5072	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 5072	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 5072	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 5072	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 5072	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 5072	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 5072	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 5072	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 5072	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 5072	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 5072	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 5072	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 5072	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 5072	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 5072	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 5072	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 5072	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 5072	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 5072	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 5072	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 5072	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 4180	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 4180	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 4732	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 4732	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 4732	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 4732	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 4732	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 4732	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 4732	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 4732	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 4732	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 4732	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 4732	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 4732	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 4732	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 4732	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 4732	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 4732	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 4732	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 4732	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 4732	2204	msedge.exe	msedge.exe
PID 2204 wrote to memory of 4732	2204	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://blackmagicpartners.com/
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe3c3246f8,0x7ffe3c324708,0x7ffe3c324718
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,1439380352226871289,5647219998888553269,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,1439380352226871289,5647219998888553269,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,1439380352226871289,5647219998888553269,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,1439380352226871289,5647219998888553269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,1439380352226871289,5647219998888553269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,1439380352226871289,5647219998888553269,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,1439380352226871289,5647219998888553269,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,1439380352226871289,5647219998888553269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,1439380352226871289,5647219998888553269,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,1439380352226871289,5647219998888553269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,1439380352226871289,5647219998888553269,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:1
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,1439380352226871289,5647219998888553269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,1439380352226871289,5647219998888553269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2040,1439380352226871289,5647219998888553269,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3432 /prefetch:8
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2040,1439380352226871289,5647219998888553269,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,1439380352226871289,5647219998888553269,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4848 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1628

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3644

C:\Users\Admin\Downloads\[Videoeditor] Contract + Preview 11.04\Davinci Resolve 18\Davinci Contract.pdf.exe
"C:\Users\Admin\Downloads\[Videoeditor] Contract + Preview 11.04\Davinci Resolve 18\Davinci Contract.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:5372
- C:\Users\Admin\AppData\Local\Temp\䕅瘵㍮㜷癸x
  "C:\Users\Admin\AppData\Local\Temp\䕅瘵㍮㜷癸x"
  2⤵
  - Executes dropped EXE
  PID:1868
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 372
    3⤵
    - Program crash
    PID:5972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1868 -ip 1868
1⤵
PID:4508

C:\Users\Admin\AppData\Local\Temp\䕅瘵㍮㜷癸x.exe
"C:\Users\Admin\AppData\Local\Temp\䕅瘵㍮㜷癸x.exe"
1⤵
- Executes dropped EXE
PID:3100

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5808

C:\Users\Admin\AppData\Local\Temp\䕅瘵㍮㜷癸x.exe
"C:\Users\Admin\AppData\Local\Temp\䕅瘵㍮㜷癸x.exe"
1⤵
- Executes dropped EXE
PID:5276

C:\Users\Admin\AppData\Local\Temp\䕅瘵㍮㜷癸x.exe
"C:\Users\Admin\AppData\Local\Temp\䕅瘵㍮㜷癸x.exe"
1⤵
- Executes dropped EXE
PID:1352

C:\Users\Admin\Downloads\[Videoeditor] Contract + Preview 11.04\Davinci Resolve 18\Davinci Contract.pdf.exe
"C:\Users\Admin\Downloads\[Videoeditor] Contract + Preview 11.04\Davinci Resolve 18\Davinci Contract.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:5552
- C:\Users\Admin\AppData\Local\Temp\䕅瘵㍮㜷癸x
  "C:\Users\Admin\AppData\Local\Temp\䕅瘵㍮㜷癸x"
  2⤵
  - Executes dropped EXE
  PID:1468

C:\Users\Admin\Downloads\[Videoeditor] Contract + Preview 11.04\Davinci Resolve 18\Davinci Contract.pdf.exe
"C:\Users\Admin\Downloads\[Videoeditor] Contract + Preview 11.04\Davinci Resolve 18\Davinci Contract.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:1092
- C:\Users\Admin\AppData\Local\Temp\䕅瘵㍮㜷癸x
  "C:\Users\Admin\AppData\Local\Temp\䕅瘵㍮㜷癸x"
  2⤵
  - Executes dropped EXE
  PID:5516

C:\Users\Admin\AppData\Local\Temp\virus.exe
"C:\Users\Admin\AppData\Local\Temp\virus.exe"
1⤵
- Executes dropped EXE
PID:5260

C:\Users\Admin\AppData\Local\Temp\virus.exe
"C:\Users\Admin\AppData\Local\Temp\virus.exe"
1⤵
- Executes dropped EXE
PID:3100

C:\Users\Admin\AppData\Local\Temp\virus.exe
"C:\Users\Admin\AppData\Local\Temp\virus.exe"
1⤵
- Executes dropped EXE
PID:4036

C:\Users\Admin\AppData\Local\Temp\virus.exe
"C:\Users\Admin\AppData\Local\Temp\virus.exe"
1⤵
- Executes dropped EXE
PID:3048

C:\Users\Admin\AppData\Local\Temp\virus.exe
"C:\Users\Admin\AppData\Local\Temp\virus.exe"
1⤵
- Executes dropped EXE
PID:4524

C:\Users\Admin\Downloads\[Videoeditor] Contract + Preview 11.04\Davinci Resolve 18\Davinci Contract.pdf.exe
"C:\Users\Admin\Downloads\[Videoeditor] Contract + Preview 11.04\Davinci Resolve 18\Davinci Contract.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:5144
- C:\Users\Admin\AppData\Local\Temp\䕅瘵㍮㜷癸x
  "C:\Users\Admin\AppData\Local\Temp\䕅瘵㍮㜷癸x"
  2⤵
  - Executes dropped EXE
  PID:4768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5e2f0fe48e7ee1aad1c24db5c01c354a

SHA1
5bfeb862e107dd290d87385dc9369bd7a1006b36

SHA256
f13b3ebe8d71bd0086d5bb82364c35f59a95d32b39753af251e8639360e291a9

SHA512
140d026437fd5e8a874cd00b03950c8f010e1a0732a0a1cc5bdde477e7f8315ccb95790bb4c15b8dbaab9468ad532eb885b6c429300a64e39412d976d079324e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7e0880992c640aca08737893588a0010

SHA1
6ceec5cb125a52751de8aeda4bab7112f68ae0fe

SHA256
8649a39877c190ec740a5422284ec5f9ff509b30b2d7896635476873dd8824e2

SHA512
52bd0a38ca7f43b26731966035045b1cbd8b60b2d81bdf9aad791cf444da8af8b722ebf3cb364a6e660bebdf23084eb0e30bc23562575b704801669817549f8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
7e6ff5d3a33c68f9e9606ff7d8aa4719

SHA1
251ff242f0a1c4145972dcb5059d2c3df477e3e1

SHA256
bf2cfbdead72f48635062243eea35e1d3bfffc6e360493f50af44bcc26648ad8

SHA512
ae902c62dbeef45dc3b5f7d6e02dc71bb5633f48017f929694a35663d5f3a024e537b5208f56e665a504ae5c2c42384acf7cfb13cc57fc8dde9c6ee2e9ad5854

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
601B

MD5
1e0cc0981d52484220b66c379f8fb8bc

SHA1
e888c3ac2b76724f3e9b4c11733a754a42164ca5

SHA256
49755759a73dff70dbdd1cd212d517134a9ec26f5b3aa585a735f8c491b026d4

SHA512
0addd5ab285d1a780aa1e9ff39355f799bcbd4ac80e684810d91abf5777964b7009b434efee517044fab3178ffaf328f724b38a953ac610d5df92febc9dcf5ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
86a0a4b71ed1bfe1b0a5ca4d60f9df69

SHA1
41c8a790039218afdbd7f18d0038ae6dfac9ac5a

SHA256
09d1ed8332498b0b52b1f255109fa8f7bbae6ad20c77ebe3f8c43d5417b891b9

SHA512
ac1f3f15ef17477ad366d51b0badcb4223aaf525f98c849482651d59c02eb55e51c18f444be46fa4f0576c21ed5de00ac450235bcf96105bdc66e9fc28efd108

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
22988af24d1ca8df1952e1cea176efdf

SHA1
efac1a8882bcf63084f96a0eaba8d86f8f4ee304

SHA256
9ab2ea1a67d106820d5297520df495ba771f14ac5933db3b0c875fe60c0799c0

SHA512
549bf3786b5f5720e58485352129df5a91ec74e1ef3c948c2d614d08cb1dbf152bfdc62a7ec42af5025f9e4004d5ea3f18592798ca8d55dad931d8e2f4c69bd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
82a8cffa26f0b9224c12ba7d1fb6c38d

SHA1
f0ee4e8171192654162d5bf04ee725f211a04eed

SHA256
c3ca5fa01bcdc3ce406e0bfcb9a846b8a71a7dc825f8591a0f3e9817dbd827c2

SHA512
66560d257a21c6009bffade022c2f625292b9fcca2cf65ef95f7d64c38086fa6b22555204b75ae06230acafb0a35231e2b7a9252945312b64300f3a128813458

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
806736f71db92d39ae81a6ca520d0919

SHA1
4b482d24b82292fbd4e83ff25de49674c20c865c

SHA256
515d1f0372f5ba9114f7465b512b978d988a9f920dc884b1e31fef6a3f3b5719

SHA512
067e63738648d5563e28d9b760dcf3d429135ce3d72334b83188a8c19c9622d4994c7bb24589b73176a8dc74049ef503d3c191427d2604dd9889bc8c1240bdb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fe667afbe539d22e5b916d1027d99e00

SHA1
4db726942d90f04361ab66195f8e6ded5c8e0dd1

SHA256
0ee41e355cddaace77f2f1b473205f60289589abcb6b5dc3f77f2d7e4f00c74c

SHA512
736e05b9e4ab28e4e30e97ebcae9c7463d09caf97d7456a5280045c441f850cdfd37e3dee1f0d696f7f5bce09c80c4d5be0ed3d369d8322a7af60d9b6333074f

Download Submit
C:\Users\Admin\AppData\Local\Temp\䕅瘵㍮㜷癸x

Filesize
38KB

MD5
3992f464696b0eeff236aef93b1fdbd5

SHA1
8dddabaea6b342efc4f5b244420a0af055ae691e

SHA256
0d1a8457014f2eb2563a91d1509dba38f6c418fedf5f241d8579d15a93e40e14

SHA512
27a63b43dc50faf4d9b06e10daa15e83dfb3f3be1bd3af83ea6990bd8ae6d3a6a7fc2f928822db972aaf1305970f4587d768d68cd7e1124bc8f710c1d3ee19a6

Download Submit
\??\pipe\LOCAL\crashpad_2204_ISOGEAGMBSTMMKCA

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1468-237-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1468-239-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1868-199-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1868-201-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1868-195-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4768-262-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/5516-249-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/5516-247-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/5808-217-0x000001A5406B0000-0x000001A5406B1000-memory.dmp

Filesize
4KB

Download
memory/5808-207-0x000001A5406B0000-0x000001A5406B1000-memory.dmp

Filesize
4KB

Download
memory/5808-216-0x000001A5406B0000-0x000001A5406B1000-memory.dmp

Filesize
4KB

Download
memory/5808-219-0x000001A5406B0000-0x000001A5406B1000-memory.dmp

Filesize
4KB

Download
memory/5808-218-0x000001A5406B0000-0x000001A5406B1000-memory.dmp

Filesize
4KB

Download
memory/5808-214-0x000001A5406B0000-0x000001A5406B1000-memory.dmp

Filesize
4KB

Download
memory/5808-215-0x000001A5406B0000-0x000001A5406B1000-memory.dmp

Filesize
4KB

Download
memory/5808-213-0x000001A5406B0000-0x000001A5406B1000-memory.dmp

Filesize
4KB

Download
memory/5808-209-0x000001A5406B0000-0x000001A5406B1000-memory.dmp

Filesize
4KB

Download
memory/5808-208-0x000001A5406B0000-0x000001A5406B1000-memory.dmp

Filesize
4KB

Download