71553eb89ce69f134762190c42b79078941d9fd643564a5c68da983565f7b516

Analysis

max time kernel
18s
max time network
22s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10-08-2024 14:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Umbral-LIL-UZI.zip
Size

402KB
MD5

2468b1e47a260815962f5f739eeed09a
SHA1

faa2aa01ab205e973ee0d00affae82fe0f9ecbba
SHA256

71553eb89ce69f134762190c42b79078941d9fd643564a5c68da983565f7b516
SHA512

8e2b3b02def37b705b61a6a6a27cc615f4e938d46513ca4ce50886ccccf56820afbb387f7fec9c548416bb92225a74e82e6e341c794bbea7681c26035ea222c1
SSDEEP

6144:Exl1KMCqEw3p/COpo9zRqPoXvIxeQeD1M1isNAJ7bIweakuL9cGa:iIMMwp/iXueQehM1isNApbdeeRcB

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1920	msedge.exe
1920	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 1016	5012	msedge.exe	103
PID 5012 wrote to memory of 1016	5012	msedge.exe	103
PID 5012 wrote to memory of 2448	5012	msedge.exe	104
PID 5012 wrote to memory of 2448	5012	msedge.exe	104
PID 5012 wrote to memory of 2448	5012	msedge.exe	104
PID 5012 wrote to memory of 2448	5012	msedge.exe	104
PID 5012 wrote to memory of 2448	5012	msedge.exe	104
PID 5012 wrote to memory of 2448	5012	msedge.exe	104
PID 5012 wrote to memory of 2448	5012	msedge.exe	104
PID 5012 wrote to memory of 2448	5012	msedge.exe	104
PID 5012 wrote to memory of 2448	5012	msedge.exe	104
PID 5012 wrote to memory of 2448	5012	msedge.exe	104
PID 5012 wrote to memory of 2448	5012	msedge.exe	104
PID 5012 wrote to memory of 2448	5012	msedge.exe	104
PID 5012 wrote to memory of 2448	5012	msedge.exe	104
PID 5012 wrote to memory of 2448	5012	msedge.exe	104
PID 5012 wrote to memory of 2448	5012	msedge.exe	104
PID 5012 wrote to memory of 2448	5012	msedge.exe	104
PID 5012 wrote to memory of 2448	5012	msedge.exe	104
PID 5012 wrote to memory of 2448	5012	msedge.exe	104
PID 5012 wrote to memory of 2448	5012	msedge.exe	104
PID 5012 wrote to memory of 2448	5012	msedge.exe	104
PID 5012 wrote to memory of 2448	5012	msedge.exe	104
PID 5012 wrote to memory of 2448	5012	msedge.exe	104
PID 5012 wrote to memory of 2448	5012	msedge.exe	104
PID 5012 wrote to memory of 2448	5012	msedge.exe	104
PID 5012 wrote to memory of 2448	5012	msedge.exe	104
PID 5012 wrote to memory of 2448	5012	msedge.exe	104
PID 5012 wrote to memory of 2448	5012	msedge.exe	104
PID 5012 wrote to memory of 2448	5012	msedge.exe	104
PID 5012 wrote to memory of 2448	5012	msedge.exe	104
PID 5012 wrote to memory of 2448	5012	msedge.exe	104
PID 5012 wrote to memory of 2448	5012	msedge.exe	104
PID 5012 wrote to memory of 2448	5012	msedge.exe	104
PID 5012 wrote to memory of 2448	5012	msedge.exe	104
PID 5012 wrote to memory of 2448	5012	msedge.exe	104
PID 5012 wrote to memory of 2448	5012	msedge.exe	104
PID 5012 wrote to memory of 2448	5012	msedge.exe	104
PID 5012 wrote to memory of 2448	5012	msedge.exe	104
PID 5012 wrote to memory of 2448	5012	msedge.exe	104
PID 5012 wrote to memory of 2448	5012	msedge.exe	104
PID 5012 wrote to memory of 2448	5012	msedge.exe	104
PID 5012 wrote to memory of 1920	5012	msedge.exe	105
PID 5012 wrote to memory of 1920	5012	msedge.exe	105
PID 5012 wrote to memory of 2852	5012	msedge.exe	106
PID 5012 wrote to memory of 2852	5012	msedge.exe	106
PID 5012 wrote to memory of 2852	5012	msedge.exe	106
PID 5012 wrote to memory of 2852	5012	msedge.exe	106
PID 5012 wrote to memory of 2852	5012	msedge.exe	106
PID 5012 wrote to memory of 2852	5012	msedge.exe	106
PID 5012 wrote to memory of 2852	5012	msedge.exe	106
PID 5012 wrote to memory of 2852	5012	msedge.exe	106
PID 5012 wrote to memory of 2852	5012	msedge.exe	106
PID 5012 wrote to memory of 2852	5012	msedge.exe	106
PID 5012 wrote to memory of 2852	5012	msedge.exe	106
PID 5012 wrote to memory of 2852	5012	msedge.exe	106
PID 5012 wrote to memory of 2852	5012	msedge.exe	106
PID 5012 wrote to memory of 2852	5012	msedge.exe	106
PID 5012 wrote to memory of 2852	5012	msedge.exe	106
PID 5012 wrote to memory of 2852	5012	msedge.exe	106
PID 5012 wrote to memory of 2852	5012	msedge.exe	106
PID 5012 wrote to memory of 2852	5012	msedge.exe	106
PID 5012 wrote to memory of 2852	5012	msedge.exe	106
PID 5012 wrote to memory of 2852	5012	msedge.exe	106

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Umbral-LIL-UZI.zip
1⤵
PID:2924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultbd496a95h21f3h4e5fh9682hd530fc67b220
1⤵
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffdcfd346f8,0x7ffdcfd34708,0x7ffdcfd34718
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,16941507599815018751,9673993018027064175,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,16941507599815018751,9673993018027064175,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,16941507599815018751,9673993018027064175,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  PID:2852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
714d19ba5d42843847b93b1d70a75658

SHA1
ce43bf44b723f60ed76d5ab4595bf5dc984bcfea

SHA256
723444262050b317d3759048c15f93ceeb944ebf9f0ef523a32cfd9d0cf4f5cf

SHA512
66012c3642225884d48c66bf4e8570ccf3b209e4355d0cbaa535410d3dc1c0cafa00a7632928f78f4a74a7fd0c246e7a22c26dca65085d5bfaef12c65fcb6957

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
eedb4f01ee7da17053365164523f5df8

SHA1
b373a52aa191a19bcf7e524acb004da457800359

SHA256
78ca33693ef3ed56470ad413eb2f48d13868111436a472d601d3d2d22f12aef9

SHA512
e4e29359f50add912ec9314422d896953693d7e1442424f871757a6625acec06b6d84300bc299b170667df6bb53a9dcc2e1386d9da97847efedcedc9e82c8d24

Download Submit