lumma | hxxps://www[.]mediafire[.]com/file/b28da4tom326vbf/anydesk[.]rar/file

Analysis

max time kernel
90s
max time network
91s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-08-2024 21:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/file/b28da4tom326vbf/anydesk.rar/file

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

Extracted

Family

lumma

https://tenntysjuxmz.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma

Executes dropped EXE 8 IoCs

pid	Process
5352	anydesk.exe
3196	anydesk.exe
5284	anydesk.exe
5712	anydesk.exe
3532	anydesk.exe
3032	anydesk.exe
316	anydesk.exe
5388	anydesk.exe

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 5352 set thread context of 4156	5352	anydesk.exe	138
PID 3196 set thread context of 4088	3196	anydesk.exe	141
PID 5284 set thread context of 116	5284	anydesk.exe	146
PID 5712 set thread context of 2944	5712	anydesk.exe	148
PID 3532 set thread context of 1220	3532	anydesk.exe	152
PID 3032 set thread context of 3128	3032	anydesk.exe	155
PID 316 set thread context of 2180	316	anydesk.exe	158
PID 5388 set thread context of 5600	5388	anydesk.exe	161

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	anydesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	anydesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	anydesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	anydesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	anydesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	anydesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	anydesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	anydesk.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3272	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3428	msedge.exe
3428	msedge.exe
4804	msedge.exe
4804	msedge.exe
5332	msedge.exe
5332	msedge.exe
5856	identity_helper.exe
5856	identity_helper.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6088	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	6036	7zG.exe
Token: 35	6036	7zG.exe
Token: SeSecurityPrivilege	6036	7zG.exe
Token: SeSecurityPrivilege	6036	7zG.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
6036	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe

Suspicious use of SetWindowsHookEx 20 IoCs

pid	Process
5812	OpenWith.exe
6088	OpenWith.exe
6088	OpenWith.exe
6088	OpenWith.exe
6088	OpenWith.exe
6088	OpenWith.exe
6088	OpenWith.exe
6088	OpenWith.exe
6088	OpenWith.exe
6088	OpenWith.exe
6088	OpenWith.exe
6088	OpenWith.exe
6088	OpenWith.exe
6088	OpenWith.exe
6088	OpenWith.exe
6088	OpenWith.exe
6088	OpenWith.exe
6088	OpenWith.exe
6088	OpenWith.exe
6088	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 804	4804	msedge.exe	86
PID 4804 wrote to memory of 804	4804	msedge.exe	86
PID 4804 wrote to memory of 1976	4804	msedge.exe	87
PID 4804 wrote to memory of 1976	4804	msedge.exe	87
PID 4804 wrote to memory of 1976	4804	msedge.exe	87
PID 4804 wrote to memory of 1976	4804	msedge.exe	87
PID 4804 wrote to memory of 1976	4804	msedge.exe	87
PID 4804 wrote to memory of 1976	4804	msedge.exe	87
PID 4804 wrote to memory of 1976	4804	msedge.exe	87
PID 4804 wrote to memory of 1976	4804	msedge.exe	87
PID 4804 wrote to memory of 1976	4804	msedge.exe	87
PID 4804 wrote to memory of 1976	4804	msedge.exe	87
PID 4804 wrote to memory of 1976	4804	msedge.exe	87
PID 4804 wrote to memory of 1976	4804	msedge.exe	87
PID 4804 wrote to memory of 1976	4804	msedge.exe	87
PID 4804 wrote to memory of 1976	4804	msedge.exe	87
PID 4804 wrote to memory of 1976	4804	msedge.exe	87
PID 4804 wrote to memory of 1976	4804	msedge.exe	87
PID 4804 wrote to memory of 1976	4804	msedge.exe	87
PID 4804 wrote to memory of 1976	4804	msedge.exe	87
PID 4804 wrote to memory of 1976	4804	msedge.exe	87
PID 4804 wrote to memory of 1976	4804	msedge.exe	87
PID 4804 wrote to memory of 1976	4804	msedge.exe	87
PID 4804 wrote to memory of 1976	4804	msedge.exe	87
PID 4804 wrote to memory of 1976	4804	msedge.exe	87
PID 4804 wrote to memory of 1976	4804	msedge.exe	87
PID 4804 wrote to memory of 1976	4804	msedge.exe	87
PID 4804 wrote to memory of 1976	4804	msedge.exe	87
PID 4804 wrote to memory of 1976	4804	msedge.exe	87
PID 4804 wrote to memory of 1976	4804	msedge.exe	87
PID 4804 wrote to memory of 1976	4804	msedge.exe	87
PID 4804 wrote to memory of 1976	4804	msedge.exe	87
PID 4804 wrote to memory of 1976	4804	msedge.exe	87
PID 4804 wrote to memory of 1976	4804	msedge.exe	87
PID 4804 wrote to memory of 1976	4804	msedge.exe	87
PID 4804 wrote to memory of 1976	4804	msedge.exe	87
PID 4804 wrote to memory of 1976	4804	msedge.exe	87
PID 4804 wrote to memory of 1976	4804	msedge.exe	87
PID 4804 wrote to memory of 1976	4804	msedge.exe	87
PID 4804 wrote to memory of 1976	4804	msedge.exe	87
PID 4804 wrote to memory of 1976	4804	msedge.exe	87
PID 4804 wrote to memory of 1976	4804	msedge.exe	87
PID 4804 wrote to memory of 3428	4804	msedge.exe	88
PID 4804 wrote to memory of 3428	4804	msedge.exe	88
PID 4804 wrote to memory of 3856	4804	msedge.exe	89
PID 4804 wrote to memory of 3856	4804	msedge.exe	89
PID 4804 wrote to memory of 3856	4804	msedge.exe	89
PID 4804 wrote to memory of 3856	4804	msedge.exe	89
PID 4804 wrote to memory of 3856	4804	msedge.exe	89
PID 4804 wrote to memory of 3856	4804	msedge.exe	89
PID 4804 wrote to memory of 3856	4804	msedge.exe	89
PID 4804 wrote to memory of 3856	4804	msedge.exe	89
PID 4804 wrote to memory of 3856	4804	msedge.exe	89
PID 4804 wrote to memory of 3856	4804	msedge.exe	89
PID 4804 wrote to memory of 3856	4804	msedge.exe	89
PID 4804 wrote to memory of 3856	4804	msedge.exe	89
PID 4804 wrote to memory of 3856	4804	msedge.exe	89
PID 4804 wrote to memory of 3856	4804	msedge.exe	89
PID 4804 wrote to memory of 3856	4804	msedge.exe	89
PID 4804 wrote to memory of 3856	4804	msedge.exe	89
PID 4804 wrote to memory of 3856	4804	msedge.exe	89
PID 4804 wrote to memory of 3856	4804	msedge.exe	89
PID 4804 wrote to memory of 3856	4804	msedge.exe	89
PID 4804 wrote to memory of 3856	4804	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/file/b28da4tom326vbf/anydesk.rar/file
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff7d1746f8,0x7fff7d174708,0x7fff7d174718
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,538310578208145538,6818355495444508038,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,538310578208145538,6818355495444508038,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1896,538310578208145538,6818355495444508038,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,538310578208145538,6818355495444508038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,538310578208145538,6818355495444508038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,538310578208145538,6818355495444508038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,538310578208145538,6818355495444508038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,538310578208145538,6818355495444508038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,538310578208145538,6818355495444508038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,538310578208145538,6818355495444508038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6400 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,538310578208145538,6818355495444508038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1896,538310578208145538,6818355495444508038,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,538310578208145538,6818355495444508038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1896,538310578208145538,6818355495444508038,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1896,538310578208145538,6818355495444508038,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6956 /prefetch:8
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1896,538310578208145538,6818355495444508038,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6956 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,538310578208145538,6818355495444508038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,538310578208145538,6818355495444508038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,538310578208145538,6818355495444508038,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7128 /prefetch:1
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,538310578208145538,6818355495444508038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,538310578208145538,6818355495444508038,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7200 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1896,538310578208145538,6818355495444508038,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7032 /prefetch:8
  2⤵
  PID:5444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3412

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5812

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:6088
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\anydesk.rar
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3272

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2604

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\anydesk\" -spe -an -ai#7zMap4549:76:7zEvent26661
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:6036

C:\Users\Admin\Downloads\anydesk\anydesk.exe
"C:\Users\Admin\Downloads\anydesk\anydesk.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5352
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4156

C:\Users\Admin\Downloads\anydesk\anydesk.exe
"C:\Users\Admin\Downloads\anydesk\anydesk.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3196
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4088

C:\Users\Admin\Downloads\anydesk\anydesk.exe
"C:\Users\Admin\Downloads\anydesk\anydesk.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5284
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:116

C:\Users\Admin\Downloads\anydesk\anydesk.exe
"C:\Users\Admin\Downloads\anydesk\anydesk.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5712
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:548
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2944

C:\Users\Admin\Downloads\anydesk\anydesk.exe
"C:\Users\Admin\Downloads\anydesk\anydesk.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3532
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1220

C:\Users\Admin\Downloads\anydesk\anydesk.exe
"C:\Users\Admin\Downloads\anydesk\anydesk.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3032
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3128

C:\Users\Admin\Downloads\anydesk\anydesk.exe
"C:\Users\Admin\Downloads\anydesk\anydesk.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:316
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2180

C:\Users\Admin\Downloads\anydesk\anydesk.exe
"C:\Users\Admin\Downloads\anydesk\anydesk.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5388
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
0b3f96e726cad44339585876767edd5b

SHA1
04b8ab93e3dc5db060a5b688f8dabe5f8426af0e

SHA256
a8271b3332d70e31d6d0812146c4810bc6fbd7abf767a5ed11586e054e8dcea0

SHA512
40d7ccea26e317e2f82e18f93a55a0423f57ab1f1fed83cb0112d88dde5999f48fe05434e22e0ef2e1186bf397813fb0a8a992c0e13835854d0ac2f5460dc2e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
9793ade054347936639bcf9d18fe2135

SHA1
b2be83db397ec837b04b8efcffbee805831729c1

SHA256
a81354be95cba83f47ee8a378d3fb66aaf0192da038a06e01b0542ed1dcc37ec

SHA512
d99fc5f2cbedf7e9ed214d053f8193028964f075225c1e1709bfc7c75b6cf73adfdeecfe89712a5cf39b03624557097df4fa8e39f3422bc70867f704f2cde3d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
9KB

MD5
b514c21d26fd4e63b035af6f7eeea409

SHA1
3b209d5c0a78b06758724fbd7b86df0342bbf779

SHA256
acc728b4601245d51e6f139657391967d1591da9df69753a126ecbfedb58b97e

SHA512
cc764517819cc3ca8affd88b243693d99fbed850705cba73a544727b34d467d8127aacf397fd110be77cd8aba34a4746ea1cf88798d034d576cda1b298d5ee5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4faa07f57b2dbde2d5be0e4b03e9715b

SHA1
7985c61270b362e0aee5168f63dc0c24c5ddcdcb

SHA256
ac1eac817297455b9e4d08223011979040747c0d4ed15b80a0a019223e8829be

SHA512
7d3746fa36ea8cf2025476dae2ffbb2fc9c4f0f2f21c00f68016afd67d266e3481d221dc5bf65a0d456f9a7a1782337b7bcd25aea6fc0e1578e01222c21b6525

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
61c11263ceb25521f42477929aa0d15c

SHA1
d38a6e4674911f96a63710255a6e9610d9a156df

SHA256
9dd87272006ccf3bacc21d7d3016605ca77c0c840233bb00b54526bd9babbbc6

SHA512
812b41bd570378306ff51eab2ed04e8322efb6ef8cee460b93d05372344a0aebcf91cf5013fbcab77a6a8342ab7ba3fe55b912120b4d0ec9dac3f6d18b6ee81a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
618025e4f9b827178299cc3923eba541

SHA1
8cd8d087c0188a3e252a55b4c4edc14b569b3d1d

SHA256
f0e9c3f3d79e58aa3c9025804c69d7279c3bdf0157ddcf28520b39cd4778e3b3

SHA512
45d5934f9ebbf68af30753181f1a54f5d342992d60a2c90cabfa694f9e2ffd1648dbaef38e6c4e62c7fa8324d6af8e6afda4be7bbdada653b42cf151bd84605d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
c55bab973c6354c7e2ded53592511783

SHA1
610dd34d2e7ad15728ed2aca58c6043c6652c6ac

SHA256
030d3ce3fc898ed3b614b190221b17fbe7fa2666d5125fbd04a5f3cb0205b252

SHA512
8061f0afaa21013069c30774122263979ec9ae10cba13b4cf3991b8d9ca9a204412ed17e9d45adf5d8edeaee62052c8965134e118449a2ccaad7a234250d221d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
36e9d9445c34ff5549dc43c5255af7b6

SHA1
a462762cb90e9283bc88380461ce1f438c71a162

SHA256
c9d642ea7eabff822d3179fa70fbc54ff32104092b754e8097c4d09a68bdb2ca

SHA512
614a94b00316b60802fdf8d575eafabec9c2fa5e61c647dad82e8010a953be1c21d46ace0967914fbd881614f6160d2c810ccd0a33563206f943cc754e0e7f7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
1469d95ea6d76f9e3c01cae49c2ce32d

SHA1
5bdbc036b8ff78a8b13b424cb3ba41edf91b6a18

SHA256
88177f4cea0416bb9f56891d6b36edefe910d732fc871dc3f08ef0cd2c966b7d

SHA512
b39676e380572a00d2390676cb2fbf8c50bceaf28b47f7f0c162a6c856469d2ed08e1f904b13cf6536b917c2d538881922744db8d798e5ae085e339f6f1336af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
b7c50f3a4a1a862ebceebf956033eb2d

SHA1
1dc2b111180d3dc18ee14acd5bfc2ab652301dca

SHA256
44d560eb28c840b7985d47f82d1f70b5e2b1d859704342000c7ee7ed081c5b32

SHA512
a35cbdc1dd353cccf9b7312b6968990836bb3b54b2eaec03ab499b9809e99ace05c344ed44ed3b67b2c62670450dc686e392cf1398f7c55f0e79556e50c78647

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f02c.TMP

Filesize
1KB

MD5
0f0009fd71d4b511a5ddec8091f2a220

SHA1
204bbd0e828480bdb3548be3df1fd5f624a32d4a

SHA256
3f0aeb57a1e3d55260f8ea1de96ea6c80e507ae494c1d5dda594d77bf9d19897

SHA512
7544d8eb3c0e28ce8ab6e300c18f69133ee87a10fb562613d83c9977938c0b2fb001731dd1f38dafb6abc242daeb6ab9a951715dd625643e9eb2df3b95a3cd89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a11b006d9a4710908ba69d6a900cae25

SHA1
e150b7813d0fa4af82b6a04d93c4a62b433cc2e1

SHA256
ce6ef0a32af17e0d4707fb3bf714dd8daac20d3f447eb426b172eae6407184b9

SHA512
d29931e7c13353a893881493a9a7ab291660c5ec8071ebd2975cc8e48673d035782fd39d627c02e05935f1277de70c43567c91008802870ec720c168a2e6972b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
90e1aa791a65c9add5add3c32eb3f841

SHA1
1fbc37959768f3b32833b34939388867c0933510

SHA256
8cd95bfe0219f6fd03ab7b1e19d19e428d5186b19d80d8e08b4b94003b7abf68

SHA512
48e723ecb4b711b9f7a25a78ed14ac09fc91d5c721b912f56c35e9ee3219e0a81bc5f6098a954ed5136fab23dde838baae9de10179a40882ac4ee87f29888317

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
ce46c20ab168acf6445f64673329d7c7

SHA1
e3e4cd0f73c553526f5caa5cd7c4ec99d108ddaa

SHA256
de93d5b89fbb6b096004c5d7c49926bb17793f5f9cca0b975dbbc96b6ce396a2

SHA512
4bee5d67b5b7f2b968d6ab0da63b22a8ffe3f37f4d80b337c532a0b93b9646f3549c62d13489529b4f769e91ea711ffc8eb63eea2a8f3450ab1f778f4f3ae23e

Download Submit
C:\Users\Admin\Downloads\anydesk.rar

Filesize
547KB

MD5
4535bd0431fb52b1298a28ce24b2312a

SHA1
0329c1b481ae2b4f3a2c98f514e7b9f51c684082

SHA256
66c4b9204758757462be770ca2b2819084afdbd5f840d4b75f24d762bfea67e2

SHA512
1f658db162158f4bcba1072e3be627d75be4e58bb2fce5acca5c0e3b8decef518057246b735f4e660567835f05cdd41c996f0f615d0691c88fbfac69abf62616

Download Submit
C:\Users\Admin\Downloads\anydesk\anydesk.exe

Filesize
1.2MB

MD5
750eb35ace4b081d7d1958d4e82af4d9

SHA1
5ec88b19f155f0294ad6c9a280fe439ec7547be2

SHA256
480d4475c7df302d34d115f8f1e7ce4f88afa4470dbad7e31b1b82765de67a14

SHA512
6f1a1f2bcce2083a523d2f9948f192df5686f94a24a863f794a862efd408643e4d8ab395e38921d59f02ac593dc8b9b79664c27d377c968a6832258caf9676ad

Download Submit
memory/316-358-0x0000000000B70000-0x0000000000D06000-memory.dmp

Filesize
1.6MB

Download
memory/316-356-0x0000000000B70000-0x0000000000D06000-memory.dmp

Filesize
1.6MB

Download
memory/3032-354-0x0000000000B70000-0x0000000000D06000-memory.dmp

Filesize
1.6MB

Download
memory/3196-329-0x0000000000B70000-0x0000000000D06000-memory.dmp

Filesize
1.6MB

Download
memory/3532-347-0x0000000000B70000-0x0000000000D06000-memory.dmp

Filesize
1.6MB

Download
memory/3532-349-0x0000000000B70000-0x0000000000D06000-memory.dmp

Filesize
1.6MB

Download
memory/4156-325-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/4156-323-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/5284-340-0x0000000000B70000-0x0000000000D06000-memory.dmp

Filesize
1.6MB

Download
memory/5352-324-0x0000000000B70000-0x0000000000D06000-memory.dmp

Filesize
1.6MB

Download
memory/5352-321-0x0000000000B70000-0x0000000000D06000-memory.dmp

Filesize
1.6MB

Download
memory/5388-361-0x0000000000B70000-0x0000000000D06000-memory.dmp

Filesize
1.6MB

Download
memory/5388-363-0x0000000000B70000-0x0000000000D06000-memory.dmp

Filesize
1.6MB

Download
memory/5712-342-0x0000000000B70000-0x0000000000D06000-memory.dmp

Filesize
1.6MB

Download
memory/5712-337-0x0000000000B70000-0x0000000000D06000-memory.dmp

Filesize
1.6MB

Download