lumma | hxxps://drive[.]google[.]com/file/d/1FIpHm1dxG2bMfqj7lQI68XysszxDFeMW/view

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21-08-2024 15:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1FIpHm1dxG2bMfqj7lQI68XysszxDFeMW/view

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://potentioallykeos.shop/api

https://interactiedovspm.shop/api

https://charecteristicdxp.shop/api

https://cagedwifedsozm.shop/api

https://deicedosmzj.shop/api

https://southedhiscuso.shop/api

https://consciousourwi.shop/api

https://tenntysjuxmz.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma

Executes dropped EXE 3 IoCs

pid	Process
5208	Main.exe
5452	Main.exe
4128	Main.exe

Loads dropped DLL 3 IoCs

pid	Process
5208	Main.exe
5452	Main.exe
4128	Main.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	drive.google.com
11	drive.google.com

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 5208 set thread context of 2060	5208	Main.exe	133
PID 5452 set thread context of 5072	5452	Main.exe	137
PID 4128 set thread context of 4184	4128	Main.exe	140

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Main.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_regiis.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Main.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_regiis.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Main.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_regiis.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	msedge.exe

Opens file in notepad (likely ransom note) 3 IoCs

ransomware

pid	Process
1576	NOTEPAD.EXE
4860	NOTEPAD.EXE
2796	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2256	msedge.exe
2256	msedge.exe
1016	msedge.exe
1016	msedge.exe
4072	identity_helper.exe
4072	identity_helper.exe
1168	msedge.exe
1168	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	1288	7zG.exe
Token: 35	1288	7zG.exe
Token: SeSecurityPrivilege	1288	7zG.exe
Token: SeSecurityPrivilege	1288	7zG.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1288	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 948	1016	msedge.exe	87
PID 1016 wrote to memory of 948	1016	msedge.exe	87
PID 1016 wrote to memory of 4952	1016	msedge.exe	88
PID 1016 wrote to memory of 4952	1016	msedge.exe	88
PID 1016 wrote to memory of 4952	1016	msedge.exe	88
PID 1016 wrote to memory of 4952	1016	msedge.exe	88
PID 1016 wrote to memory of 4952	1016	msedge.exe	88
PID 1016 wrote to memory of 4952	1016	msedge.exe	88
PID 1016 wrote to memory of 4952	1016	msedge.exe	88
PID 1016 wrote to memory of 4952	1016	msedge.exe	88
PID 1016 wrote to memory of 4952	1016	msedge.exe	88
PID 1016 wrote to memory of 4952	1016	msedge.exe	88
PID 1016 wrote to memory of 4952	1016	msedge.exe	88
PID 1016 wrote to memory of 4952	1016	msedge.exe	88
PID 1016 wrote to memory of 4952	1016	msedge.exe	88
PID 1016 wrote to memory of 4952	1016	msedge.exe	88
PID 1016 wrote to memory of 4952	1016	msedge.exe	88
PID 1016 wrote to memory of 4952	1016	msedge.exe	88
PID 1016 wrote to memory of 4952	1016	msedge.exe	88
PID 1016 wrote to memory of 4952	1016	msedge.exe	88
PID 1016 wrote to memory of 4952	1016	msedge.exe	88
PID 1016 wrote to memory of 4952	1016	msedge.exe	88
PID 1016 wrote to memory of 4952	1016	msedge.exe	88
PID 1016 wrote to memory of 4952	1016	msedge.exe	88
PID 1016 wrote to memory of 4952	1016	msedge.exe	88
PID 1016 wrote to memory of 4952	1016	msedge.exe	88
PID 1016 wrote to memory of 4952	1016	msedge.exe	88
PID 1016 wrote to memory of 4952	1016	msedge.exe	88
PID 1016 wrote to memory of 4952	1016	msedge.exe	88
PID 1016 wrote to memory of 4952	1016	msedge.exe	88
PID 1016 wrote to memory of 4952	1016	msedge.exe	88
PID 1016 wrote to memory of 4952	1016	msedge.exe	88
PID 1016 wrote to memory of 4952	1016	msedge.exe	88
PID 1016 wrote to memory of 4952	1016	msedge.exe	88
PID 1016 wrote to memory of 4952	1016	msedge.exe	88
PID 1016 wrote to memory of 4952	1016	msedge.exe	88
PID 1016 wrote to memory of 4952	1016	msedge.exe	88
PID 1016 wrote to memory of 4952	1016	msedge.exe	88
PID 1016 wrote to memory of 4952	1016	msedge.exe	88
PID 1016 wrote to memory of 4952	1016	msedge.exe	88
PID 1016 wrote to memory of 4952	1016	msedge.exe	88
PID 1016 wrote to memory of 4952	1016	msedge.exe	88
PID 1016 wrote to memory of 2256	1016	msedge.exe	89
PID 1016 wrote to memory of 2256	1016	msedge.exe	89
PID 1016 wrote to memory of 2968	1016	msedge.exe	90
PID 1016 wrote to memory of 2968	1016	msedge.exe	90
PID 1016 wrote to memory of 2968	1016	msedge.exe	90
PID 1016 wrote to memory of 2968	1016	msedge.exe	90
PID 1016 wrote to memory of 2968	1016	msedge.exe	90
PID 1016 wrote to memory of 2968	1016	msedge.exe	90
PID 1016 wrote to memory of 2968	1016	msedge.exe	90
PID 1016 wrote to memory of 2968	1016	msedge.exe	90
PID 1016 wrote to memory of 2968	1016	msedge.exe	90
PID 1016 wrote to memory of 2968	1016	msedge.exe	90
PID 1016 wrote to memory of 2968	1016	msedge.exe	90
PID 1016 wrote to memory of 2968	1016	msedge.exe	90
PID 1016 wrote to memory of 2968	1016	msedge.exe	90
PID 1016 wrote to memory of 2968	1016	msedge.exe	90
PID 1016 wrote to memory of 2968	1016	msedge.exe	90
PID 1016 wrote to memory of 2968	1016	msedge.exe	90
PID 1016 wrote to memory of 2968	1016	msedge.exe	90
PID 1016 wrote to memory of 2968	1016	msedge.exe	90
PID 1016 wrote to memory of 2968	1016	msedge.exe	90
PID 1016 wrote to memory of 2968	1016	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1FIpHm1dxG2bMfqj7lQI68XysszxDFeMW/view
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe5fbc46f8,0x7ffe5fbc4708,0x7ffe5fbc4718
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,1505406104953824077,16565929179618627410,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,1505406104953824077,16565929179618627410,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,1505406104953824077,16565929179618627410,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:8
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,1505406104953824077,16565929179618627410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,1505406104953824077,16565929179618627410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,1505406104953824077,16565929179618627410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,1505406104953824077,16565929179618627410,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,1505406104953824077,16565929179618627410,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,1505406104953824077,16565929179618627410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2064,1505406104953824077,16565929179618627410,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,1505406104953824077,16565929179618627410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2064,1505406104953824077,16565929179618627410,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,1505406104953824077,16565929179618627410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,1505406104953824077,16565929179618627410,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,1505406104953824077,16565929179618627410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,1505406104953824077,16565929179618627410,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,1505406104953824077,16565929179618627410,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5864 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4316

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1228

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5588

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap8182:70:7zEvent14616
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1288

C:\Users\Admin\Downloads\Main\Main.exe
"C:\Users\Admin\Downloads\Main\Main.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5208
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2060

C:\Users\Admin\Downloads\Main\Main.exe
"C:\Users\Admin\Downloads\Main\Main.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5452
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5072

C:\Users\Admin\Downloads\Main\Main.exe
"C:\Users\Admin\Downloads\Main\Main.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4128
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4184

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Main\output.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1576

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Main\proxy.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4860

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Main\Instruction.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2796

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:2920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Main.exe.log

Filesize
42B

MD5
84cfdb4b995b1dbf543b26b86c863adc

SHA1
d2f47764908bf30036cf8248b9ff5541e2711fa2

SHA256
d8988d672d6915b46946b28c06ad8066c50041f6152a91d37ffa5cf129cc146b

SHA512
485f0ed45e13f00a93762cbf15b4b8f996553baa021152fae5aba051e3736bcd3ca8f4328f0e6d9e3e1f910c96c4a9ae055331123ee08e3c2ce3a99ac2e177ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
c010085097d9265c795a6f6c0a533d5d

SHA1
534b384b342e1f2fe0f9d48cc3b756c73b2cc5a8

SHA256
3521e4fd2326fa25d0dbbb9b98915f245e4858a78b8be176e5e53e3ff440e547

SHA512
dfadefe4d34ffd85978d7075a1b5b4731d191815a6dc7616e0e3e4e8da1194c5525ea36faa12b4a34987d46622c9639d0ced0a000a3cfe1cb6c50d59a6dd9b01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
fdcef80ac4d03ef9b1ddd0e3abf0fca0

SHA1
1a2949169f45271bc4eeb030c766398c6818abfb

SHA256
e0cf8d2165fe205eb42995a9b6140ef57594deb52bfb5a543fee753f760ea3ad

SHA512
e370360a6fc75c4e1124b1eafa4610efe5ddb8c61b3c718e7807ac506d902731f23b4370f1a866791ab4ec328d1d37b743fa9434097e507892d2fb91065721a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
e1465bf61a0a6d50adcf545398537a96

SHA1
98ee5fea0b656ce1efe9f3dbc353d74542ea1cb0

SHA256
2e693a10a69e174d261e7ef33ae1e32f8cfc3028f762e6c6f899b7e921626487

SHA512
6042da3bb71dae95088371fa0eff5c4eea191e277913fcf7726aa5b7b661e15fa9e98e7251842c3e19e0f0fad037fad969ca2e0f27db7ba0d2bbd97e48e587d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f44f9f423c3c1c767eb1016a5e3a14c5

SHA1
65f85eaa873d8cf304de85a9272944a4869a44e0

SHA256
0deb217991143b33de4cd4e01b53c00416bee8569e8dfe21611f380a8ae5d192

SHA512
4d9522551bef0a9e53aae687f8bf9f5303c1e407e22ee929075017ac3e78e6d26533baa63d42073627b70d2304fb7cf8c71a71402af0670e2828d2dcb4863b91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aa9719ad32b0e3e4c37d70f95bee44e7

SHA1
d646a287335c6e73387b51825b133877e1b7bdd8

SHA256
84c8c235ed6a74890541dc41ab91f34f58e1fc4e9043b26fb69fc565c26aacc5

SHA512
f1a73936931220df90ebc26af279b331fa64d19849b410e49113530c75d13f87f1560efee2b818ab23f376318f9e67de2b2a03042ba802b408b3a89ba5938d68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c7094e9d-2b5e-4396-b75d-1b5905561b6d.tmp

Filesize
6KB

MD5
cac7568a54c5b80af9c9fc7cdf28aea6

SHA1
5291bb2ba692a05ae0591bb6476bf37c8c0389b4

SHA256
43e558eb079c8f12872457a8d89af7d26218650954ca64b2fc7003105e3973da

SHA512
0ee61776913a9fdb5f9d8260145583ee0a17a80be10c3a6e1340fd045cfabeb230d00ada5bf79eb5aeadc64e74010f5988c661317af477addd533677850f98a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7cd8ff681fad34e078198133785ccb95

SHA1
d4d422f9f0d371efcf0bf8d2affc2cf9b129a7a4

SHA256
4eb38e8ca7788b54ccefaacf47abac5a6165fde01cf48aa99fe8fff7a3675b44

SHA512
0eae0010ba371b8fc089a8dc1b5e33b5a0e14ac9b03cf6d4fd561915c1f65aff18895f98a7bb154566fde12fcfe59c7e50794d1b23fd32123c4450e3829ee0c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e51f5f80493759ac7e646c1c553c29af

SHA1
ce94f5789e7825e62cf37ace8ebfaf0a622bc932

SHA256
3d77c20382b71a81365db11c48abc052f19914a5fa933da1feda0bf1210925ea

SHA512
a9320876f2006e965e7051f5e2881ede0c246208f87dd7c275403e7bdcaf69782efb6286c2f2641c920d3b6b80e3a061fff77d92e6acfa34b63e37f542350da5

Download Submit
C:\Users\Admin\AppData\Roaming\d3d9x.dll

Filesize
472KB

MD5
8ee22e5eed62160bbd73486515444675

SHA1
2e4a73f154b8fa0c6c5ad4dc9eb39a42374cd8d9

SHA256
cc1cdd0247e83886a1b014a5048e2a920b92d1cc7e82f23a93cf51c56bc72e5f

SHA512
9ba3e72705e02c21f70cb6172a0833e14e70c96ebb63722763fdb69de179126d1232740c7646209628104b5e8f514556a98761f770cbb21c1cb2bd3a0cc2bdaf

Download Submit
C:\Users\Admin\Downloads\Main\Instruction.txt

Filesize
98B

MD5
607c2ea855554986a7d5cd12be8a5680

SHA1
77fff96bbf55a4ff66c085e4c3892fd44a31089b

SHA256
ea239113e89243b6420400812dc8e7f802531589f03d86a4ab17700daf65ea53

SHA512
06c22c7c13cb75bee2e6b48f542f96c8c64d6fa1d2c2a496d590791f2cb00be1713f7df1f8e1c2990bc96c6f0942f919bec3faf2a05e36d2eadea04c469626c6

Download Submit
C:\Users\Admin\Downloads\Main\Main.exe

Filesize
678KB

MD5
8420aa3e4c994b17e2c002217731642b

SHA1
e4a698d615cf7fc6b79d3e4c01e724a63eab2481

SHA256
b0a1383874ecbd60ffc63d78c9ae35b972c1f07d73f7ce61ad0fc1302e83058d

SHA512
603b66b68af4b212886dee102f54e88a1c1a13e17ed7915bae8d8c7ff3fdff35da4d2b44bc7d26c553f85d61436e6a5b73e0dcb3c5ee217515ea98b9b6f6fc86

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 913877.crdownload

Filesize
459KB

MD5
7195af62b3759e6be253dd70439b5140

SHA1
eabc4b74e35440bb81d516047d9cfbda012d2191

SHA256
62fa84dd433bdb0df7e0557696e85ceb43a5e32e166ef05ffda740f1e0c58015

SHA512
5aba510a4af1df154b84d6f54c4b3f821ec621664c2a3c962197ea034e31ac4d7b9af8f3bfe3564a5f0c1d98a93de302e631527e58e9f4da87c62bd5558d382f

Download Submit
memory/2060-190-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2060-192-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4184-234-0x0000000000720000-0x000000000076D000-memory.dmp

Filesize
308KB

Download
memory/4184-237-0x0000000000720000-0x000000000076D000-memory.dmp

Filesize
308KB

Download
memory/5208-183-0x0000000000110000-0x00000000001C0000-memory.dmp

Filesize
704KB

Download