lumma | hxxps://www[.]mediafire[.]com/folder/wgv57fim9g8eh/NewPeggsEx

Resubmissions

29/12/2024, 22:38

241229-2kp72aypex 3

29/12/2024, 22:26

241229-2cxl5symht 10

Analysis

max time kernel
175s
max time network
178s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
29/12/2024, 22:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/folder/wgv57fim9g8eh/NewPeggsEx

Score

10^/10

lumma discovery phishing stealer

Malware Config

Extracted

Family

lumma

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

https://ingreem-eilish.biz/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing

Executes dropped EXE 3 IoCs

pid	Process
4640	BasesRow.exe
2644	BasesRow.exe
3872	BasesRow.exe

Loads dropped DLL 3 IoCs

pid	Process
4640	BasesRow.exe
2644	BasesRow.exe
3872	BasesRow.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4640 set thread context of 1804	4640	BasesRow.exe	105
PID 2644 set thread context of 4412	2644	BasesRow.exe	115
PID 3872 set thread context of 4148	3872	BasesRow.exe	120

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4940	4640	WerFault.exe	101
4048	2644	WerFault.exe	113
1976	3872	WerFault.exe	118

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BasesRow.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_regiis.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BasesRow.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_regiis.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BasesRow.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_regiis.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\_Instаll_UPD_2.3.3.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4936	msedge.exe
4936	msedge.exe
3364	msedge.exe
3364	msedge.exe
4860	msedge.exe
4860	msedge.exe
720	identity_helper.exe
720	identity_helper.exe
2620	msedge.exe
2620	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	5072	7zG.exe
Token: 35	5072	7zG.exe
Token: SeSecurityPrivilege	5072	7zG.exe
Token: SeSecurityPrivilege	5072	7zG.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3364 wrote to memory of 4556	3364	msedge.exe	77
PID 3364 wrote to memory of 4556	3364	msedge.exe	77
PID 3364 wrote to memory of 2040	3364	msedge.exe	78
PID 3364 wrote to memory of 2040	3364	msedge.exe	78
PID 3364 wrote to memory of 2040	3364	msedge.exe	78
PID 3364 wrote to memory of 2040	3364	msedge.exe	78
PID 3364 wrote to memory of 2040	3364	msedge.exe	78
PID 3364 wrote to memory of 2040	3364	msedge.exe	78
PID 3364 wrote to memory of 2040	3364	msedge.exe	78
PID 3364 wrote to memory of 2040	3364	msedge.exe	78
PID 3364 wrote to memory of 2040	3364	msedge.exe	78
PID 3364 wrote to memory of 2040	3364	msedge.exe	78
PID 3364 wrote to memory of 2040	3364	msedge.exe	78
PID 3364 wrote to memory of 2040	3364	msedge.exe	78
PID 3364 wrote to memory of 2040	3364	msedge.exe	78
PID 3364 wrote to memory of 2040	3364	msedge.exe	78
PID 3364 wrote to memory of 2040	3364	msedge.exe	78
PID 3364 wrote to memory of 2040	3364	msedge.exe	78
PID 3364 wrote to memory of 2040	3364	msedge.exe	78
PID 3364 wrote to memory of 2040	3364	msedge.exe	78
PID 3364 wrote to memory of 2040	3364	msedge.exe	78
PID 3364 wrote to memory of 2040	3364	msedge.exe	78
PID 3364 wrote to memory of 2040	3364	msedge.exe	78
PID 3364 wrote to memory of 2040	3364	msedge.exe	78
PID 3364 wrote to memory of 2040	3364	msedge.exe	78
PID 3364 wrote to memory of 2040	3364	msedge.exe	78
PID 3364 wrote to memory of 2040	3364	msedge.exe	78
PID 3364 wrote to memory of 2040	3364	msedge.exe	78
PID 3364 wrote to memory of 2040	3364	msedge.exe	78
PID 3364 wrote to memory of 2040	3364	msedge.exe	78
PID 3364 wrote to memory of 2040	3364	msedge.exe	78
PID 3364 wrote to memory of 2040	3364	msedge.exe	78
PID 3364 wrote to memory of 2040	3364	msedge.exe	78
PID 3364 wrote to memory of 2040	3364	msedge.exe	78
PID 3364 wrote to memory of 2040	3364	msedge.exe	78
PID 3364 wrote to memory of 2040	3364	msedge.exe	78
PID 3364 wrote to memory of 2040	3364	msedge.exe	78
PID 3364 wrote to memory of 2040	3364	msedge.exe	78
PID 3364 wrote to memory of 2040	3364	msedge.exe	78
PID 3364 wrote to memory of 2040	3364	msedge.exe	78
PID 3364 wrote to memory of 2040	3364	msedge.exe	78
PID 3364 wrote to memory of 2040	3364	msedge.exe	78
PID 3364 wrote to memory of 4936	3364	msedge.exe	79
PID 3364 wrote to memory of 4936	3364	msedge.exe	79
PID 3364 wrote to memory of 4456	3364	msedge.exe	80
PID 3364 wrote to memory of 4456	3364	msedge.exe	80
PID 3364 wrote to memory of 4456	3364	msedge.exe	80
PID 3364 wrote to memory of 4456	3364	msedge.exe	80
PID 3364 wrote to memory of 4456	3364	msedge.exe	80
PID 3364 wrote to memory of 4456	3364	msedge.exe	80
PID 3364 wrote to memory of 4456	3364	msedge.exe	80
PID 3364 wrote to memory of 4456	3364	msedge.exe	80
PID 3364 wrote to memory of 4456	3364	msedge.exe	80
PID 3364 wrote to memory of 4456	3364	msedge.exe	80
PID 3364 wrote to memory of 4456	3364	msedge.exe	80
PID 3364 wrote to memory of 4456	3364	msedge.exe	80
PID 3364 wrote to memory of 4456	3364	msedge.exe	80
PID 3364 wrote to memory of 4456	3364	msedge.exe	80
PID 3364 wrote to memory of 4456	3364	msedge.exe	80
PID 3364 wrote to memory of 4456	3364	msedge.exe	80
PID 3364 wrote to memory of 4456	3364	msedge.exe	80
PID 3364 wrote to memory of 4456	3364	msedge.exe	80
PID 3364 wrote to memory of 4456	3364	msedge.exe	80
PID 3364 wrote to memory of 4456	3364	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.mediafire.com/folder/wgv57fim9g8eh/NewPeggsEx
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8566e3cb8,0x7ff8566e3cc8,0x7ff8566e3cd8
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1948,4369737672999457227,18232354127777808049,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1960 /prefetch:2
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1948,4369737672999457227,18232354127777808049,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1948,4369737672999457227,18232354127777808049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,4369737672999457227,18232354127777808049,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,4369737672999457227,18232354127777808049,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,4369737672999457227,18232354127777808049,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,4369737672999457227,18232354127777808049,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1948,4369737672999457227,18232354127777808049,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,4369737672999457227,18232354127777808049,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,4369737672999457227,18232354127777808049,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,4369737672999457227,18232354127777808049,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1948,4369737672999457227,18232354127777808049,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6752 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,4369737672999457227,18232354127777808049,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6436 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,4369737672999457227,18232354127777808049,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6628 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,4369737672999457227,18232354127777808049,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,4369737672999457227,18232354127777808049,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,4369737672999457227,18232354127777808049,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6864 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1948,4369737672999457227,18232354127777808049,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1948,4369737672999457227,18232354127777808049,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6508 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:704

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4412

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\_Instаll_UPD_2.3.3\" -ad -an -ai#7zMap31644:98:7zEvent17762
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5072

C:\Users\Admin\Downloads\_Instаll_UPD_2.3.3\BasesRow.exe
"C:\Users\Admin\Downloads\_Instаll_UPD_2.3.3\BasesRow.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4640
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1804
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4640 -s 1084
  2⤵
  - Program crash
  PID:4940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4640 -ip 4640
1⤵
PID:1456

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\_Instаll_UPD_2.3.3\jres\README.txt
1⤵
PID:4004

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\_Instаll_UPD_2.3.3\jres\THIRDPARTYLICENSEREADME.txt
1⤵
PID:1344

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\_Instаll_UPD_2.3.3\jres\THIRDPARTYLICENSEREADME-JAVAFX.txt
1⤵
PID:1680

C:\Users\Admin\Downloads\_Instаll_UPD_2.3.3\BasesRow.exe
"C:\Users\Admin\Downloads\_Instаll_UPD_2.3.3\BasesRow.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2644
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4412
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 1048
  2⤵
  - Program crash
  PID:4048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2644 -ip 2644
1⤵
PID:400

C:\Users\Admin\Downloads\_Instаll_UPD_2.3.3\BasesRow.exe
"C:\Users\Admin\Downloads\_Instаll_UPD_2.3.3\BasesRow.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3872
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4148
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 1048
  2⤵
  - Program crash
  PID:1976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 3872 -ip 3872
1⤵
PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c0a1774f8079fe496e694f35dfdcf8bc

SHA1
da3b4b9fca9a3f81b6be5b0cd6dd700603d448d3

SHA256
c041da0b90a5343ede7364ccf0428852103832c4efa8065a0cd1e8ce1ff181cb

SHA512
60d9e87f8383fe3afa2c8935f0e5a842624bb24b03b2d8057e0da342b08df18cf70bf55e41fa3ae54f73bc40a274cf6393d79ae01f6a1784273a25fa2761728b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e11c77d0fa99af6b1b282a22dcb1cf4a

SHA1
2593a41a6a63143d837700d01aa27b1817d17a4d

SHA256
d96f9bfcc81ba66db49a3385266a631899a919ed802835e6fb6b9f7759476ea0

SHA512
c8f69f503ab070a758e8e3ae57945c0172ead1894fdbfa2d853e5bb976ed3817ecc8f188eefd5092481effd4ef650788c8ff9a8d9a5ee4526f090952d7c859f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002d

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
3018f25599190fb5652a2683f5b8a327

SHA1
7d679dd1544ec5f93c8cc581ed995a640d37877c

SHA256
c197dbc47c90cf8937107ac39bf67ef3a0be867770a43f4a39109116cd5a0868

SHA512
6e45f3aa1835d3e3256e9ea07dc57b9bfe95f083a34c313a506e5a18d7bb38d755735695583ad8dc514dd8b6951d43091c73a010805dbff9533002b0d35a1200

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
46ed03c4f19f0d75066432aafd68a7b9

SHA1
f096a7e1253ed87f8f0ce61a9a11cb3543784f8c

SHA256
b33aff4ffa8203ccf389a5b8c99a43453aa8bac41d31d6bd4c2a7e2c12365dfc

SHA512
836295cb046f74c3985a54017089ead8dd7862d1cdd0e66414b79e0c36fb6d3c05924ab13faf4fd99e466367c6d8a815f0910abc80e2e7a6369c0bed1d514189

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
d0929d436d066ff4e8f380080a2c8061

SHA1
ab0edb8d8a5dabae9ac08fdc4b042defddda6947

SHA256
631798805ca0e59f4d91a328b9318087b14e35681d5d7586ff83addc1aa5be7d

SHA512
02c7019391ec41f45f22c7a4b8a7038c32a6f87b718e61ed5b5709d1a181c069ac2210d294034dbad394cb5e2660d008e2ead2259dd1c23245a2ce208caa87de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
321e91e169d8404a8cde2ec04dfdc5ed

SHA1
c75ba92523ce25ead37e6b38a59ba3231c20c70f

SHA256
cf1dd08884b47c74e239aa8e25789242a3953c3e5d0b9df3bcef50936647a4e6

SHA512
43ea720555ffcd94f8c966a617d5e3a558d7c1db663e51940df4a32e1f6ceb89dc86e136f238dafd8274ac7a84dec31a70a6b9166bcd2d9d41a637fc9e4b0f55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
e62fd6c8aeaa98f9ec499ec951f4f02a

SHA1
87740c84cc38b56942aead573f0eecc078418f44

SHA256
e66e95de411fe36ce6dab0aa118430440133f01def1f921c7f986e848408ecfa

SHA512
50a25551e623bb05e679b3d93b387a514fc07e6da1d7ce2836e73b6ee7a86b83b89654e2a802e2ccf7819bc1f957e42221f43dfe6a304c7c89a78d06e1061cbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
a5768298e4ff77ec4a565b721c6f8797

SHA1
9919c1125f78d67c3a90c1a00821e775d83c6d9b

SHA256
36167b49b1c1c430b589dd1a5f00c0159bd4b15c6000098b57a0d2c404b99ec9

SHA512
41fba6dd1331ca569e32068a8eee749471a8844a7610cfeee797518f46c4f18b45bde4995ec182134303eb8a14c84035571ea9045fa3beafaa2b7efaee2cbf2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
604a4bdb81832906df50c3c61274acf7

SHA1
99f95b2da342a12a5fd9705d46d359751d7f4a2e

SHA256
c77cf76f655d3565ef12ab8ec4fda7b8196a50c587fa97e5e7cecaa202e40855

SHA512
b34c1a5efce431327f4cf27981b9bb2232f85c90855b206cd64bd1a3a99c1af538f2f6ea103cb9ebce2818706b2c483c83b43e81cf81fb9c6149cc437d35818d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
082c30ab36efbedd43f9cc858a87ee7d

SHA1
1ba1c84d34da2a4a3b871f512b23042737906edd

SHA256
320e3364e7873b4b6702fac8d2e0260ece3262f5d65d1177c2875f56e0d919c5

SHA512
8e4d891a9de4af3d44df081a924c991f277ef4f47824a4d987da453bbb18926840e2f55834fe2063e4aac759f50d7bd5550439bbd3711a3b9073f8dcf92a8327

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
f4bc45622576766bc52d593b679344ef

SHA1
0c96015da19054d0866a8f9a465937333bf5f671

SHA256
6be6f2f91f7431bb341fc8865e33afbe6c3919149a5b8b25847daeb8fa2948f5

SHA512
61bb81ee5fbced2d3400e156bf892818dcfb20d76aa1d428880efb105b291b1940a3445849d1000ed36862110a2d946b89674e3c993fdc6dff8c9adee104a161

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
86aa89de026dce4c369fe9315c37f19d

SHA1
5abf41a10415e307bdf48e06fcde467a270ca785

SHA256
df856f1d427267e9bf09548348df6255be88e4abdf8adf9c7e76e078bdb636f0

SHA512
92cf3de03b03b544338706e5c38b5a1fde0f3cb84eba6520f9445a218de0dff4318e748fdf9eb952f703622250fe506fc83e17977936cb9d80ec7768de70468c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe580cad.TMP

Filesize
48B

MD5
ea173d833f44c7154579d07aadb538bf

SHA1
206cd42c2d3c42f7ad67426056c088e7ce2e6e38

SHA256
8247c2fdab86c21ba1dd62d83eb881c62271d7a7a1a518f0cb455adddc3695bc

SHA512
e7e285aac93dc64bf92899c786ec9281eafc968469b6b59b77de6940da7e864c0f1725f30f29577deeff8a0e5777926247bd9fd1321a6b71f437bbd6bb60e705

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3dde975ddf84ddd40c5e356b20fbdc41

SHA1
2d1f36e13adf63c4354db3597c2c6b7148954776

SHA256
2e0110a4814d3e0110e6995bf0b543cd39ca37a618b57dd3f7f9f77223cde89f

SHA512
ca9d52d3087fbb9a5146c32678a4fe9ed17f94cc713529b30761a0c1900084ee5a6645daa2376a753080c98c7d991278378c5e07c13470daa8ce2e26324e3b45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c68c.TMP

Filesize
1KB

MD5
2995245f6829bfabad83a8e40580dc0f

SHA1
42aff3aabf55c427b4f3c1996e7daa5fee6dd147

SHA256
bbe5848bd3dae1d97392aa2954e3fafb3ae4c5f4654772309572d65531cbaeed

SHA512
63bb34db7760abb198bf0ed7db289f6f62953516cae06339d4588590830009d7c4c66c6021390801e807f7fa736b76c7c69c86e7bca6220a2cdba6aaee4af571

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4cdbb405493dbb372dad73f1ea61bcb3

SHA1
c44d6beb4ad75b4b7a67fa860d6a1ce85c93dd72

SHA256
1f2895be2e7736ac1f195965263801ffdcc2eba3c31121eb6411ec69d94c587f

SHA512
e29720a2caf3bd8dd95effb6aee84f0f79e389ecc54e2b6e24ad58b33e7c613e29686c47f2a3335eb84887b5482ed7eacb60effb0ab3aa6778969482436fd158

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
be4872cdd5592455928c71924b9e5f7d

SHA1
7d9293c163c8e2aff37ef50fe3d1b61ecfc8d0ba

SHA256
f1d20ef6e925406bc6f782e1658e0dc4a8d96d4b1bf4b6479ffd586a560b0397

SHA512
4a3b048b69858bc33015051e55f11fbdeb1041e0905496f75a6d55b3f80a1ba9f37a0930e6428ef05b185c8f3f2c3ce838d666ecad97a3fb83d1822a14a054cc

Download Submit
C:\Users\Admin\AppData\Roaming\gdi32.dll

Filesize
437KB

MD5
719b51d853f1d8a5b2d704db5736bee2

SHA1
b274871c8e03dd13b2c1099763b3ecb919a751b1

SHA256
56112f1fb0b4cb0d81bc58c8be898ad644b8e0fc3d2beac6635c200b69321aa2

SHA512
dc25f57a88e1b1edc3b36e6ac543181bb1103b392f33b2e288e86cd68ab89f232dcf7328b030543336a0a5223674a4ee6959025e0d508e85af96636c97205fa8

Download Submit
C:\Users\Admin\Downloads\_Instаll_UPD_2.3.3.zip

Filesize
31.6MB

MD5
39605e3e5a00fe66c950f740bf43a031

SHA1
4a43b08296ecb6b8e392e09f7609d04adaad9601

SHA256
2bb93dac54dc7ccb409449ff5956d95a8383ae1399c71c645c024182e2e02061

SHA512
9a48b239c678c6948cf0c6fa795bc7bfca500c4504a620989f6a5e3cc2c9c93149f66987829ba537dbc7449b5c30328fe765c7b768c80d76df22933edb0ac728

Download Submit
C:\Users\Admin\Downloads\_Instаll_UPD_2.3.3.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\_Instаll_UPD_2.3.3\BasesRow.exe

Filesize
696KB

MD5
5ff8f2113356c908d9b58d930f55f210

SHA1
e8b8b6e3feb904bf8e463b744f7763e172866c56

SHA256
7ff818c2d6bb4329ebc91219c45807e5b96e49bca7e0960a8b71e7e03b9cec60

SHA512
c407713e5155eb184bd78593bef578cbdfcb5a05be14ba3edfccf1a9af4a1cae9dee4eda1b64b96a851fc50515d58dfaaf8fa6bea063706fed17ee33fd67096d

Download Submit
C:\Users\Admin\Downloads\_Instаll_UPD_2.3.3\jres\README.txt

Filesize
47B

MD5
4bda1f1b04053dcfe66e87a77b307bb1

SHA1
b8b35584be24be3a8e1160f97b97b2226b38fa7d

SHA256
fd475b1619675b9fb3f5cd11d448b97eddee8d1f6ddcca13ded8bc6e0caa9cf3

SHA512
997cee676018076e9e4e94d61ec94d5b69b148b3152a0148e70d0be959533a13ad0bc1e8b43268f91db08b881bf5050a6d5c157d456597260a2b332a48068980

Download Submit
C:\Users\Admin\Downloads\_Instаll_UPD_2.3.3\jres\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
109KB

MD5
0e05bd8b9bfcf17f142445d1f8c6561c

SHA1
cf0a9f4040603008891aa0731abf89ce2403f2fb

SHA256
c3ea3996241b8e9ae7db3780e470174076fd2003d8aefaa77bf0bab5e04de050

SHA512
07c7865d31d22ba0c68e384afedc22261f7b3a82bebc9324145ff7f631623eca2dc31c71cdbbfc9febc1733451a095302de2a0877821a5b68038e350969bf460

Download Submit
C:\Users\Admin\Downloads\_Instаll_UPD_2.3.3\jres\THIRDPARTYLICENSEREADME.txt

Filesize
176KB

MD5
0e87879f452892b85c81071a1ddd5a2a

SHA1
2cf97c1a84374a6fbbd5d97fe1b432fa799c3b19

SHA256
9c18836fd0b5e4b0c57cffdb74574fa5549085c3b327703dc8efe4208f4e3321

SHA512
10ba68ffd9deab10a0b200707c3af9e95e27aed004f66f049d41310cb041b7618ee017219c848912d5951599208d385bcb928dd33175652101c7e5bc2e3eba5b

Download Submit
C:\Users\Admin\Downloads\_Instаll_UPD_2.3.3\jres\doc\lib\images\cursors\win32_LinkNoDrop32x32.gif

Filesize
153B

MD5
1e9d8f133a442da6b0c74d49bc84a341

SHA1
259edc45b4569427e8319895a444f4295d54348f

SHA256
1a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b

SHA512
63d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37

Download Submit
memory/1804-873-0x00000000014F0000-0x0000000001557000-memory.dmp

Filesize
412KB

Download
memory/1804-872-0x00000000014F0000-0x0000000001557000-memory.dmp

Filesize
412KB

Download
memory/1804-876-0x00000000014F0000-0x0000000001557000-memory.dmp

Filesize
412KB

Download
memory/4148-959-0x0000000000560000-0x00000000005B7000-memory.dmp

Filesize
348KB

Download
memory/4148-960-0x0000000000560000-0x00000000005B7000-memory.dmp

Filesize
348KB

Download
memory/4148-963-0x0000000000560000-0x00000000005B7000-memory.dmp

Filesize
348KB

Download
memory/4412-942-0x00000000008F0000-0x0000000000956000-memory.dmp

Filesize
408KB

Download
memory/4412-939-0x00000000008F0000-0x0000000000956000-memory.dmp

Filesize
408KB

Download
memory/4412-938-0x00000000008F0000-0x0000000000956000-memory.dmp

Filesize
408KB

Download
memory/4640-865-0x0000000003420000-0x0000000003426000-memory.dmp

Filesize
24KB

Download
memory/4640-864-0x0000000000FC0000-0x0000000001078000-memory.dmp

Filesize
736KB

Download