lumma | hxxps://storageinstance[.]oss-ap-southeast-1[.]aliyuncs[.]com/cincinati[.]zip

Resubmissions

19/11/2024, 10:49

241119-mw68csvhlr 10

19/11/2024, 10:43

241119-msk6qavjdw 10

Analysis

max time kernel
432s
max time network
434s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2024, 10:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://storageinstance.oss-ap-southeast-1.aliyuncs.com/cincinati.zip

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://processhol.sbs/api

https://p10tgrace.sbs/api

https://peepburry828.sbs/api

https://3xp3cts1aim.sbs/api

https://p3ar11fter.sbs/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Executes dropped EXE 1 IoCs

pid	Process
5160	Dept.com

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
5740	tasklist.exe
5864	tasklist.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\IncidentsAerospace	RomanticCopyright.exe
File opened for modification	C:\Windows\AssessmentsArmed	RomanticCopyright.exe
File opened for modification	C:\Windows\FarRegistered	RomanticCopyright.exe
File opened for modification	C:\Windows\InsertedHe	RomanticCopyright.exe
File opened for modification	C:\Windows\RecordedHeld	RomanticCopyright.exe
File opened for modification	C:\Windows\ColdRecycling	RomanticCopyright.exe
File opened for modification	C:\Windows\PleaseBehavioral	RomanticCopyright.exe
File opened for modification	C:\Windows\ScenesConnecting	RomanticCopyright.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RomanticCopyright.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dept.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
5024	msedge.exe
5024	msedge.exe
4684	msedge.exe
4684	msedge.exe
3572	identity_helper.exe
3572	identity_helper.exe
2920	msedge.exe
2920	msedge.exe
5160	Dept.com
5160	Dept.com
5160	Dept.com
5160	Dept.com
5160	Dept.com
5160	Dept.com
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5740	tasklist.exe
Token: SeDebugPrivilege	5864	tasklist.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
5160	Dept.com
5160	Dept.com
5160	Dept.com

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
5160	Dept.com
5160	Dept.com
5160	Dept.com

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 1468	4684	msedge.exe	83
PID 4684 wrote to memory of 1468	4684	msedge.exe	83
PID 4684 wrote to memory of 1900	4684	msedge.exe	84
PID 4684 wrote to memory of 1900	4684	msedge.exe	84
PID 4684 wrote to memory of 1900	4684	msedge.exe	84
PID 4684 wrote to memory of 1900	4684	msedge.exe	84
PID 4684 wrote to memory of 1900	4684	msedge.exe	84
PID 4684 wrote to memory of 1900	4684	msedge.exe	84
PID 4684 wrote to memory of 1900	4684	msedge.exe	84
PID 4684 wrote to memory of 1900	4684	msedge.exe	84
PID 4684 wrote to memory of 1900	4684	msedge.exe	84
PID 4684 wrote to memory of 1900	4684	msedge.exe	84
PID 4684 wrote to memory of 1900	4684	msedge.exe	84
PID 4684 wrote to memory of 1900	4684	msedge.exe	84
PID 4684 wrote to memory of 1900	4684	msedge.exe	84
PID 4684 wrote to memory of 1900	4684	msedge.exe	84
PID 4684 wrote to memory of 1900	4684	msedge.exe	84
PID 4684 wrote to memory of 1900	4684	msedge.exe	84
PID 4684 wrote to memory of 1900	4684	msedge.exe	84
PID 4684 wrote to memory of 1900	4684	msedge.exe	84
PID 4684 wrote to memory of 1900	4684	msedge.exe	84
PID 4684 wrote to memory of 1900	4684	msedge.exe	84
PID 4684 wrote to memory of 1900	4684	msedge.exe	84
PID 4684 wrote to memory of 1900	4684	msedge.exe	84
PID 4684 wrote to memory of 1900	4684	msedge.exe	84
PID 4684 wrote to memory of 1900	4684	msedge.exe	84
PID 4684 wrote to memory of 1900	4684	msedge.exe	84
PID 4684 wrote to memory of 1900	4684	msedge.exe	84
PID 4684 wrote to memory of 1900	4684	msedge.exe	84
PID 4684 wrote to memory of 1900	4684	msedge.exe	84
PID 4684 wrote to memory of 1900	4684	msedge.exe	84
PID 4684 wrote to memory of 1900	4684	msedge.exe	84
PID 4684 wrote to memory of 1900	4684	msedge.exe	84
PID 4684 wrote to memory of 1900	4684	msedge.exe	84
PID 4684 wrote to memory of 1900	4684	msedge.exe	84
PID 4684 wrote to memory of 1900	4684	msedge.exe	84
PID 4684 wrote to memory of 1900	4684	msedge.exe	84
PID 4684 wrote to memory of 1900	4684	msedge.exe	84
PID 4684 wrote to memory of 1900	4684	msedge.exe	84
PID 4684 wrote to memory of 1900	4684	msedge.exe	84
PID 4684 wrote to memory of 1900	4684	msedge.exe	84
PID 4684 wrote to memory of 1900	4684	msedge.exe	84
PID 4684 wrote to memory of 5024	4684	msedge.exe	85
PID 4684 wrote to memory of 5024	4684	msedge.exe	85
PID 4684 wrote to memory of 1344	4684	msedge.exe	86
PID 4684 wrote to memory of 1344	4684	msedge.exe	86
PID 4684 wrote to memory of 1344	4684	msedge.exe	86
PID 4684 wrote to memory of 1344	4684	msedge.exe	86
PID 4684 wrote to memory of 1344	4684	msedge.exe	86
PID 4684 wrote to memory of 1344	4684	msedge.exe	86
PID 4684 wrote to memory of 1344	4684	msedge.exe	86
PID 4684 wrote to memory of 1344	4684	msedge.exe	86
PID 4684 wrote to memory of 1344	4684	msedge.exe	86
PID 4684 wrote to memory of 1344	4684	msedge.exe	86
PID 4684 wrote to memory of 1344	4684	msedge.exe	86
PID 4684 wrote to memory of 1344	4684	msedge.exe	86
PID 4684 wrote to memory of 1344	4684	msedge.exe	86
PID 4684 wrote to memory of 1344	4684	msedge.exe	86
PID 4684 wrote to memory of 1344	4684	msedge.exe	86
PID 4684 wrote to memory of 1344	4684	msedge.exe	86
PID 4684 wrote to memory of 1344	4684	msedge.exe	86
PID 4684 wrote to memory of 1344	4684	msedge.exe	86
PID 4684 wrote to memory of 1344	4684	msedge.exe	86
PID 4684 wrote to memory of 1344	4684	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://storageinstance.oss-ap-southeast-1.aliyuncs.com/cincinati.zip
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa6d5146f8,0x7ffa6d514708,0x7ffa6d514718
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,15195144148252358111,17067276629538816466,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,15195144148252358111,17067276629538816466,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,15195144148252358111,17067276629538816466,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15195144148252358111,17067276629538816466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15195144148252358111,17067276629538816466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,15195144148252358111,17067276629538816466,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,15195144148252358111,17067276629538816466,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15195144148252358111,17067276629538816466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15195144148252358111,17067276629538816466,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2104,15195144148252358111,17067276629538816466,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15195144148252358111,17067276629538816466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2104,15195144148252358111,17067276629538816466,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15195144148252358111,17067276629538816466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15195144148252358111,17067276629538816466,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,15195144148252358111,17067276629538816466,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1792 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:736

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4288

C:\Users\Admin\AppData\Local\Temp\Temp1_cincinati.zip\RomanticCopyright.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_cincinati.zip\RomanticCopyright.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3892
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Uni Uni.cmd & Uni.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5272
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5740
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "wrsa opssvc"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5748
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5864
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5872
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 796989
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5932
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "SigConsumptionDisciplinesSong" Envelope
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5968
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Wan + ..\Module + ..\Is + ..\Read + ..\Bibliography + ..\Match + ..\Qld I
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6080
- - C:\Users\Admin\AppData\Local\Temp\796989\Dept.com
    Dept.com I
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:5160
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e92abdd88f38bd16a76b5880fef8fd93

SHA1
ecb0442d521283fed5d9ad591e68106fda010144

SHA256
225e803ca6c33edf9bb41b6488c4c599c76fb11b6d8f4d15843fb7d76bcbb62d

SHA512
4c37c6d73ae9f0dc633f09d175ed60595753297c79ebaba6109cf7bb21203368551446690186d89b4b7a87ce772246cd7064fcdbc7109c743343120c1b49f8fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e8a14f2a3707b33dfd3e6c9753fd0d40

SHA1
9d91eb20030ae90a46f32761a7dc357e4b7610ed

SHA256
cc7e831fbde63f778ea854e534ce75dbd823e717f39e8b958d8a4cf1ed340ad5

SHA512
e7cb270fb5fb1f437fdffdb4fae61dbd7cdfc776c88fdfc842beae706e095763c21dc0b1fad5d250f7c650db77db9abf0d42b5410558316d9da2ff13517aec4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1e502776f1cb1a27631fd419bb81e3f9

SHA1
36ddc5d15c9fb48c16f571fa9c13a09fbf162324

SHA256
e10d69f3086d8dc4476f701d09f34bef7e4829fea722df5d1ea87e049d7c9e66

SHA512
52278110cf48da3856dcb56b96db59af1efba88c69f388b8d60f452aebe9b486e2a48c56960a760a93ba8ae18a016f2f163e5843adfed6634c62e2d4406f6655

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ff50940a52f64a112e56f012870d32b5

SHA1
0efee79a3f182a895a0f107939a6a9ab5bcc022b

SHA256
7a73eafb913526f05d531b03b83b19f2111eeccebe1fab913c5bf52b4d448976

SHA512
28f2c14c85af2b88b9a7f13a38e402d9894070b688d31ab2ac34a399102a9d5900cc0da91f32b0f99c54c6ebbe13d4048aeb0d80006030a00d58a19d8cb67330

Download Submit
C:\Users\Admin\AppData\Local\Temp\796989\Dept.com

Filesize
921KB

MD5
78ba0653a340bac5ff152b21a83626cc

SHA1
b12da9cb5d024555405040e65ad89d16ae749502

SHA256
05d8cf394190f3a707abfb25fb44d7da9d5f533d7d2063b23c00cc11253c8be7

SHA512
efb75e4c1e0057ffb47613fd5aae8ce3912b1558a4b74dbf5284c942eac78ecd9aca98f7c1e0e96ec38e8177e58ffdf54f2eb0385e73eef39e8a2ce611237317

Download Submit
C:\Users\Admin\AppData\Local\Temp\796989\I

Filesize
489KB

MD5
35431b1f719e5f8edd3ee4c56d590bc9

SHA1
c4667dc8990f03e9d3410e636957d5e9c73773c7

SHA256
427536f6a144672b8c5cd873d89c0374dab2c6383256347eef80b291729b99b0

SHA512
358ea29b484c7e7d493fec6270a7d3a6147852ba68f1c1f5fd9dc277e65dc24239b3718fb1ca986f354b5ebc954dae51f1e478db9d034a6f3417f6564d967fbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bibliography

Filesize
91KB

MD5
0124e182e6ab32c597551f987c8efc9e

SHA1
5b1504b161a4748cfdff1463b4a370b7ee6caf14

SHA256
6484dd9a145b3178a2534dd802441a7b8d08a679c3241c11395c22bfa6ba6826

SHA512
70e76a19d9f3382e14463e9f79dee0db404482e714f1ca9b0330ad144c055b6c6464d9be6bbb94e7e05048925b8f2dd1049276b4982722b7e8a2d8fe7e2dd010

Download Submit
C:\Users\Admin\AppData\Local\Temp\Envelope

Filesize
1KB

MD5
930b977ce8cf5c68e617c0cc083b6915

SHA1
07ab167616b479dd68ea9cfdad2c51d180757596

SHA256
cd56fdf1345808d2c8d7a099dabc0d8667581b2888fa973eba477509f7875f3e

SHA512
a823ba03f129037c1feb58f7f5408070f512dc0d4044cbaa5aa28295a1e7d952b4172119a1609c271273e8b31ec6aed5d4b3a570cfc5bbc3846821eb1f791814

Download Submit
C:\Users\Admin\AppData\Local\Temp\Is

Filesize
56KB

MD5
84df1af81b44c0e9ac087f6b724dbfe1

SHA1
c2604b423fa3a1dfd0d41fd05364f390db94e0f0

SHA256
649f01b11633d4f45165010db7e1150d9ddf533fb2906cc7f26ebf4d3807d2c4

SHA512
b69aca208184bac03392a91a04cb737772576a2e29ad8a9549d1917c88e86d2fe12e22d9d1a9d01dd08eb1fefa27c13c26a14c41a0551e75dc72f3d64ce97403

Download Submit
C:\Users\Admin\AppData\Local\Temp\Match

Filesize
81KB

MD5
cce2e35fcd13802b894592bfa8bc4832

SHA1
e4b2ebbcea783891bae927d45a5d20a99b0d2c57

SHA256
49c9f0a08d446ac52e26ec0a79578d6e8cd0363adce44af727c537c2c127f278

SHA512
1f2ac58895ebf1a4c3989a5d76ffac39012fe511030508bfef1c164e0d8301f5f7ce2b87381604b1fa1a0443b5f6ca59948061f7a2f7634d6cdfa0880dc33798

Download Submit
C:\Users\Admin\AppData\Local\Temp\Module

Filesize
86KB

MD5
c3a23aa50702baadcffdb632c0781eaf

SHA1
26adb4b06851eb66a2fc3a4b2dc29055e6291e91

SHA256
e27aec3fc7086af2906fbf8d5a1a17e3f6871651f2663f8e5a3f5b44dd1e7d61

SHA512
545aefc06ba554d32183d8e96f3eafc6204e609d95c4bc8e8bbede315ccc78605d916533fabe995dd9e50b3a0ea63d12e64445e3346dafe24267281b8ca23284

Download Submit
C:\Users\Admin\AppData\Local\Temp\Qld

Filesize
39KB

MD5
47b8c8360718381beb75b78cad9989d4

SHA1
b1c9ed94b846670c0fbb0322b607b3e5affce120

SHA256
0d7c733985efc3042c41b2b26c32b7b8ce65ff9071ebdd872c3d0520a18351ed

SHA512
724d7030e1fab1adc5a9798e18cf75c11159cce1e57ab493a4595bdb14b68129c46a518616c427131963a7fd06e741965faca545fc5f007ab120cf28c1fe4d98

Download Submit
C:\Users\Admin\AppData\Local\Temp\Read

Filesize
62KB

MD5
b09b69ffbbb1c92beb55c7fd798c8c66

SHA1
a648e5a9721d8623dd6fca06d5295d1f07b13519

SHA256
4b54975d3405ea89c477daa9802d93b4a56683a901039d31e8eb1218deb742fa

SHA512
74d6cb22483b46a36887584c97060b16a1f8b6dcc280a8d9c7456d1c8c174b61487990af0bd7426b431ca7fde197ade2f5785784d27ab4371003feaecf2bb409

Download Submit
C:\Users\Admin\AppData\Local\Temp\Standing

Filesize
919KB

MD5
4414fe8f2635b6344106903d0f52455d

SHA1
70f135830f92733b3f0bbdfa35b1f0e36e9e5746

SHA256
578f765c46f2b2842f3455c37549326a9ea665aeedf5b86f6c3ff0be1a5f1244

SHA512
3c818c29afc91ce177db19c91026017cb567e2e6b0727ba271d66cc5c4f107661a677abc4ea5d1c281c56b3de166ed8ceaf298fa2ecb8f50a08bc1fcb6a0c91f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Uni

Filesize
7KB

MD5
df066c1e3038ff1c556a50a0782e0de1

SHA1
ebad7031e3b7651898e3d916d0aa0cb09397d03a

SHA256
cb4ca6cf393c39f6fffab51f095518826e38d4eff4fb0f42aa1fb9a4d7ef0b3a

SHA512
649874ac78af57207d1d06059e9e5eac3814c13910d08e9325cb500434ad4cb553cdab659db3291839523d0ae636251ac925224db04ea29dde8be41e1d8cb194

Download Submit
C:\Users\Admin\AppData\Local\Temp\Wan

Filesize
74KB

MD5
cf96668f1c4973c8b43a72d90221e4d3

SHA1
3b512b9979650f556936a5b0866387820d112745

SHA256
720160bb915923d8cf54be5d580ac5c13e67a261daf3ae65f972435dd716cd07

SHA512
1d9c6299cce257f780252fe4805836f4f27914a816ef89d81119e2553008083754bdb16f25f895f85e35ccb5daa5c5f79fcff2d203b40c5444c88f9fc76b276e

Download Submit
C:\Users\Admin\Downloads\cincinati.zip

Filesize
982KB

MD5
4b1eee4ab5a46f1215f7397a650e385f

SHA1
93104208b9a3e25900e2c6489c398ec1ae07db56

SHA256
3d36c412f3e9bd9983629b45cc34dc5ac1d48cec7232a3d8ace19ae1181f7649

SHA512
c25c93642125540ac105932fe813243357df50d48cea289effa259a3e7cc2b272e3674c3119ae075412d214ca71b05d9e9414d0a6d50d033364bbf2258d07bb3

Download Submit
memory/5160-290-0x0000000003C40000-0x0000000003C9F000-memory.dmp

Filesize
380KB

Download
memory/5160-289-0x0000000003C40000-0x0000000003C9F000-memory.dmp

Filesize
380KB

Download
memory/5160-294-0x0000000003C40000-0x0000000003C9F000-memory.dmp

Filesize
380KB

Download
memory/5160-293-0x0000000003C40000-0x0000000003C9F000-memory.dmp

Filesize
380KB

Download
memory/5160-292-0x0000000003C40000-0x0000000003C9F000-memory.dmp

Filesize
380KB

Download
memory/5160-291-0x0000000003C40000-0x0000000003C9F000-memory.dmp

Filesize
380KB

Download