lumma | hxxps://www[.]mediafire[.]com/file/rg48ry3pirzhcmy/hoodz[.]zip/file

Analysis

max time kernel
78s
max time network
79s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-01-2025 15:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/file/rg48ry3pirzhcmy/hoodz.zip/file

Score

10^/10

lumma discovery phishing stealer

Malware Config

Extracted

Family

lumma

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

Extracted

Family

lumma

https://abruptyopsn.shop/api

https://wholersorie.shop/api

https://framekgirus.shop/api

https://tirepublicerj.shop/api

https://noisycuttej.shop/api

https://rabidcowse.shop/api

https://cloudewahsj.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing

Executes dropped EXE 1 IoCs

pid	Process
5284	hoodz logger.exe

Loads dropped DLL 1 IoCs

pid	Process
5284	hoodz logger.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
233	whatismyipaddress.com
234	whatismyipaddress.com
235	whatismyipaddress.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5284 set thread context of 5492	5284	hoodz logger.exe	131

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5632	5284	WerFault.exe	127

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hoodz logger.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_regiis.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3488	msedge.exe
3488	msedge.exe
1400	msedge.exe
1400	msedge.exe
3328	identity_helper.exe
3328	identity_helper.exe
3068	msedge.exe
3068	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeRestorePrivilege	1800	7zG.exe
Token: 35	1800	7zG.exe
Token: SeSecurityPrivilege	1800	7zG.exe
Token: SeSecurityPrivilege	1800	7zG.exe
Token: SeManageVolumePrivilege	5924	svchost.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1800	7zG.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 1200	1400	msedge.exe	83
PID 1400 wrote to memory of 1200	1400	msedge.exe	83
PID 1400 wrote to memory of 2448	1400	msedge.exe	85
PID 1400 wrote to memory of 2448	1400	msedge.exe	85
PID 1400 wrote to memory of 2448	1400	msedge.exe	85
PID 1400 wrote to memory of 2448	1400	msedge.exe	85
PID 1400 wrote to memory of 2448	1400	msedge.exe	85
PID 1400 wrote to memory of 2448	1400	msedge.exe	85
PID 1400 wrote to memory of 2448	1400	msedge.exe	85
PID 1400 wrote to memory of 2448	1400	msedge.exe	85
PID 1400 wrote to memory of 2448	1400	msedge.exe	85
PID 1400 wrote to memory of 2448	1400	msedge.exe	85
PID 1400 wrote to memory of 2448	1400	msedge.exe	85
PID 1400 wrote to memory of 2448	1400	msedge.exe	85
PID 1400 wrote to memory of 2448	1400	msedge.exe	85
PID 1400 wrote to memory of 2448	1400	msedge.exe	85
PID 1400 wrote to memory of 2448	1400	msedge.exe	85
PID 1400 wrote to memory of 2448	1400	msedge.exe	85
PID 1400 wrote to memory of 2448	1400	msedge.exe	85
PID 1400 wrote to memory of 2448	1400	msedge.exe	85
PID 1400 wrote to memory of 2448	1400	msedge.exe	85
PID 1400 wrote to memory of 2448	1400	msedge.exe	85
PID 1400 wrote to memory of 2448	1400	msedge.exe	85
PID 1400 wrote to memory of 2448	1400	msedge.exe	85
PID 1400 wrote to memory of 2448	1400	msedge.exe	85
PID 1400 wrote to memory of 2448	1400	msedge.exe	85
PID 1400 wrote to memory of 2448	1400	msedge.exe	85
PID 1400 wrote to memory of 2448	1400	msedge.exe	85
PID 1400 wrote to memory of 2448	1400	msedge.exe	85
PID 1400 wrote to memory of 2448	1400	msedge.exe	85
PID 1400 wrote to memory of 2448	1400	msedge.exe	85
PID 1400 wrote to memory of 2448	1400	msedge.exe	85
PID 1400 wrote to memory of 2448	1400	msedge.exe	85
PID 1400 wrote to memory of 2448	1400	msedge.exe	85
PID 1400 wrote to memory of 2448	1400	msedge.exe	85
PID 1400 wrote to memory of 2448	1400	msedge.exe	85
PID 1400 wrote to memory of 2448	1400	msedge.exe	85
PID 1400 wrote to memory of 2448	1400	msedge.exe	85
PID 1400 wrote to memory of 2448	1400	msedge.exe	85
PID 1400 wrote to memory of 2448	1400	msedge.exe	85
PID 1400 wrote to memory of 2448	1400	msedge.exe	85
PID 1400 wrote to memory of 2448	1400	msedge.exe	85
PID 1400 wrote to memory of 3488	1400	msedge.exe	86
PID 1400 wrote to memory of 3488	1400	msedge.exe	86
PID 1400 wrote to memory of 1968	1400	msedge.exe	87
PID 1400 wrote to memory of 1968	1400	msedge.exe	87
PID 1400 wrote to memory of 1968	1400	msedge.exe	87
PID 1400 wrote to memory of 1968	1400	msedge.exe	87
PID 1400 wrote to memory of 1968	1400	msedge.exe	87
PID 1400 wrote to memory of 1968	1400	msedge.exe	87
PID 1400 wrote to memory of 1968	1400	msedge.exe	87
PID 1400 wrote to memory of 1968	1400	msedge.exe	87
PID 1400 wrote to memory of 1968	1400	msedge.exe	87
PID 1400 wrote to memory of 1968	1400	msedge.exe	87
PID 1400 wrote to memory of 1968	1400	msedge.exe	87
PID 1400 wrote to memory of 1968	1400	msedge.exe	87
PID 1400 wrote to memory of 1968	1400	msedge.exe	87
PID 1400 wrote to memory of 1968	1400	msedge.exe	87
PID 1400 wrote to memory of 1968	1400	msedge.exe	87
PID 1400 wrote to memory of 1968	1400	msedge.exe	87
PID 1400 wrote to memory of 1968	1400	msedge.exe	87
PID 1400 wrote to memory of 1968	1400	msedge.exe	87
PID 1400 wrote to memory of 1968	1400	msedge.exe	87
PID 1400 wrote to memory of 1968	1400	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.mediafire.com/file/rg48ry3pirzhcmy/hoodz.zip/file
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffa37246f8,0x7fffa3724708,0x7fffa3724718
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,4507958293206727571,9297308583563367984,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,4507958293206727571,9297308583563367984,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,4507958293206727571,9297308583563367984,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4507958293206727571,9297308583563367984,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4507958293206727571,9297308583563367984,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4507958293206727571,9297308583563367984,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,4507958293206727571,9297308583563367984,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6424 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,4507958293206727571,9297308583563367984,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6424 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4507958293206727571,9297308583563367984,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4507958293206727571,9297308583563367984,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2164,4507958293206727571,9297308583563367984,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4507958293206727571,9297308583563367984,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2164,4507958293206727571,9297308583563367984,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6672 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4507958293206727571,9297308583563367984,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4507958293206727571,9297308583563367984,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4507958293206727571,9297308583563367984,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4507958293206727571,9297308583563367984,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4507958293206727571,9297308583563367984,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4507958293206727571,9297308583563367984,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4507958293206727571,9297308583563367984,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4507958293206727571,9297308583563367984,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6832 /prefetch:1
  2⤵
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4507958293206727571,9297308583563367984,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4507958293206727571,9297308583563367984,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4507958293206727571,9297308583563367984,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4507958293206727571,9297308583563367984,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3680 /prefetch:1
  2⤵
  PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4507958293206727571,9297308583563367984,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1700 /prefetch:1
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4507958293206727571,9297308583563367984,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2052 /prefetch:1
  2⤵
  PID:1008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4152

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2704

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\hoodz\" -ad -an -ai#7zMap25625:72:7zEvent27020
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1800

C:\Users\Admin\Downloads\hoodz\hoodz\hoodz logger.exe
"C:\Users\Admin\Downloads\hoodz\hoodz\hoodz logger.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5284
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5492
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5284 -s 1028
  2⤵
  - Program crash
  PID:5632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5284 -ip 5284
1⤵
PID:5592

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

Filesize
16KB

MD5
45d425e7054d9217f881d5ece5eb840d

SHA1
4fa7066ee6e0a38621ed0248084d1d0d5d7213a3

SHA256
1857142c6ea35da9b68873e12f20a00d81ce3386849eb10016be4d8009073a8e

SHA512
90a750af666b4983be01bdbcd8b84b651a8d103d75cd503a208ea85d58d9b360f0377064aaf30cd9f9f1dfd7aa0d9ca0bd3e6363c524a2470648cc6f3a6c8114

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
768B

MD5
d2eaec57f4b050aa24779d9a3745c749

SHA1
015aaf3fdaccb77bc9984e0d07dc2bebbc22b466

SHA256
fb0bff14745a82d9fdffbcb8920d57fb7e279b15c9a8938b5d0f7504679931a2

SHA512
280bd1da7540285ce559af8253343c98239cee504c9d60c6ef88e6629f6fc7e0a40124e202b59ad4bd128897a3fb1db36bd2ce25bc03f4375c3c80ea894ebd18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
d1c3eb51d8ee781bac1e6de33f86526d

SHA1
11111a355e56372c03bc65dcc5b213f73c3ef8a9

SHA256
5fb5f3bcbd2bd2ae986d2fb5a6dea3ded40b9b7df302db5d97d596fbd5276ef0

SHA512
49781791dc5bfcc6f18ab3b0a7395f9daf5d3d3b18dab7a5dd8e686c13117b131eb3175ff8fd8d86e0b577513ba18ef00d21b4cb4e5807b4d4b6d8ec7d450217

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
792B

MD5
02a9a6b9761b59ad634df0d64bbdd518

SHA1
e2f49f4597939b9d04132eba2c4245fa5860463d

SHA256
5686dddea2860812a4f1b53e61fd19abc23e64881942258de7ef83cb22e5d9fd

SHA512
0ab1c78ab13c9f877d96f55017c76b17d37c9dbca59a46f1e47890921ee9eac16e9cf710825d1810349d773b378b692c60a5d8a4ba54e855ab8fcfa51f62beb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
426f90e2f0e974bdacc24a7df836300e

SHA1
19c788b26e6852fa42b6ad76bc9753d7d0fb0ee5

SHA256
7a893d5270df50872cca634cee6e7b67d00705ef279ec62773a21d289c366f8f

SHA512
5b6e186834e17aa0b189e2af0952c0acdff4cbf5db2336e10bec093f3b395c4d187c36b402eee0abcc11ce2a7012943e8fc7c5aac4de04d714f4a671dd64f3bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
11KB

MD5
ada89d8113a8916f36aedd06dc7b4ff5

SHA1
36dcb9777e5e29d05ea6d52f9506d8f710fe4d9a

SHA256
fa58d5b4d1027252e48d04d42e2dbae84f96f0fb01a4ee694459e934facb7991

SHA512
10ca048e04b4530c510519049d2ba3801a79908afb480a7284ca71752c8d5d32432e590400f2639bcfa251e9eabc58bff3bf4dae9a2aa87acc8ffa92b928a2e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e66be1fa525af297d0592ec0265ec2f9

SHA1
241f19a69c8e720f85d86dc0fb9255717f1c2c40

SHA256
fbf1e742bab9c2e0af80704175ec4b8fd1dddcebe8be7e8feb4899e8d898c04b

SHA512
c783a6e8da250cce9afce29853e5e88a7b9cd83d0171e11130a23527a4d1903be907d4f95f085b76e36a6c4b147b83c97df465555081166b48ca5c0bc3bc79be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
a05345bfe92364b4f9912593fff496c7

SHA1
118d258174b40ce400148157f9770824fb71a641

SHA256
adb6725876553673a761c83922aeeaa09e8c7ce1dc8874eafec9c41478ea640f

SHA512
c376483bb4948d4e0a972bc1c535d4c185750243bd405426a80f3f19e27f278ce2ab7b02850fa69f9459d6de8bca54a57ebabf4e8f799eb3db65c1709151f10f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
4f04251436787199b44e037095dfec28

SHA1
fbdb1b0ad56c77e140b5e72aaa118bc553738f5c

SHA256
2caf1ad0649ed0a226f7a991bc234b0303802132b4ec1ea5047b5ad6c3f51f6a

SHA512
9696171282afcee007f9240cf093bcec5182383f7ad46cd5641c4be2992f9f15a87fff2a4bd61af368da42d3f18d1651ca768c661031be762523e1609ceeeddd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
bbafb154f73ec8e8ecf8b533bd2719db

SHA1
e390c62fd8b42aa76e9358a49f52ccf86f503304

SHA256
c9675f0e451f936a48c2bc1dc565abb7e5be262f4ed1bd055d8c036224679b98

SHA512
633819d8323c822b65e9d27657cf82cfad12d2e2863fc121b10ab1b082783d845f7865bd3c6e30e8a24d1a5b108c04328fbe8116de278a3b4a05a0f65172110f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
d3fc8c7dc6140be8477e8168dc6923b0

SHA1
d7f2f5ba601a0fb5f37594ccea16c8dd5ecd48f1

SHA256
da37dcea4a673f198ca6dce1929f333819dbd0c4fe221ebba0289ee796732c4c

SHA512
4180ac08a562fe8355fc81af18b4f24ff5da131bdc960dd868d4629fa1b291820f0fbda928b69a9e6f58df5590974b7d2d4ea7e96d40eb52305897f44add5b17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9549c4bac4af582179bed857523755cf

SHA1
a27b0b9e198bdb0e149d565c0ae7cbcc6f792daa

SHA256
47253d9391b38c11fddf7e5fbc05bf0124de242b3ae0088709db7baca3b85482

SHA512
d420ce163060eae84dd0ac6b0a70adc7aad9f044c1413fd20868833287e89036d1768618af890eb1b88a2bb0f3cc20b076ca11e55d5dff7733fa8b6c2a90078a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
e7101803882615b3c4d9bd7834c25f7f

SHA1
7827bbfbbac0aa7fd5a05e5dc8ba54776d4af12e

SHA256
c67702a6e581a15338c48dec257b840f3e15ccda94c2bdf542c617dbc0cbedc7

SHA512
5a7f1a1f8c56da3dc6d67c995a2c573912cdcf954c825b3cfc979f010bc5e08fd8cc4f56a9b578186c996d378accb2361bb501eb38acd5b195bd8e0b2933cae1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f7ed.TMP

Filesize
706B

MD5
992a4fc33fda1934c66b829775791e15

SHA1
6c1f29921c4685bf3d5a1182701cb0f3ca2d1d20

SHA256
5c177bc07f1edbda78cfe00150f6d07cca3d8d378f17f0be6fb6a12bed3282d8

SHA512
050e47cfb3b82c044674e279325f29ab15fca02444e392057287a6a111e226fe31e6e1166dd17cad64758f756e35a6f2ba63b5cca64fa460afb6bbe2f17d0d5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4f49fadd16537503878c9a76575f54e1

SHA1
a5ef6d5a8e71c5ae426ad0a3a896a9945f44ec1c

SHA256
141b6d91bc0fd2cc2a59429a405824531593fe1d054ea3c9e4373d4527300132

SHA512
9cdc5dc00690d19fd91bd61c0bd8f9973c8fcc439af7db1c072ca8f89a7ef449288ff101bae7e62407a6e4b35cd181b5eaea3c8ef12dc1da45a06c10a12cd3ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6f175a9a27b8205203fba633afbded16

SHA1
f97b5d7c68f481ff1e2eab54a917faa50e8080d7

SHA256
fb6088b52e13d8fe0ee60f27533c615156484685f3df2a35017fed6c7bb61706

SHA512
369a1689bb8324c40172ced96b4ef1dac5af88cf7af3aa3d9c3351067926359dc6b29257d9fe7853ccd4eba874dbe0bedb065e85cda47236dcf03e028bf18971

Download Submit
C:\Users\Admin\AppData\Roaming\gdi32.dll

Filesize
431KB

MD5
64c287959ff0dbd10db81bded030a3a1

SHA1
acf88011455fc98d0de186520b4ddde5d1cf5f75

SHA256
673e0efee492a6a82afcce12545c4a2d46a1e9e827c33b7a1e9f0a904656a458

SHA512
d7ca03f8032e7c9d5882ead046c33388d5ebba5923abd95c3c535945ba4aa8a1fe6e47d116dd9376c6717a36bff5ac0d0dcfc599526a5fc89d81c3fd3b0517c2

Download Submit
C:\Users\Admin\Downloads\hoodz.zip

Filesize
623KB

MD5
cdaf900259ce52736b6ee2523d303e64

SHA1
8309cc24e5301782c70272e6f7329d2a7f01d6ec

SHA256
573847fef714d09a4420695c37d25a28f151cf27200ea5384baacb5c4231f9e6

SHA512
e9d0eb783bea00eb693019fe478b99fc19a74eeb37471fe38d896379003df264209f82c74cb9956e77ab89df885598a2e03f6e828fdffc704faa5db7850037c5

Download Submit
C:\Users\Admin\Downloads\hoodz\hoodz\hoodz logger.exe

Filesize
743KB

MD5
7177b0ba961ddd258ee9672d436d6b63

SHA1
cdb7aef7f7a05430d323c00d43fe98af4680fa28

SHA256
1abcde09d85b8ff8788f23afaf33674557563273df5961719bc65216aa3a1a95

SHA512
df1b07f5d4ff53afc4547fb371af1393bafce2eec0cc96ab0ceeaeb4500a3e771f4d1b9c7936b86f38241abfdfb53c9cf2fff22d3a0e7006015f50c165c59078

Download Submit
memory/5284-241-0x00000000013B0000-0x00000000013B6000-memory.dmp

Filesize
24KB

Download
memory/5284-240-0x0000000000A30000-0x0000000000AF2000-memory.dmp

Filesize
776KB

Download
memory/5492-252-0x0000000000EF0000-0x0000000000F55000-memory.dmp

Filesize
404KB

Download
memory/5492-249-0x0000000000EF0000-0x0000000000F55000-memory.dmp

Filesize
404KB

Download
memory/5492-248-0x0000000000EF0000-0x0000000000F55000-memory.dmp

Filesize
404KB

Download
memory/5924-294-0x000001DB7F3D0000-0x000001DB7F3D1000-memory.dmp

Filesize
4KB

Download
memory/5924-300-0x000001DB7F400000-0x000001DB7F401000-memory.dmp

Filesize
4KB

Download
memory/5924-301-0x000001DB7F400000-0x000001DB7F401000-memory.dmp

Filesize
4KB

Download
memory/5924-302-0x000001DB7F400000-0x000001DB7F401000-memory.dmp

Filesize
4KB

Download
memory/5924-303-0x000001DB7F600000-0x000001DB7F601000-memory.dmp

Filesize
4KB

Download
memory/5924-304-0x000001DB7F600000-0x000001DB7F601000-memory.dmp

Filesize
4KB

Download
memory/5924-306-0x000001DB7F010000-0x000001DB7F011000-memory.dmp

Filesize
4KB

Download
memory/5924-305-0x000001DB7F020000-0x000001DB7F021000-memory.dmp

Filesize
4KB

Download
memory/5924-308-0x000001DB7F020000-0x000001DB7F021000-memory.dmp

Filesize
4KB

Download
memory/5924-311-0x000001DB7F010000-0x000001DB7F011000-memory.dmp

Filesize
4KB

Download
memory/5924-314-0x000001DB7EF50000-0x000001DB7EF51000-memory.dmp

Filesize
4KB

Download
memory/5924-298-0x000001DB7F400000-0x000001DB7F401000-memory.dmp

Filesize
4KB

Download
memory/5924-326-0x000001DB7F150000-0x000001DB7F151000-memory.dmp

Filesize
4KB

Download
memory/5924-328-0x000001DB7F160000-0x000001DB7F161000-memory.dmp

Filesize
4KB

Download
memory/5924-329-0x000001DB7F160000-0x000001DB7F161000-memory.dmp

Filesize
4KB

Download
memory/5924-330-0x000001DB7F270000-0x000001DB7F271000-memory.dmp

Filesize
4KB

Download
memory/5924-299-0x000001DB7F400000-0x000001DB7F401000-memory.dmp

Filesize
4KB

Download
memory/5924-297-0x000001DB7F400000-0x000001DB7F401000-memory.dmp

Filesize
4KB

Download
memory/5924-296-0x000001DB7F400000-0x000001DB7F401000-memory.dmp

Filesize
4KB

Download
memory/5924-295-0x000001DB7F400000-0x000001DB7F401000-memory.dmp

Filesize
4KB

Download
memory/5924-278-0x000001DB7EE40000-0x000001DB7EE50000-memory.dmp

Filesize
64KB

Download
memory/5924-262-0x000001DB7ED40000-0x000001DB7ED50000-memory.dmp

Filesize
64KB

Download