umbral | fb909a020c044cd3da4445891bbf2e3dbeb9527e84ce04efc0640b43061da547

Analysis

max time kernel
31s
max time network
29s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
24-12-2024 21:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

roblox beamer.exe
Size

229KB
MD5

e8291587d7fd8bc8704e1115abe62ac6
SHA1

6a71de3d8aece949377efd526a222939ad3a01f5
SHA256

fb909a020c044cd3da4445891bbf2e3dbeb9527e84ce04efc0640b43061da547
SHA512

806a572f8784a37138b4fb19b4b7dbc93ef2b7e14aba9bb3a78c2d6a3882f1c0b5eb36c21e98065f7c5454a9e33f07aa200b13fb2cebd8a52c16b401603cf994
SSDEEP

6144:qloZM+rIkd8g+EtXHkv/iD4EjKLBPUon+WvRsY9GLb8e1mji:UoZtL+EP8EjKLBPUon+WvRsY9wZ

Score

10^/10

umbral discovery execution spyware stealer

Malware Config

Signatures

Detect Umbral payload 1 IoCs

resource	yara_rule
behavioral1/memory/2168-1-0x000001DC50950000-0x000001DC50990000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Umbral family
umbral

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4948	powershell.exe
616	powershell.exe
3308	powershell.exe
3280	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	roblox beamer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	discord.com
7	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1520	cmd.exe
4132	PING.EXE

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4848	wmic.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4132	PING.EXE

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
2168	roblox beamer.exe
3280	powershell.exe
3280	powershell.exe
4948	powershell.exe
4948	powershell.exe
616	powershell.exe
616	powershell.exe
1504	powershell.exe
1504	powershell.exe
3308	powershell.exe
3308	powershell.exe
3124	msedge.exe
3124	msedge.exe
3128	msedge.exe
3128	msedge.exe
1588	identity_helper.exe
1588	identity_helper.exe
1124	msedge.exe
1124	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2168	roblox beamer.exe
Token: SeIncreaseQuotaPrivilege	1656	wmic.exe
Token: SeSecurityPrivilege	1656	wmic.exe
Token: SeTakeOwnershipPrivilege	1656	wmic.exe
Token: SeLoadDriverPrivilege	1656	wmic.exe
Token: SeSystemProfilePrivilege	1656	wmic.exe
Token: SeSystemtimePrivilege	1656	wmic.exe
Token: SeProfSingleProcessPrivilege	1656	wmic.exe
Token: SeIncBasePriorityPrivilege	1656	wmic.exe
Token: SeCreatePagefilePrivilege	1656	wmic.exe
Token: SeBackupPrivilege	1656	wmic.exe
Token: SeRestorePrivilege	1656	wmic.exe
Token: SeShutdownPrivilege	1656	wmic.exe
Token: SeDebugPrivilege	1656	wmic.exe
Token: SeSystemEnvironmentPrivilege	1656	wmic.exe
Token: SeRemoteShutdownPrivilege	1656	wmic.exe
Token: SeUndockPrivilege	1656	wmic.exe
Token: SeManageVolumePrivilege	1656	wmic.exe
Token: 33	1656	wmic.exe
Token: 34	1656	wmic.exe
Token: 35	1656	wmic.exe
Token: 36	1656	wmic.exe
Token: SeIncreaseQuotaPrivilege	1656	wmic.exe
Token: SeSecurityPrivilege	1656	wmic.exe
Token: SeTakeOwnershipPrivilege	1656	wmic.exe
Token: SeLoadDriverPrivilege	1656	wmic.exe
Token: SeSystemProfilePrivilege	1656	wmic.exe
Token: SeSystemtimePrivilege	1656	wmic.exe
Token: SeProfSingleProcessPrivilege	1656	wmic.exe
Token: SeIncBasePriorityPrivilege	1656	wmic.exe
Token: SeCreatePagefilePrivilege	1656	wmic.exe
Token: SeBackupPrivilege	1656	wmic.exe
Token: SeRestorePrivilege	1656	wmic.exe
Token: SeShutdownPrivilege	1656	wmic.exe
Token: SeDebugPrivilege	1656	wmic.exe
Token: SeSystemEnvironmentPrivilege	1656	wmic.exe
Token: SeRemoteShutdownPrivilege	1656	wmic.exe
Token: SeUndockPrivilege	1656	wmic.exe
Token: SeManageVolumePrivilege	1656	wmic.exe
Token: 33	1656	wmic.exe
Token: 34	1656	wmic.exe
Token: 35	1656	wmic.exe
Token: 36	1656	wmic.exe
Token: SeDebugPrivilege	3280	powershell.exe
Token: SeDebugPrivilege	4948	powershell.exe
Token: SeDebugPrivilege	616	powershell.exe
Token: SeDebugPrivilege	1504	powershell.exe
Token: SeIncreaseQuotaPrivilege	3608	wmic.exe
Token: SeSecurityPrivilege	3608	wmic.exe
Token: SeTakeOwnershipPrivilege	3608	wmic.exe
Token: SeLoadDriverPrivilege	3608	wmic.exe
Token: SeSystemProfilePrivilege	3608	wmic.exe
Token: SeSystemtimePrivilege	3608	wmic.exe
Token: SeProfSingleProcessPrivilege	3608	wmic.exe
Token: SeIncBasePriorityPrivilege	3608	wmic.exe
Token: SeCreatePagefilePrivilege	3608	wmic.exe
Token: SeBackupPrivilege	3608	wmic.exe
Token: SeRestorePrivilege	3608	wmic.exe
Token: SeShutdownPrivilege	3608	wmic.exe
Token: SeDebugPrivilege	3608	wmic.exe
Token: SeSystemEnvironmentPrivilege	3608	wmic.exe
Token: SeRemoteShutdownPrivilege	3608	wmic.exe
Token: SeUndockPrivilege	3608	wmic.exe
Token: SeManageVolumePrivilege	3608	wmic.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 1656	2168	roblox beamer.exe	77
PID 2168 wrote to memory of 1656	2168	roblox beamer.exe	77
PID 2168 wrote to memory of 1580	2168	roblox beamer.exe	80
PID 2168 wrote to memory of 1580	2168	roblox beamer.exe	80
PID 2168 wrote to memory of 3280	2168	roblox beamer.exe	82
PID 2168 wrote to memory of 3280	2168	roblox beamer.exe	82
PID 2168 wrote to memory of 4948	2168	roblox beamer.exe	84
PID 2168 wrote to memory of 4948	2168	roblox beamer.exe	84
PID 2168 wrote to memory of 616	2168	roblox beamer.exe	86
PID 2168 wrote to memory of 616	2168	roblox beamer.exe	86
PID 2168 wrote to memory of 1504	2168	roblox beamer.exe	88
PID 2168 wrote to memory of 1504	2168	roblox beamer.exe	88
PID 2168 wrote to memory of 3608	2168	roblox beamer.exe	90
PID 2168 wrote to memory of 3608	2168	roblox beamer.exe	90
PID 2168 wrote to memory of 4316	2168	roblox beamer.exe	92
PID 2168 wrote to memory of 4316	2168	roblox beamer.exe	92
PID 2168 wrote to memory of 2896	2168	roblox beamer.exe	94
PID 2168 wrote to memory of 2896	2168	roblox beamer.exe	94
PID 2168 wrote to memory of 3308	2168	roblox beamer.exe	96
PID 2168 wrote to memory of 3308	2168	roblox beamer.exe	96
PID 2168 wrote to memory of 4848	2168	roblox beamer.exe	98
PID 2168 wrote to memory of 4848	2168	roblox beamer.exe	98
PID 2168 wrote to memory of 1520	2168	roblox beamer.exe	100
PID 2168 wrote to memory of 1520	2168	roblox beamer.exe	100
PID 1520 wrote to memory of 4132	1520	cmd.exe	102
PID 1520 wrote to memory of 4132	1520	cmd.exe	102
PID 3124 wrote to memory of 3000	3124	msedge.exe	106
PID 3124 wrote to memory of 3000	3124	msedge.exe	106
PID 3124 wrote to memory of 4588	3124	msedge.exe	107
PID 3124 wrote to memory of 4588	3124	msedge.exe	107
PID 3124 wrote to memory of 4588	3124	msedge.exe	107
PID 3124 wrote to memory of 4588	3124	msedge.exe	107
PID 3124 wrote to memory of 4588	3124	msedge.exe	107
PID 3124 wrote to memory of 4588	3124	msedge.exe	107
PID 3124 wrote to memory of 4588	3124	msedge.exe	107
PID 3124 wrote to memory of 4588	3124	msedge.exe	107
PID 3124 wrote to memory of 4588	3124	msedge.exe	107
PID 3124 wrote to memory of 4588	3124	msedge.exe	107
PID 3124 wrote to memory of 4588	3124	msedge.exe	107
PID 3124 wrote to memory of 4588	3124	msedge.exe	107
PID 3124 wrote to memory of 4588	3124	msedge.exe	107
PID 3124 wrote to memory of 4588	3124	msedge.exe	107
PID 3124 wrote to memory of 4588	3124	msedge.exe	107
PID 3124 wrote to memory of 4588	3124	msedge.exe	107
PID 3124 wrote to memory of 4588	3124	msedge.exe	107
PID 3124 wrote to memory of 4588	3124	msedge.exe	107
PID 3124 wrote to memory of 4588	3124	msedge.exe	107
PID 3124 wrote to memory of 4588	3124	msedge.exe	107
PID 3124 wrote to memory of 4588	3124	msedge.exe	107
PID 3124 wrote to memory of 4588	3124	msedge.exe	107
PID 3124 wrote to memory of 4588	3124	msedge.exe	107
PID 3124 wrote to memory of 4588	3124	msedge.exe	107
PID 3124 wrote to memory of 4588	3124	msedge.exe	107
PID 3124 wrote to memory of 4588	3124	msedge.exe	107
PID 3124 wrote to memory of 4588	3124	msedge.exe	107
PID 3124 wrote to memory of 4588	3124	msedge.exe	107
PID 3124 wrote to memory of 4588	3124	msedge.exe	107
PID 3124 wrote to memory of 4588	3124	msedge.exe	107
PID 3124 wrote to memory of 4588	3124	msedge.exe	107
PID 3124 wrote to memory of 4588	3124	msedge.exe	107
PID 3124 wrote to memory of 4588	3124	msedge.exe	107
PID 3124 wrote to memory of 4588	3124	msedge.exe	107
PID 3124 wrote to memory of 4588	3124	msedge.exe	107
PID 3124 wrote to memory of 4588	3124	msedge.exe	107

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1580	attrib.exe

C:\Users\Admin\AppData\Local\Temp\roblox beamer.exe
"C:\Users\Admin\AppData\Local\Temp\roblox beamer.exe"
1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1656
- C:\Windows\SYSTEM32\attrib.exe
  "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\roblox beamer.exe"
  2⤵
  - Views/modifies file attributes
  PID:1580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\roblox beamer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:616
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1504
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" os get Caption
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3608
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" computersystem get totalphysicalmemory
  2⤵
  PID:4316
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:2896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3308
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:4848
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\roblox beamer.exe" && pause
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1520
- - C:\Windows\system32\PING.EXE
    ping localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbeeff3cb8,0x7ffbeeff3cc8,0x7ffbeeff3cd8
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,3591425552370205945,8392213476134299904,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1884,3591425552370205945,8392213476134299904,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1884,3591425552370205945,8392213476134299904,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3591425552370205945,8392213476134299904,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3591425552370205945,8392213476134299904,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3591425552370205945,8392213476134299904,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3591425552370205945,8392213476134299904,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1884,3591425552370205945,8392213476134299904,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1884,3591425552370205945,8392213476134299904,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3591425552370205945,8392213476134299904,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3591425552370205945,8392213476134299904,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2840

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4c1a24fa898d2a98b540b20272c8e47b

SHA1
3218bff9ce95b52842fa1b8bd00be073177141ef

SHA256
bbcc378fcbf64580e7a48b4e7ca9be57fa0a1f2e747f488325685bdb18d73a95

SHA512
e61f196e7f1c9a5fe249abe9b11eea770fb2f4babc61f60b12c71f43e6fe9354cf14869daf46abc2c2655bce180252acd43c10562a2dcd31fa7d90d33253820e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f1d2c7fd2ca29bb77a5da2d1847fbb92

SHA1
840de2cf36c22ba10ac96f90890b6a12a56526c6

SHA256
58d0f80310f4a84f687c5ce0adaa982eb42fe4480510399fa2ae975d40bb8bc5

SHA512
ede1fafea2404f16948fe0b5ea5161ccee3ee6e40c55ff98c337eac981a6776b9c73dc030a5c59e4347aec91259f497539206e71949c33adcecbf2c846709e14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d0c35625324eb22ce06c528a78490386

SHA1
44f1790258dd4ff65934669313fdcda82cb5a8cf

SHA256
f7345d68ea5bd3c00422bcb8856ad817113561e8dbdb1a778b4c663f93fe2177

SHA512
ef37a7ef847d40b281873fc0f76087e79093113cbbbea1baba2f284288194ea50cffbf3eb0c74d666326e3858eceef82ee5f46f22a3815c4c150b7dde6d07177

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
11ccc12e02e529fcecf4390e7788914f

SHA1
bec562f22de3f09ceb5d1a236b46d12c777d36fb

SHA256
38ad9883cf4c4828f67a18fe30b8f280ea493764185ac777cf4c3cc62d7b9acf

SHA512
f5d701a759f4cc114b1b36e6f4d7bfd28f8f790c7fb266331507fd7ad91b4e9c7c82e01ab981b1c6bace7d24b762eda7a544dea31b55a5cd9c69082268c54079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
bb06d74dabb83b6620b7bf925bcf380f

SHA1
cdcda7c7a2eab7fb794ca106a1946912818d41df

SHA256
e8f1194adea0ca3c91270801d4211e78b2b11aa7ef64a6af5e99c999901f33f6

SHA512
ad6412d9ca1853e246f035d6216c6def3ab5c16a3cd1060ca2e8f0d568b39ca7c6453f3cba8df5755855abc6833f42bd72d3464099514f0e48267d14ca03f36c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
1a9fa92a4f2e2ec9e244d43a6a4f8fb9

SHA1
9910190edfaccece1dfcc1d92e357772f5dae8f7

SHA256
0ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888

SHA512
5d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
02975ea0938bd97fc7230f785cd825a7

SHA1
192713c1f2912016fb8c2f1ed8eb8be4a883218d

SHA256
c330ecfbea7de88e537747edbb97192cbca39b8ec65e9dc6105d2a7a3e3d6859

SHA512
52e28301d3981c4eb78988018a7c56788e1ebbea586612f68016cad8317223a74851bb6a3f91f62d1e8c914c075c775810c90f5994ecadd73c635194aaaf5bf9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
f29ff8b1e0f396a194a6782749830b8e

SHA1
2f8999b0eb2a20e591cf9a638c9fa84ddf4a1f69

SHA256
5bfd4968395fefaac3941c08fa11e86dfde1072137d9290aee3888f2a5d92d3f

SHA512
0689d665f2a7c9007c5dc4c14a53d5566d315d05d476bee82d64d02d40e3ffddca2b36419c76a8f7b7979958a62a7a93c939d1ed72fa7a844841ed06741b9e19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
38ecc5b95c11e5a77558753102979c51

SHA1
c0759b08ef377df9979d8835d8a7e464cd8eaf6b

SHA256
2eb69abe0af5a2fb5bb313533cef641e25016876b874353f7d737c7ad672c79e

SHA512
9bf4ce3bc097bdd0242bd105c936a9c9403d5ac83ec99e6a310591a7b8d26309485f3e0cdc4cba67c322f834c325a2b63a008adb078f3a3307094c4b68a48686

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rh3htcyg.obl.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
2KB

MD5
4028457913f9d08b06137643fe3e01bc

SHA1
a5cb3f12beaea8194a2d3d83a62bdb8d558f5f14

SHA256
289d433902418aaf62e7b96b215ece04fcbcef2457daf90f46837a4d5090da58

SHA512
c8e1eef90618341bbde885fd126ece2b1911ca99d20d82f62985869ba457553b4c2bf1e841fd06dacbf27275b3b0940e5a794e1b1db0fd56440a96592362c28b

Download Submit
memory/2168-2-0x00007FFBDD050000-0x00007FFBDDB12000-memory.dmp

Filesize
10.8MB

Download
memory/2168-33-0x000001DC6B210000-0x000001DC6B22E000-memory.dmp

Filesize
120KB

Download
memory/2168-31-0x000001DC6B190000-0x000001DC6B206000-memory.dmp

Filesize
472KB

Download
memory/2168-1-0x000001DC50950000-0x000001DC50990000-memory.dmp

Filesize
256KB

Download
memory/2168-68-0x000001DC52780000-0x000001DC5278A000-memory.dmp

Filesize
40KB

Download
memory/2168-69-0x000001DC6B160000-0x000001DC6B172000-memory.dmp

Filesize
72KB

Download
memory/2168-0-0x00007FFBDD053000-0x00007FFBDD055000-memory.dmp

Filesize
8KB

Download
memory/2168-88-0x00007FFBDD050000-0x00007FFBDDB12000-memory.dmp

Filesize
10.8MB

Download
memory/2168-32-0x000001DC6B110000-0x000001DC6B160000-memory.dmp

Filesize
320KB

Download
memory/3280-11-0x00000205B3A20000-0x00000205B3A42000-memory.dmp

Filesize
136KB

Download
memory/3280-4-0x00007FFBDD050000-0x00007FFBDDB12000-memory.dmp

Filesize
10.8MB

Download
memory/3280-3-0x00007FFBDD050000-0x00007FFBDDB12000-memory.dmp

Filesize
10.8MB

Download
memory/3280-5-0x00007FFBDD050000-0x00007FFBDDB12000-memory.dmp

Filesize
10.8MB

Download
memory/3280-17-0x00007FFBDD050000-0x00007FFBDDB12000-memory.dmp

Filesize
10.8MB

Download