umbral | e36bae9f31355d5d5ffdb550c1d7d1c0f88a7f52f7bae1288a6f9e5008f6471b

Analysis

max time kernel
66s
max time network
66s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-01-2025 06:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Nursultan Crack 1.16.5 (infected).7z
Size

111KB
MD5

12e7124cf069c75347e8291b5a682f85
SHA1

c66a93d01796b51f81577cfd4629b439e69da530
SHA256

e36bae9f31355d5d5ffdb550c1d7d1c0f88a7f52f7bae1288a6f9e5008f6471b
SHA512

5f0cc0697b68e7fa64df395e38a8586299aa97f3d33316cea3458591f7d83d36b7f319a6ad83773368e8d04ddd53f6a5f6b0a2d054d3480e565375a1a495f775
SSDEEP

1536:ymRAf4Fyhjpllzf89PZBmEdKPWCniAaPzJFUUjRIK+zzGhUQrosmgvP4+9iMagHo:yE50VU9xiW7L0USSuQwgvPHIkQIGR

Score

10^/10

umbral discovery execution spyware stealer

Malware Config

Signatures

Detect Umbral payload 4 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023cbc-4.dat	family_umbral
behavioral1/files/0x0008000000023cc8-10.dat	family_umbral
behavioral1/memory/1732-20-0x0000028E3A210000-0x0000028E3A250000-memory.dmp	family_umbral
behavioral1/memory/4168-27-0x0000000000400000-0x000000000045D000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Umbral family
umbral

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3660	powershell.exe
1168	powershell.exe
5056	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Nursultan Crack 1.16.5.exe

Executes dropped EXE 3 IoCs

pid	Process
4168	Nursultan Crack 1.16.5.exe
1732	Microsoft Defender.exe
4372	CrackLauncher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
25	discord.com
26	discord.com
40	discord.com
41	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
20	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nursultan Crack 1.16.5.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4032	wmic.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\discord-1199748644409184347	CrackLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\discord-1199748644409184347\ = "URL:Run game 1199748644409184347 protocol"	CrackLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\discord-1199748644409184347\URL Protocol	CrackLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\discord-1199748644409184347\DefaultIcon\ = "C:\\Users\\Admin\\Desktop\\CrackLauncher.exe"	CrackLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\discord-1199748644409184347\shell\open	CrackLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\discord-1199748644409184347\shell\open\command\ = "C:\\Users\\Admin\\Desktop\\CrackLauncher.exe"	CrackLauncher.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3442511616-637977696-3186306149-1000\{191AC901-EFFB-47C1-9C98-4EE7265DA0AC}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\discord-1199748644409184347\DefaultIcon	CrackLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\discord-1199748644409184347\shell\open\command	CrackLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\discord-1199748644409184347\shell	CrackLauncher.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
1732	Microsoft Defender.exe
3660	powershell.exe
3660	powershell.exe
1168	powershell.exe
1168	powershell.exe
5056	powershell.exe
5056	powershell.exe
3284	msedge.exe
3284	msedge.exe
4628	msedge.exe
4628	msedge.exe
3024	msedge.exe
3024	msedge.exe
2260	msedge.exe
2260	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1048	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	1048	7zFM.exe
Token: 35	1048	7zFM.exe
Token: SeSecurityPrivilege	1048	7zFM.exe
Token: SeDebugPrivilege	1732	Microsoft Defender.exe
Token: SeIncreaseQuotaPrivilege	4628	wmic.exe
Token: SeSecurityPrivilege	4628	wmic.exe
Token: SeTakeOwnershipPrivilege	4628	wmic.exe
Token: SeLoadDriverPrivilege	4628	wmic.exe
Token: SeSystemProfilePrivilege	4628	wmic.exe
Token: SeSystemtimePrivilege	4628	wmic.exe
Token: SeProfSingleProcessPrivilege	4628	wmic.exe
Token: SeIncBasePriorityPrivilege	4628	wmic.exe
Token: SeCreatePagefilePrivilege	4628	wmic.exe
Token: SeBackupPrivilege	4628	wmic.exe
Token: SeRestorePrivilege	4628	wmic.exe
Token: SeShutdownPrivilege	4628	wmic.exe
Token: SeDebugPrivilege	4628	wmic.exe
Token: SeSystemEnvironmentPrivilege	4628	wmic.exe
Token: SeRemoteShutdownPrivilege	4628	wmic.exe
Token: SeUndockPrivilege	4628	wmic.exe
Token: SeManageVolumePrivilege	4628	wmic.exe
Token: 33	4628	wmic.exe
Token: 34	4628	wmic.exe
Token: 35	4628	wmic.exe
Token: 36	4628	wmic.exe
Token: SeIncreaseQuotaPrivilege	4628	wmic.exe
Token: SeSecurityPrivilege	4628	wmic.exe
Token: SeTakeOwnershipPrivilege	4628	wmic.exe
Token: SeLoadDriverPrivilege	4628	wmic.exe
Token: SeSystemProfilePrivilege	4628	wmic.exe
Token: SeSystemtimePrivilege	4628	wmic.exe
Token: SeProfSingleProcessPrivilege	4628	wmic.exe
Token: SeIncBasePriorityPrivilege	4628	wmic.exe
Token: SeCreatePagefilePrivilege	4628	wmic.exe
Token: SeBackupPrivilege	4628	wmic.exe
Token: SeRestorePrivilege	4628	wmic.exe
Token: SeShutdownPrivilege	4628	wmic.exe
Token: SeDebugPrivilege	4628	wmic.exe
Token: SeSystemEnvironmentPrivilege	4628	wmic.exe
Token: SeRemoteShutdownPrivilege	4628	wmic.exe
Token: SeUndockPrivilege	4628	wmic.exe
Token: SeManageVolumePrivilege	4628	wmic.exe
Token: 33	4628	wmic.exe
Token: 34	4628	wmic.exe
Token: 35	4628	wmic.exe
Token: 36	4628	wmic.exe
Token: SeDebugPrivilege	3660	powershell.exe
Token: SeDebugPrivilege	1168	powershell.exe
Token: SeIncreaseQuotaPrivilege	4588	wmic.exe
Token: SeSecurityPrivilege	4588	wmic.exe
Token: SeTakeOwnershipPrivilege	4588	wmic.exe
Token: SeLoadDriverPrivilege	4588	wmic.exe
Token: SeSystemProfilePrivilege	4588	wmic.exe
Token: SeSystemtimePrivilege	4588	wmic.exe
Token: SeProfSingleProcessPrivilege	4588	wmic.exe
Token: SeIncBasePriorityPrivilege	4588	wmic.exe
Token: SeCreatePagefilePrivilege	4588	wmic.exe
Token: SeBackupPrivilege	4588	wmic.exe
Token: SeRestorePrivilege	4588	wmic.exe
Token: SeShutdownPrivilege	4588	wmic.exe
Token: SeDebugPrivilege	4588	wmic.exe
Token: SeSystemEnvironmentPrivilege	4588	wmic.exe
Token: SeRemoteShutdownPrivilege	4588	wmic.exe
Token: SeUndockPrivilege	4588	wmic.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
1048	7zFM.exe
1048	7zFM.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4168 wrote to memory of 1732	4168	Nursultan Crack 1.16.5.exe	90
PID 4168 wrote to memory of 1732	4168	Nursultan Crack 1.16.5.exe	90
PID 4168 wrote to memory of 4372	4168	Nursultan Crack 1.16.5.exe	91
PID 4168 wrote to memory of 4372	4168	Nursultan Crack 1.16.5.exe	91
PID 4372 wrote to memory of 2236	4372	CrackLauncher.exe	93
PID 4372 wrote to memory of 2236	4372	CrackLauncher.exe	93
PID 1732 wrote to memory of 4628	1732	Microsoft Defender.exe	94
PID 1732 wrote to memory of 4628	1732	Microsoft Defender.exe	94
PID 1732 wrote to memory of 3660	1732	Microsoft Defender.exe	96
PID 1732 wrote to memory of 3660	1732	Microsoft Defender.exe	96
PID 1732 wrote to memory of 1168	1732	Microsoft Defender.exe	99
PID 1732 wrote to memory of 1168	1732	Microsoft Defender.exe	99
PID 1732 wrote to memory of 4588	1732	Microsoft Defender.exe	102
PID 1732 wrote to memory of 4588	1732	Microsoft Defender.exe	102
PID 1732 wrote to memory of 1672	1732	Microsoft Defender.exe	104
PID 1732 wrote to memory of 1672	1732	Microsoft Defender.exe	104
PID 1732 wrote to memory of 232	1732	Microsoft Defender.exe	106
PID 1732 wrote to memory of 232	1732	Microsoft Defender.exe	106
PID 1732 wrote to memory of 5056	1732	Microsoft Defender.exe	108
PID 1732 wrote to memory of 5056	1732	Microsoft Defender.exe	108
PID 1732 wrote to memory of 4032	1732	Microsoft Defender.exe	110
PID 1732 wrote to memory of 4032	1732	Microsoft Defender.exe	110
PID 4372 wrote to memory of 860	4372	CrackLauncher.exe	114
PID 4372 wrote to memory of 860	4372	CrackLauncher.exe	114
PID 4372 wrote to memory of 3824	4372	CrackLauncher.exe	115
PID 4372 wrote to memory of 3824	4372	CrackLauncher.exe	115
PID 3824 wrote to memory of 1380	3824	msedge.exe	116
PID 3824 wrote to memory of 1380	3824	msedge.exe	116
PID 4372 wrote to memory of 3024	4372	CrackLauncher.exe	117
PID 4372 wrote to memory of 3024	4372	CrackLauncher.exe	117
PID 3024 wrote to memory of 3124	3024	msedge.exe	119
PID 3024 wrote to memory of 3124	3024	msedge.exe	119
PID 3824 wrote to memory of 1336	3824	msedge.exe	122
PID 3824 wrote to memory of 1336	3824	msedge.exe	122
PID 3824 wrote to memory of 1336	3824	msedge.exe	122
PID 3824 wrote to memory of 1336	3824	msedge.exe	122
PID 3824 wrote to memory of 1336	3824	msedge.exe	122
PID 3824 wrote to memory of 1336	3824	msedge.exe	122
PID 3824 wrote to memory of 1336	3824	msedge.exe	122
PID 3824 wrote to memory of 1336	3824	msedge.exe	122
PID 3824 wrote to memory of 1336	3824	msedge.exe	122
PID 3824 wrote to memory of 1336	3824	msedge.exe	122
PID 3824 wrote to memory of 1336	3824	msedge.exe	122
PID 3824 wrote to memory of 1336	3824	msedge.exe	122
PID 3824 wrote to memory of 1336	3824	msedge.exe	122
PID 3824 wrote to memory of 1336	3824	msedge.exe	122
PID 3824 wrote to memory of 1336	3824	msedge.exe	122
PID 3824 wrote to memory of 1336	3824	msedge.exe	122
PID 3824 wrote to memory of 1336	3824	msedge.exe	122
PID 3824 wrote to memory of 1336	3824	msedge.exe	122
PID 3824 wrote to memory of 1336	3824	msedge.exe	122
PID 3824 wrote to memory of 1336	3824	msedge.exe	122
PID 3824 wrote to memory of 1336	3824	msedge.exe	122
PID 3824 wrote to memory of 1336	3824	msedge.exe	122
PID 3824 wrote to memory of 1336	3824	msedge.exe	122
PID 3824 wrote to memory of 1336	3824	msedge.exe	122
PID 3824 wrote to memory of 1336	3824	msedge.exe	122
PID 3824 wrote to memory of 1336	3824	msedge.exe	122
PID 3824 wrote to memory of 1336	3824	msedge.exe	122
PID 3824 wrote to memory of 1336	3824	msedge.exe	122
PID 3824 wrote to memory of 1336	3824	msedge.exe	122
PID 3824 wrote to memory of 1336	3824	msedge.exe	122
PID 3824 wrote to memory of 1336	3824	msedge.exe	122
PID 3824 wrote to memory of 1336	3824	msedge.exe	122

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Nursultan Crack 1.16.5 (infected).7z"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1048

C:\Users\Admin\Desktop\Nursultan Crack 1.16.5.exe
"C:\Users\Admin\Desktop\Nursultan Crack 1.16.5.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Users\Admin\AppData\Local\Temp\Microsoft Defender.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft Defender.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4628
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft Defender.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3660
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1168
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" os get Caption
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4588
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" computersystem get totalphysicalmemory
    3⤵
    PID:1672
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    PID:232
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5056
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:4032
- C:\Users\Admin\Desktop\CrackLauncher.exe
  "C:\Users\Admin\Desktop\CrackLauncher.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/SDxDej44bY
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xf8,0x12c,0x7ffca54646f8,0x7ffca5464708,0x7ffca5464718
      4⤵
      PID:1380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,3488353534809775857,17701697366397251337,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2028 /prefetch:2
      4⤵
      PID:1336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,3488353534809775857,17701697366397251337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/sk3d_club
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffca54646f8,0x7ffca5464708,0x7ffca5464718
      4⤵
      PID:3124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,6658019456541499299,7884819938459655541,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1984 /prefetch:2
      4⤵
      PID:3584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,6658019456541499299,7884819938459655541,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,6658019456541499299,7884819938459655541,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
      4⤵
      PID:4656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,6658019456541499299,7884819938459655541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
      4⤵
      PID:4340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,6658019456541499299,7884819938459655541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
      4⤵
      PID:216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,6658019456541499299,7884819938459655541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:1
      4⤵
      PID:4888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,6658019456541499299,7884819938459655541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
      4⤵
      PID:3544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,6658019456541499299,7884819938459655541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
      4⤵
      PID:1480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2000,6658019456541499299,7884819938459655541,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4292 /prefetch:8
      4⤵
      PID:1008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2000,6658019456541499299,7884819938459655541,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4248 /prefetch:8
      4⤵
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      PID:2260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
600B

MD5
113ab03090b8a6c3f2afc7e9426e0b68

SHA1
a0d548d48233e536e0a97714b26e55d9b0019a10

SHA256
e7fdda040a4c0d07e319dd5b216c456cbda28c750e4ee3baf6e63195ac7f97fb

SHA512
920e32e8b7d461e6e14090ecaef4cd8a4e5f5c7cdae51c5c469c4690523b79f7df4eec898e99882f96fbf4617131503e7a5362cdf12b22e5caba776087b77e25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b53e6d7cb65097b09fd688bc9e21a8f5

SHA1
05cd76eed466eb758672ddff03aa9b86170027cd

SHA256
e5dc99f786d56ab9d258668b51cb008218f065ae0d272fdff6e16867a221b911

SHA512
b2db676af1b36f703fa27133c39808093de03316243e6759f44298119efcc761cec84d39144b9c3684c9f771d6db9bafef31eed3ffdb2505d288e2669b227541

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0b49db97ac69095c8963d4549078e772

SHA1
406c1486750bb73857395e92ad4a44c5c0b63ba7

SHA256
fe8c05afc1fc17117315b16822a70cba6771d423ab8aa4f546c23e37546c13c9

SHA512
e88c3418bd1d537a264d95d9530c88359a1929af65129e5cdb33017ee82e83e54a152bfa9404734e18db7612fc89118b92fb864112d52bfb5b30cc2256e4a1f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
843a61354de84cb6feeffbe0bd41834a

SHA1
b60eb8ff126073915d781b636eef3b714ddf5913

SHA256
2ab56a750250351de36b4727bc8ed824308d6b606136b4fbb521c568d78a6193

SHA512
e3c7a02d2bce554ddc72da20c404fb7cd20bbdcd2c3a5bdc3c9432c82a7cad6c937f3f02519f5298f3289fa633248fc1b4cc5fa13567a6e69f089705b005b11d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3eb56333ed5df027adb482592589aa78

SHA1
00715bf2769f678bcba94ac38eb5fb7672589626

SHA256
1adb94c27aebf7392e84fba69826c6d5c9cb3ba8a265250d92e8de431b1384dd

SHA512
4d3981ca2b435f639651f5f9f1be7b5d74144898d4dcaa954b69ff567784bbbf30aa3f6117c7023164ef1d10346fb6423fcafe1d969aaef8b212ec35723c2d6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
2c0ed6376e94f2f1e46f838609caa945

SHA1
b76fdf211519edcb2dd8973149bedb69c504c722

SHA256
ad2520a315def8dce7c00cfee32eb2a8101279e14c9e0c3ef0d84232e6273c03

SHA512
cf7c714587f2745f42d6d8ba89778da76baf0679c294e4a9aa7af75622bfc4e9255c60d72a1e0e3a3d0ea7772dcf9547f4a9a7833b34fc12d0576a17457b880b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
af283a45e468abc28a9ac1c14af0a45d

SHA1
6d70a604e1a12e0df9b98a4bf57d335d78986c93

SHA256
141a5cbf854b091471384f71c93282c31d166a8676d43559c38086dd6e07229c

SHA512
05abb1f812dd979755e811928006974bccf076e8f618061e64db35b129bb78175a99bac6eefa5e11f6f3c4af94f60e9b7da4c4ba07fa740748ff47a4511d4db8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Defender.exe

Filesize
229KB

MD5
7ab25e10c42d7a21f1799649c0b03c4e

SHA1
0b46cc256d0c4318d261768961485cc247a6314f

SHA256
0a3412d95770025cf3fbdcacd918d9d49b90d9ad276238a9a676d1f1d2ba9d69

SHA512
f8b00294dfead23ce45c007f17c90a8e2a62a9e539c948ff9b75e5a0147fe2f075cfaeedb583ae68b6291f1cf422a4d21d2e0e22541d4cc4ce0e0a39d071a21e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vubtcghj.qte.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Desktop\CrackLauncher.exe

Filesize
102KB

MD5
c137c5f5287d73a94d55bc18df238303

SHA1
95b4b01775bea14feaaa462c98d969eb81696d2c

SHA256
d294856177658df0159cfe937e5ea95a8ee8a2ca85754d897aea3bb5d0d962c0

SHA512
ba595d185ae98152658ce95964fd6bcce7e970896b0b1c674a142d126cf0433094debcd25527d9b4f5a6568cc5a8a42aeaef536166748eea3973f8b694564aa5

Download Submit
C:\Users\Admin\Desktop\Nursultan Crack 1.16.5.exe

Filesize
341KB

MD5
011697c6b74b09defc18eb06a40e66f1

SHA1
752503e83d083988cb1c73dbf5bd046ed64d5555

SHA256
42ee176a76d9d08837b9ca332c3fa89680c93efe8fca1ab77d4771f26157917f

SHA512
5c64e93683b3df46f97e66042780e0b066fedcd2f4b1610580aa1cc52160f90891d3d860e3459de6a9b78360cd74c6232542607dd1026331b8efe5847920bda6

Download Submit
memory/1732-63-0x0000028E546E0000-0x0000028E546F2000-memory.dmp

Filesize
72KB

Download
memory/1732-62-0x0000028E546B0000-0x0000028E546BA000-memory.dmp

Filesize
40KB

Download
memory/1732-55-0x0000028E54680000-0x0000028E5469E000-memory.dmp

Filesize
120KB

Download
memory/1732-54-0x0000028E549D0000-0x0000028E54A20000-memory.dmp

Filesize
320KB

Download
memory/1732-53-0x0000028E54950000-0x0000028E549C6000-memory.dmp

Filesize
472KB

Download
memory/1732-20-0x0000028E3A210000-0x0000028E3A250000-memory.dmp

Filesize
256KB

Download
memory/1732-19-0x00007FFCA49F3000-0x00007FFCA49F5000-memory.dmp

Filesize
8KB

Download
memory/3660-29-0x000001AE5DEA0000-0x000001AE5DEC2000-memory.dmp

Filesize
136KB

Download
memory/4168-27-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download