lumma | hxxps://download2291[.]mediafire[.]com/ewqovavxjbrgHa1S3kf0QCs6En-4zgPbmEYvVe6945IQ2EwRcqSPumJKUxncaR5uMiiIV58JedBMXngN01T3vtAAgyu9WQA8E4HAhqC4fJ_KGdUGr_r48X9IPfwitXmazY-OKOQlVFzIJ887lTwuA_Q0X-5Zib0a1YjmulY57P8SMGQ/wtolwi0lab4l6pf/Aura[.]zip

Resubmissions

09-01-2025 05:58

250109-gphnjatkbp 10

09-01-2025 05:55

250109-gmyxqstjhm 3

Analysis

max time kernel
212s
max time network
208s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-01-2025 05:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://download2291.mediafire.com/ewqovavxjbrgHa1S3kf0QCs6En-4zgPbmEYvVe6945IQ2EwRcqSPumJKUxncaR5uMiiIV58JedBMXngN01T3vtAAgyu9WQA8E4HAhqC4fJ_KGdUGr_r48X9IPfwitXmazY-OKOQlVFzIJ887lTwuA_Q0X-5Zib0a1YjmulY57P8SMGQ/wtolwi0lab4l6pf/Aura.zip

Score

10^/10

lumma discovery phishing stealer

Malware Config

Extracted

Family

lumma

https://robinsharez.shop/api

https://handscreamny.shop/api

https://chipdonkeruz.shop/api

https://versersleep.shop/api

https://crowdwarek.shop/api

https://apporholis.shop/api

https://femalsabler.shop/api

https://soundtappysk.shop/api

https://letterdrive.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/memory/5532-420-0x0000000000450000-0x00000000004BA000-memory.dmp	net_reactor

A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5532 set thread context of 1444	5532	Aura.exe	134
PID 4292 set thread context of 6008	4292	Aura.exe	142

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1632	5532	WerFault.exe	130
2844	4292	WerFault.exe	140

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aura.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aura.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aura.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aura.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 4 IoCs

ransomware

pid	Process
6036	NOTEPAD.EXE
4084	NOTEPAD.EXE
4288	NOTEPAD.EXE
4456	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2284	msedge.exe
2284	msedge.exe
4152	msedge.exe
4152	msedge.exe
2028	identity_helper.exe
2028	identity_helper.exe
5316	msedge.exe
5316	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
5420	OpenWith.exe
3968	OpenWith.exe
5128	OpenWith.exe
3864	OpenWith.exe
5208	OpenWith.exe
4500	OpenWith.exe
2252	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4152 wrote to memory of 3460	4152	msedge.exe	83
PID 4152 wrote to memory of 3460	4152	msedge.exe	83
PID 4152 wrote to memory of 400	4152	msedge.exe	84
PID 4152 wrote to memory of 400	4152	msedge.exe	84
PID 4152 wrote to memory of 400	4152	msedge.exe	84
PID 4152 wrote to memory of 400	4152	msedge.exe	84
PID 4152 wrote to memory of 400	4152	msedge.exe	84
PID 4152 wrote to memory of 400	4152	msedge.exe	84
PID 4152 wrote to memory of 400	4152	msedge.exe	84
PID 4152 wrote to memory of 400	4152	msedge.exe	84
PID 4152 wrote to memory of 400	4152	msedge.exe	84
PID 4152 wrote to memory of 400	4152	msedge.exe	84
PID 4152 wrote to memory of 400	4152	msedge.exe	84
PID 4152 wrote to memory of 400	4152	msedge.exe	84
PID 4152 wrote to memory of 400	4152	msedge.exe	84
PID 4152 wrote to memory of 400	4152	msedge.exe	84
PID 4152 wrote to memory of 400	4152	msedge.exe	84
PID 4152 wrote to memory of 400	4152	msedge.exe	84
PID 4152 wrote to memory of 400	4152	msedge.exe	84
PID 4152 wrote to memory of 400	4152	msedge.exe	84
PID 4152 wrote to memory of 400	4152	msedge.exe	84
PID 4152 wrote to memory of 400	4152	msedge.exe	84
PID 4152 wrote to memory of 400	4152	msedge.exe	84
PID 4152 wrote to memory of 400	4152	msedge.exe	84
PID 4152 wrote to memory of 400	4152	msedge.exe	84
PID 4152 wrote to memory of 400	4152	msedge.exe	84
PID 4152 wrote to memory of 400	4152	msedge.exe	84
PID 4152 wrote to memory of 400	4152	msedge.exe	84
PID 4152 wrote to memory of 400	4152	msedge.exe	84
PID 4152 wrote to memory of 400	4152	msedge.exe	84
PID 4152 wrote to memory of 400	4152	msedge.exe	84
PID 4152 wrote to memory of 400	4152	msedge.exe	84
PID 4152 wrote to memory of 400	4152	msedge.exe	84
PID 4152 wrote to memory of 400	4152	msedge.exe	84
PID 4152 wrote to memory of 400	4152	msedge.exe	84
PID 4152 wrote to memory of 400	4152	msedge.exe	84
PID 4152 wrote to memory of 400	4152	msedge.exe	84
PID 4152 wrote to memory of 400	4152	msedge.exe	84
PID 4152 wrote to memory of 400	4152	msedge.exe	84
PID 4152 wrote to memory of 400	4152	msedge.exe	84
PID 4152 wrote to memory of 400	4152	msedge.exe	84
PID 4152 wrote to memory of 400	4152	msedge.exe	84
PID 4152 wrote to memory of 2284	4152	msedge.exe	85
PID 4152 wrote to memory of 2284	4152	msedge.exe	85
PID 4152 wrote to memory of 1520	4152	msedge.exe	86
PID 4152 wrote to memory of 1520	4152	msedge.exe	86
PID 4152 wrote to memory of 1520	4152	msedge.exe	86
PID 4152 wrote to memory of 1520	4152	msedge.exe	86
PID 4152 wrote to memory of 1520	4152	msedge.exe	86
PID 4152 wrote to memory of 1520	4152	msedge.exe	86
PID 4152 wrote to memory of 1520	4152	msedge.exe	86
PID 4152 wrote to memory of 1520	4152	msedge.exe	86
PID 4152 wrote to memory of 1520	4152	msedge.exe	86
PID 4152 wrote to memory of 1520	4152	msedge.exe	86
PID 4152 wrote to memory of 1520	4152	msedge.exe	86
PID 4152 wrote to memory of 1520	4152	msedge.exe	86
PID 4152 wrote to memory of 1520	4152	msedge.exe	86
PID 4152 wrote to memory of 1520	4152	msedge.exe	86
PID 4152 wrote to memory of 1520	4152	msedge.exe	86
PID 4152 wrote to memory of 1520	4152	msedge.exe	86
PID 4152 wrote to memory of 1520	4152	msedge.exe	86
PID 4152 wrote to memory of 1520	4152	msedge.exe	86
PID 4152 wrote to memory of 1520	4152	msedge.exe	86
PID 4152 wrote to memory of 1520	4152	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://download2291.mediafire.com/ewqovavxjbrgHa1S3kf0QCs6En-4zgPbmEYvVe6945IQ2EwRcqSPumJKUxncaR5uMiiIV58JedBMXngN01T3vtAAgyu9WQA8E4HAhqC4fJ_KGdUGr_r48X9IPfwitXmazY-OKOQlVFzIJ887lTwuA_Q0X-5Zib0a1YjmulY57P8SMGQ/wtolwi0lab4l6pf/Aura.zip
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbbcbc46f8,0x7ffbbcbc4708,0x7ffbbcbc4718
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,8024887517095011385,5991259341300991993,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,8024887517095011385,5991259341300991993,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,8024887517095011385,5991259341300991993,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,8024887517095011385,5991259341300991993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,8024887517095011385,5991259341300991993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,8024887517095011385,5991259341300991993,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,8024887517095011385,5991259341300991993,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,8024887517095011385,5991259341300991993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2280 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,8024887517095011385,5991259341300991993,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,8024887517095011385,5991259341300991993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,8024887517095011385,5991259341300991993,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,8024887517095011385,5991259341300991993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,8024887517095011385,5991259341300991993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6860 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,8024887517095011385,5991259341300991993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6752 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,8024887517095011385,5991259341300991993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2196,8024887517095011385,5991259341300991993,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,8024887517095011385,5991259341300991993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6312 /prefetch:1
  2⤵
  PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,8024887517095011385,5991259341300991993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6840 /prefetch:1
  2⤵
  PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2196,8024887517095011385,5991259341300991993,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,8024887517095011385,5991259341300991993,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1188 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5840

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4888

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4104

C:\Users\Admin\AppData\Local\Temp\Temp1_Aura.zip\Aura\Aura.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Aura.zip\Aura\Aura.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5532
- C:\Users\Admin\AppData\Local\Temp\Temp1_Aura.zip\Aura\Aura.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_Aura.zip\Aura\Aura.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5532 -s 792
  2⤵
  - Program crash
  PID:1632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5532 -ip 5532
1⤵
PID:5024

C:\Users\Admin\AppData\Local\Temp\Temp1_Aura.zip\Aura\Aura.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Aura.zip\Aura\Aura.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4292
- C:\Users\Admin\AppData\Local\Temp\Temp1_Aura.zip\Aura\Aura.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_Aura.zip\Aura\Aura.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 784
  2⤵
  - Program crash
  PID:2844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4292 -ip 4292
1⤵
PID:6032

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_Aura.zip\Aura\changelog.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:6036

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5420

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_Aura.zip\Aura\CREDITS.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4084

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3968

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5128

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3864

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_Aura.zip\Aura\LICENSE.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4288

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_Aura.zip\Aura\version.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4456

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5208

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4500

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000029

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
e93dd88f0c56c9cc3be2702693443b01

SHA1
a86026c06020588d622976144446f53eefc53c2d

SHA256
258877453106c68c0cee8064f548f1335e50fee3f49b2eb18c313518acf793e8

SHA512
05ed96e7c8640fd6882a2531a760c3f20297812fb65db5d881eb6e50d77a593042684386ae700c3028de8988e7f7cb5b02b0c7fd3adfe7c36e8f407f0756e19c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
f2da13883c46ff156c4ba222e919dd79

SHA1
c8c468b5ce83cc3e9328facb7187e8de621e746c

SHA256
d1097e91b9e989df3f52fb8718a02be390ab2dd37924f15cae0bd4151a527f77

SHA512
c6781d0744f2733ea463f8cd9dcc6bc4329648de5e1a1c0ab3c4dc2d2f6475fb77e408385b382bea8f72fd60aade6046bafadba7f77268473e1c9afdc17c9968

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
031d53c21858dec47c42b89954a2b60d

SHA1
45d3b9aafdb250ba4dee3fa972f9f793cf1218f1

SHA256
28a5f0c4c5e69325e7afc305b3659aecd95efb5b46a9a52ba1bdf8e2631105ae

SHA512
8fe2f082030fbffc9bc195a907a52f872d9e671ac317e117e894c9e4b9edba6f9997ffe2e0c0ca6ed623b7d99dc735a4d495b2fa903d43e394b00ac065787426

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ba832d4e462c8ea985e4f5f990df8288

SHA1
98ff891df8a8beb3f9c23ed2fb9deeac17013218

SHA256
6a0fee1e6ddfd96b3d5f3155e922fdf99af9a4fe4bc1df9f9770d562a27a791b

SHA512
0a2d3ae80d5f094f40245fff3ba9ac03be257be7ffcc0dedcc61fbf36fa25aa9cf8fa03b428b7788e824b22aed63e722c05e193de9f62d6eeb8b88529fe46455

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
e24531c951816f932c3e244ceaf36c92

SHA1
4bb9b3b786be36a4e3efe0d2c82c8b5bd0193719

SHA256
99c0da507ea691d9b9ecdae04f1a384d4cea1c5e5062b5702bd1005996573eb2

SHA512
fca6dcdc000f0a8688c94c696e81c0632a0eaa0d80a539780cda4ace77588e5818003325bdc341113d2465133eb8bcb72dacc2179e6bd9a0bc8ae262aaa6c8f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
f5284ad927ad396e5ba9c0d0eb0364e4

SHA1
b8d3aea8fbfe1043f07b144247789670f18b5f5d

SHA256
a54753c40e767694042aa384769556ac8aefd90167124bf9bc1f56021a02f6f6

SHA512
23674ac94dcee22c5be06b56350d706b1b6d1f7b8bb18c6673077534eaf8e000b41058f503768f03f079e231a623bc272c2d242a7208928b5fbc3c17d125f2c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
417e351078d25d4d37b8f5262a3bea3d

SHA1
940f9576153be229e161c64d2afc9b044d75e37a

SHA256
5b7228342f9171bcc4a41be0242b16abe55f147e4805b164eaec965325c74b99

SHA512
e587b2f03fb5ae1e1bd3cf88590f514b05be6127e844e27274ca51d3a34d5af008cabb24720dc4925ef4cb4e0f0fb4b150c5d56839476fe5f2d980e318f37d40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a2ffde02d44e3393223bde1514d36e17

SHA1
b025d931f81c52ef019b76558d1f3f751586943e

SHA256
8cb8bbdb8aa60aaad68ca605fb6b0f50882ae07e4bc9d8fa7043e3080997f460

SHA512
5665da8a1f2232348b7b91c3e333c1dfcdb4ee224b5e2584f14258c652d7385b1f2a7bbf319c273ab8f983428ec64861001f968435db6210bf70a9d9d5bd1e2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
dff2096822b69f8b6ff55b75074f10ca

SHA1
44163072d16c54d590acd0705e173dec4b78c28d

SHA256
425361ae2358e0ee0a2e5cb36e59e7965fadbc5f342ae3d3bf90f84d3b0af9d4

SHA512
7a016580b6a1e2c48820f0813093422e6495d76154326a9d7a70ad2833c64958424ca9e0387392b750ae0a6b556fe220319c1a5be002c2bd0e0bc82227fe0dc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0c6cc3e9eae5b834b85d282177891092

SHA1
8f8dc10f5182c4128fddd6cab358c980ac7a9ce0

SHA256
f2c676f1a2ea48ffbfc5da2f4cc50042f270e2ef9255e8b9d499b4133487afd7

SHA512
1ce7bb24440c5f999a0e570fe6b831f1abef2771a935017975619a6e63eae7404041396e9358b86e888dbe497be31ca4a8c5efa406864ee2b33eadf761ac160a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5819bd.TMP

Filesize
874B

MD5
1cb718fe2203ecff4609aa741ee5a770

SHA1
652dfa936558146e514df0459941acc1c0e93957

SHA256
2988486075fc58eba4679bb5b84b29cfbded4d5b144e37b3f8aa6a160374e11a

SHA512
4a710e7407488ce9bb077e9378a9700b9879a57cb8e7c7e1bb8abdab495560f44e9a0978f87071978f0e9a25956d6f72febd33898dae35e8e12dc5ed61b25bb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f31d8f68-e9a8-42a0-a646-3f43109e6a97.tmp

Filesize
5KB

MD5
317cb40ce42b809b089a3294514398f5

SHA1
c6729ca99e7bc1ab1b899e8387c3334345cd631b

SHA256
48120c25d695571595917037d4dfa02197aee7fdb26c058345e80cee18378e58

SHA512
d1d6e318f50ba4ca6529985b336b43794bcab8e43851538e91618e80ce04d379a9ab7084a3ae1830a7984a534d1870b79319b91483fd6e5f097e42cd5f05b13c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9e6ae02b60964b64a60537a6600364b8

SHA1
1743b2653276dec66ca746f94757415d22143751

SHA256
3258ff6a16b2569bca87bc30b298c4bf69a7830840fc1620b572d8a7b156854c

SHA512
d722a85d4a6f6c1d4611d5459ec5a697116869736abda9b116448504c1b1efadea88a6a526f046b78586bc5569722475d3ae37e3b7a7408c97eedd105d2b3b99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
dbbb770a92ef936b0361755fc3430031

SHA1
0f3b2c093ddaf3302ade7626d54b0e5cd0eaed94

SHA256
fa46674ad8f00d361b3a950eaadae853f2df786cd88526a0ee6ee5f46b4b23c1

SHA512
7e4eb3e4bc1c65ad814e5847540998bce5e5ecf51aad1a097ad12b680a85645f3c29c5b606530d7d69ab9c601270645716a3f6bbd3a81ee3f0926531cd78df30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
68590b114c47a0e402125918d21d2d50

SHA1
2d24d75263e6e1066731cc8241c41314f805b9bf

SHA256
fb76f7dfb7695d42658754efc1c5283b850e3e12e2cd0256b2f8cd857ad131e7

SHA512
5eda020559f8cc15a22f91605918e13b355a14866b3e693f5538202fd0572fad0ab4fdbd6f050b6c05c9365508caba207cc7e1da517f2f525dc5b3b460619f0e

Download Submit
memory/1444-424-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1444-423-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/5532-421-0x0000000005490000-0x0000000005A34000-memory.dmp

Filesize
5.6MB

Download
memory/5532-420-0x0000000000450000-0x00000000004BA000-memory.dmp

Filesize
424KB

Download