lumma | hxxps://www[.]youtube[.]com/redirect?event=video_description&redir_token=QUFFLUhqbEEwRzliMHRPOENJWEZBdnFDOThkMkEtMDZXd3xBQ3Jtc0trY2tWZ3pvR2gxVUd1TVNSemFpYlFiWFFQV1lZUTJuMFVkNWlOSHlBb2tnQXNMQnNDc1JHeHpGYjBlWG4zSW1jVGZ5NlppQk5qbkpQejlZak5iOHNmV1dEV01WLWx5bXZXUEZOdzV1SVZuUWQ0MktSQQ&q=https%3A%2F%2Fapp[.]mediafire[.]com%2Ff169cqy6jf7l3&v=tYEfOijBLcM

Analysis

max time kernel
266s
max time network
268s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 11:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbEEwRzliMHRPOENJWEZBdnFDOThkMkEtMDZXd3xBQ3Jtc0trY2tWZ3pvR2gxVUd1TVNSemFpYlFiWFFQV1lZUTJuMFVkNWlOSHlBb2tnQXNMQnNDc1JHeHpGYjBlWG4zSW1jVGZ5NlppQk5qbkpQejlZak5iOHNmV1dEV01WLWx5bXZXUEZOdzV1SVZuUWQ0MktSQQ&q=https%3A%2F%2Fapp.mediafire.com%2Ff169cqy6jf7l3&v=tYEfOijBLcM
Sample240703-m6dc2azapd

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://citizencenturygoodwk.shop/api
https://potterryisiw.shop/api
https://foodypannyjsud.shop/api
https://contintnetksows.shop/api
https://reinforcedirectorywd.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3816 set thread context of 1988	3816	SapphireX.exe	136
PID 100 set thread context of 5976	100	SapphireX.exe	137

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5732	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4748	vlc.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
760	msedge.exe
760	msedge.exe
4592	msedge.exe
4592	msedge.exe
1688	identity_helper.exe
1688	identity_helper.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
5176	msedge.exe
5176	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4748	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	1088	svchost.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4748	vlc.exe
4748	vlc.exe
4748	vlc.exe
4748	vlc.exe
4748	vlc.exe
4748	vlc.exe
4748	vlc.exe
4748	vlc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4748	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 4472	4592	msedge.exe	81
PID 4592 wrote to memory of 4472	4592	msedge.exe	81
PID 4592 wrote to memory of 3036	4592	msedge.exe	82
PID 4592 wrote to memory of 3036	4592	msedge.exe	82
PID 4592 wrote to memory of 3036	4592	msedge.exe	82
PID 4592 wrote to memory of 3036	4592	msedge.exe	82
PID 4592 wrote to memory of 3036	4592	msedge.exe	82
PID 4592 wrote to memory of 3036	4592	msedge.exe	82
PID 4592 wrote to memory of 3036	4592	msedge.exe	82
PID 4592 wrote to memory of 3036	4592	msedge.exe	82
PID 4592 wrote to memory of 3036	4592	msedge.exe	82
PID 4592 wrote to memory of 3036	4592	msedge.exe	82
PID 4592 wrote to memory of 3036	4592	msedge.exe	82
PID 4592 wrote to memory of 3036	4592	msedge.exe	82
PID 4592 wrote to memory of 3036	4592	msedge.exe	82
PID 4592 wrote to memory of 3036	4592	msedge.exe	82
PID 4592 wrote to memory of 3036	4592	msedge.exe	82
PID 4592 wrote to memory of 3036	4592	msedge.exe	82
PID 4592 wrote to memory of 3036	4592	msedge.exe	82
PID 4592 wrote to memory of 3036	4592	msedge.exe	82
PID 4592 wrote to memory of 3036	4592	msedge.exe	82
PID 4592 wrote to memory of 3036	4592	msedge.exe	82
PID 4592 wrote to memory of 3036	4592	msedge.exe	82
PID 4592 wrote to memory of 3036	4592	msedge.exe	82
PID 4592 wrote to memory of 3036	4592	msedge.exe	82
PID 4592 wrote to memory of 3036	4592	msedge.exe	82
PID 4592 wrote to memory of 3036	4592	msedge.exe	82
PID 4592 wrote to memory of 3036	4592	msedge.exe	82
PID 4592 wrote to memory of 3036	4592	msedge.exe	82
PID 4592 wrote to memory of 3036	4592	msedge.exe	82
PID 4592 wrote to memory of 3036	4592	msedge.exe	82
PID 4592 wrote to memory of 3036	4592	msedge.exe	82
PID 4592 wrote to memory of 3036	4592	msedge.exe	82
PID 4592 wrote to memory of 3036	4592	msedge.exe	82
PID 4592 wrote to memory of 3036	4592	msedge.exe	82
PID 4592 wrote to memory of 3036	4592	msedge.exe	82
PID 4592 wrote to memory of 3036	4592	msedge.exe	82
PID 4592 wrote to memory of 3036	4592	msedge.exe	82
PID 4592 wrote to memory of 3036	4592	msedge.exe	82
PID 4592 wrote to memory of 3036	4592	msedge.exe	82
PID 4592 wrote to memory of 3036	4592	msedge.exe	82
PID 4592 wrote to memory of 3036	4592	msedge.exe	82
PID 4592 wrote to memory of 760	4592	msedge.exe	83
PID 4592 wrote to memory of 760	4592	msedge.exe	83
PID 4592 wrote to memory of 620	4592	msedge.exe	84
PID 4592 wrote to memory of 620	4592	msedge.exe	84
PID 4592 wrote to memory of 620	4592	msedge.exe	84
PID 4592 wrote to memory of 620	4592	msedge.exe	84
PID 4592 wrote to memory of 620	4592	msedge.exe	84
PID 4592 wrote to memory of 620	4592	msedge.exe	84
PID 4592 wrote to memory of 620	4592	msedge.exe	84
PID 4592 wrote to memory of 620	4592	msedge.exe	84
PID 4592 wrote to memory of 620	4592	msedge.exe	84
PID 4592 wrote to memory of 620	4592	msedge.exe	84
PID 4592 wrote to memory of 620	4592	msedge.exe	84
PID 4592 wrote to memory of 620	4592	msedge.exe	84
PID 4592 wrote to memory of 620	4592	msedge.exe	84
PID 4592 wrote to memory of 620	4592	msedge.exe	84
PID 4592 wrote to memory of 620	4592	msedge.exe	84
PID 4592 wrote to memory of 620	4592	msedge.exe	84
PID 4592 wrote to memory of 620	4592	msedge.exe	84
PID 4592 wrote to memory of 620	4592	msedge.exe	84
PID 4592 wrote to memory of 620	4592	msedge.exe	84
PID 4592 wrote to memory of 620	4592	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbEEwRzliMHRPOENJWEZBdnFDOThkMkEtMDZXd3xBQ3Jtc0trY2tWZ3pvR2gxVUd1TVNSemFpYlFiWFFQV1lZUTJuMFVkNWlOSHlBb2tnQXNMQnNDc1JHeHpGYjBlWG4zSW1jVGZ5NlppQk5qbkpQejlZak5iOHNmV1dEV01WLWx5bXZXUEZOdzV1SVZuUWQ0MktSQQ&q=https%3A%2F%2Fapp.mediafire.com%2Ff169cqy6jf7l3&v=tYEfOijBLcM
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb2a3446f8,0x7ffb2a344708,0x7ffb2a344718
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,10060439259671250913,17960200923709108062,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,10060439259671250913,17960200923709108062,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,10060439259671250913,17960200923709108062,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:8
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10060439259671250913,17960200923709108062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10060439259671250913,17960200923709108062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,10060439259671250913,17960200923709108062,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 /prefetch:8
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,10060439259671250913,17960200923709108062,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10060439259671250913,17960200923709108062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10060439259671250913,17960200923709108062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10060439259671250913,17960200923709108062,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10060439259671250913,17960200923709108062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10060439259671250913,17960200923709108062,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10060439259671250913,17960200923709108062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10060439259671250913,17960200923709108062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10060439259671250913,17960200923709108062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6292 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10060439259671250913,17960200923709108062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10060439259671250913,17960200923709108062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10060439259671250913,17960200923709108062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6788 /prefetch:1
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10060439259671250913,17960200923709108062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7100 /prefetch:1
  2⤵
  PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10060439259671250913,17960200923709108062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6944 /prefetch:1
  2⤵
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10060439259671250913,17960200923709108062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7032 /prefetch:1
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10060439259671250913,17960200923709108062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2016,10060439259671250913,17960200923709108062,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7516 /prefetch:8
  2⤵
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10060439259671250913,17960200923709108062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7504 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,10060439259671250913,17960200923709108062,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6532 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2016,10060439259671250913,17960200923709108062,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7304 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5176

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4556

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5828

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1088

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\SapphireX\HowToUse.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:5732

C:\Users\Admin\Desktop\SapphireX\SapphireX.exe
"C:\Users\Admin\Desktop\SapphireX\SapphireX.exe"
1⤵
- Suspicious use of SetThreadContext
PID:3816
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  PID:1988

C:\Users\Admin\Desktop\SapphireX\SapphireX.exe
"C:\Users\Admin\Desktop\SapphireX\SapphireX.exe"
1⤵
- Suspicious use of SetThreadContext
PID:100
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  PID:5976

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\EnableSet.cmd" "
1⤵
PID:2424

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x41c 0x498
1⤵
PID:2848

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\StepCompress.MTS"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64
MD5 f61fa5143fe872d1d8f1e9f8dc6544f9
SHA1 df44bab94d7388fb38c63085ec4db80cfc5eb009
SHA512 971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262
MD5 87f7abeb82600e1e640b843ad50fe0a1
SHA1 045bbada3f23fc59941bf7d0210fb160cb78ae87
SHA512 ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618
MD5 SHA1 SHA512

Submit Download

f_000020

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000020
Size 62KB
SHA256 c16e012546b3d1ef206a1ecbbb7bf8b5dfd0c13cfeb3bdc8af8c11eaa9da8b84
MD5 1721006aa7e52dafddd68998f1ca9ac0
SHA1 884e3081a1227cd1ed4ec63fb0a98bec572165ba
SHA512 ff7bfd489dc8c5001eea8f823e5ec7abf134e8ad52ee9544a8f4c20800cb67a724ec157ca8f4c434a94262a8e07c3452b6ad994510b2b9118c78e2f53d75a493
SSDEEP 1536:3X8BVXoTLmkCtaqXuzz4PvaRCkcZYAjg+biyOhXDeqwJnlf9EA:3X24mkCtaq+zrsj2AjvHMC5JlOA
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 71077316156fbb0079fcedac2e9b357f0d54006cfff9b2c274339defb88f60cb
MD5 645e2e89566098964db0062dcdc1e4a0
SHA1 0040ebb3d3155956b953496ff47f90cd26720d2f
SHA512 f9151799d3e5d0932e1885139d4866481e57388baa1d197eefeef649f5e0fefcd9e3d688c9a728e303b18be1a5840fc9ec76420e4025aa360630f639290a56c2
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 e96fa9f3a70eb8bf77de75bc4ec9fb03aaf7ec0372e969882555bad1ee77d5e9
MD5 4586e89318ca7f840e04673e5231d840
SHA1 cf01f141c193eaa41a07aa94a07cc610e8e9d7e5
SHA512 95342e5d352b4aa51960a9d5de03edd10f73ec120a741b604b85f15cc1a198b0d683b2c96a14e1a662761f52368b8c04d883e1580498d361290b7be345563ea8
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 10KB
SHA256 2454b687725911b1adbf697a8bb3cbb55832e8e30d5d78a68b1ec95b7c44cefb
MD5 b95ae084780487b0bdd452b7fa3c1411
SHA1 f24f46aa5914fea99a4088f58f2609a83de559af
SHA512 3c50d9c7094efe404ea6a3e59c40c57304805ae677a716bb97f7118656e206ca4d565900288e842bf25080d5fcccfe5010b9830ac7bacde6099dc07ce27aebe3
SSDEEP 192:Js6iuqsm6l6wzfFi28RhhXrD67i6KceVUN6i6YZfaiSaBk9liToBh/xjptjIR0XX:Js6iuqsm6l6wzfFi28RhhXrD67i6KceH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 90b89fe681d88167dfd7567586714759e4984eeec5271e0a0cd84c2198cfc0b9
MD5 dbf362dba0375a6094ee9272c850ade2
SHA1 a8bd0708721121e71b149eb101719627bacdd7b8
SHA512 6713ce1768294bcef35b88e6a3078fc8d9c06965ac4698ce084cbb38a1fc2374ffc18fbd633b705b226d7b1236bf2c18c02093ae7edfd4fbb6529864cabc65ec
SSDEEP 192:nT0k9NT9wJaD6WWMSqGWOhtTuPaivUbJRe71p+Pk+kPxBw0NN028Y3wFceIAzKgA:ngOWJaRWD3REdXZBtq+3FcV/E
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 e0af513a0e27980f10b5c1f21869ff4e24507a73cbe8a192f0dfc1f0947a1d82
MD5 5770663e82d215aadc000d6694572bfb
SHA1 4e357719264f0be087c727bfb18532169826a6f1
SHA512 753716cce971a04f5e3c666228d41ba9808cbec396051aa13d9a9872e3fa1b280ace6f61342e331b7533fedda348600852661dac3a235c5ff71a6e0bdaab938f
SSDEEP 96:nT0kWjT17UJak0wpvWMoiVmdeH/zAT1SjUWQyV+VDCziEwb:nT0kIT9UJabGWMXEJaro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 a28e0d82f7afb082b0f243598cf11762329403f42e520f740e139c75111dda16
MD5 3acf9c49aeb1bfdb050ecf8e6806406f
SHA1 e5aa506e0407275ee3a39e2347db8994ee06ab3b
SHA512 49dce3431ed7322ffa489d732ebf2f8dca2115951b321b0437fdf40f8947351cfaae106d4382150ba93c3b9383ed0dda5728e6cbcc6be613e8fa64194af3776d
SSDEEP 192:nT0kjT9wJa9GWMwhtTuPa9EV0ENy23/Jarg:ng6WJawWnWVR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c699c5390702c86b07471d82b550bdb4e1c3a346ba7856567e6e65d790051d90
MD5 d3c798fe02bcaf9196f14c30b1fee448
SHA1 5f6d50d83d3f564fa28a391a74e37f7d1e91fbcc
SHA512 40ae07a433f09630282b0874611e42e8e6d0b2f412b654a34a398b72fb06af14e3443f6592a88757c5ccb414d094c21ff91bd51378683c88c2197b1ebd250bd7
SSDEEP 192:nT0k+pT9wJaD6WWMSqGWOhtTuPaivUbJRe71p+Pk+kPxBw0NN028Y3wFceIAzKgp:ngHWJaRWD3REdXZBtq+3FcV/V
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 3d351cce16bbabeca40f5ace40c1e0692d20b1611402fb07f7e2a3e9e4e41792
MD5 8c92bbda5afe6cf5b057aad114a2fca9
SHA1 6e67d8de0d23680a9ccc96b1f33d34f2d8171bed
SHA512 93d2f1abdffe8ae2bed177f1ab578adbe106ee3dc09e94a88ede3ab760233524f3d8bbc6508df141b190eb881aab9921b4762f4a6bd8270d7a9ab27e0ac252f1
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe579bd2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe579bd2.TMP
Size 1KB
SHA256 f5aec360f8ced8ca2ffd77b3c75b3e77d6f93404292283f30b113b95df15d172
MD5 3bb7ece8727fa47cfc6d8d60b4b733a1
SHA1 a3d435e817e543c764895596b1e808a3975034dd
SHA512 ed91b0a437865a738431a9c9473cf51a988168be9fe5ae2c6a1538829d41879d51d15cecf8be7be0e064ed168ce6882806b5ab26874ce8259d8534b2b6e6adfe
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 f115f58cdf5af78054d79867e955dafc12a92c62d85bc39072baf52e9fdacc4d
MD5 d981f5422af52a8f95b67859aa06dbe9
SHA1 5c3d64c1da270c0be8daf00f0b5b97847571e99c
SHA512 c3d021a0bde700e1d62c0511ff3a5a98f93af43f9e4ed8b1e70a7b07fa147447f84faf95f56002fb103ab44b72443a13122fadb11b02ccbb3a5b649917e6b089
SSDEEP 192:1oCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuprvf4e2RUB/BSRQax+wAJNu:59iIxuERzA83h09RZxYb+85lwAiMTK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 ec9965d16d76980cc5e4d6e638ab21b334a3ac6d8ee1a742391a434e5b075af4
MD5 cb2f7c9176ebb3dc1079cdff65d88762
SHA1 d866372ecde1ae21589e9d8600499bcf320943f4
SHA512 2a929e3aa470a3b08460515b32936ce9137650a0077a130944010bfd87f1a698d71b3164991f742292620b760c0323e9748543e661a985f06a41ce54a88c239f
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupPHvT4e2RUB/5myEcygu/VV:A9iIxuERzA83h09RZxY3K4nTK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/100-541-0x00007FF6826B0000-0x00007FF683236000-memory.dmp

Download

memory/100-536-0x00007FF6826B0000-0x00007FF683236000-memory.dmp

Download

memory/1088-471-0x0000029AD6160000-0x0000029AD6161000-memory.dmp

Download

memory/1088-504-0x0000029AD4EC0000-0x0000029AD4EC1000-memory.dmp

Download

memory/1088-474-0x0000029AD6160000-0x0000029AD6161000-memory.dmp

Download

memory/1088-475-0x0000029AD6160000-0x0000029AD6161000-memory.dmp

Download

memory/1088-476-0x0000029AD6160000-0x0000029AD6161000-memory.dmp

Download

memory/1088-477-0x0000029AD6160000-0x0000029AD6161000-memory.dmp

Download

memory/1088-478-0x0000029AD6160000-0x0000029AD6161000-memory.dmp

Download

memory/1088-479-0x0000029AD6160000-0x0000029AD6161000-memory.dmp

Download

memory/1088-480-0x0000029AD6160000-0x0000029AD6161000-memory.dmp

Download

memory/1088-481-0x0000029AD4D80000-0x0000029AD4D81000-memory.dmp

Download

memory/1088-482-0x0000029AD4D70000-0x0000029AD4D71000-memory.dmp

Download

memory/1088-484-0x0000029AD4D80000-0x0000029AD4D81000-memory.dmp

Download

memory/1088-487-0x0000029AD4D70000-0x0000029AD4D71000-memory.dmp

Download

memory/1088-490-0x0000029AD4CB0000-0x0000029AD4CB1000-memory.dmp

Download

memory/1088-502-0x0000029AD4EB0000-0x0000029AD4EB1000-memory.dmp

Download

memory/1088-473-0x0000029AD6160000-0x0000029AD6161000-memory.dmp

Download

memory/1088-505-0x0000029AD4EC0000-0x0000029AD4EC1000-memory.dmp

Download

memory/1088-506-0x0000029AD4FD0000-0x0000029AD4FD1000-memory.dmp

Download

memory/1088-472-0x0000029AD6160000-0x0000029AD6161000-memory.dmp

Download

memory/1088-470-0x0000029AD6130000-0x0000029AD6131000-memory.dmp

Download

memory/1088-438-0x0000029ACCA40000-0x0000029ACCA50000-memory.dmp

Download

memory/1088-454-0x0000029ACCB40000-0x0000029ACCB50000-memory.dmp

Download

memory/1988-533-0x0000000000F00000-0x0000000000F59000-memory.dmp

Download

memory/1988-534-0x0000000000F00000-0x0000000000F59000-memory.dmp

Download

memory/3816-535-0x00007FF6826B0000-0x00007FF683236000-memory.dmp

Download

memory/3816-532-0x00007FF6826B0000-0x00007FF683236000-memory.dmp

Download

memory/3816-525-0x00007FF6826B0000-0x00007FF683236000-memory.dmp

Download

memory/4748-561-0x00007FFB155D0000-0x00007FFB15604000-memory.dmp

Download

memory/4748-560-0x00007FF77AE30000-0x00007FF77AF28000-memory.dmp

Download

memory/5976-540-0x0000000000370000-0x00000000003C9000-memory.dmp

Download

memory/5976-542-0x0000000000370000-0x00000000003C9000-memory.dmp

Download