lumma | 3ae6a78cb35bf01ae180a335de4f67d9cfb3b3435ae07de53c57a8341f40daa9

Analysis

max time kernel
112s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-01-2025 10:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Leak-New-01-05.html
Size

7KB
MD5

5246d7e1141b4c5a5699d725bbe5811d
SHA1

e428c54b65345173302aec4ab6925a65de3a888f
SHA256

3ae6a78cb35bf01ae180a335de4f67d9cfb3b3435ae07de53c57a8341f40daa9
SHA512

73afa44b8468821363302931df427d1835f50ea8c9a222f55559bd50a55103ed525ee5237621339da681f324d6e1cebd1b3fbde41371e02aa86836bf7bc86688
SSDEEP

96:7suWzyOiRdzcOiLjfjmZ/Q6d38C9F/pePJjeIJumKF95RZjieojwXZk9qPYf:S3Gw7m5QGLSJjeeu1hkrb

Score

10^/10

lumma discovery phishing stealer

Malware Config

Extracted

Family

lumma

https://robinsharez.shop/api

https://handscreamny.shop/api

https://chipdonkeruz.shop/api

https://versersleep.shop/api

https://crowdwarek.shop/api

https://apporholis.shop/api

https://femalsabler.shop/api

https://soundtappysk.shop/api

https://letterdrive.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

.NET Reactor proctector 2 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral2/files/0x0003000000000733-412.dat	net_reactor
behavioral2/memory/4608-420-0x0000000000B50000-0x0000000000BBA000-memory.dmp	net_reactor

A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing

Executes dropped EXE 4 IoCs

pid	Process
4608	Menu.exe
5364	Menu.exe
2368	Menu.exe
5736	Menu.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4608 set thread context of 5364	4608	Menu.exe	136
PID 2368 set thread context of 5736	2368	Menu.exe	143

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2080	4608	WerFault.exe	132
5988	2368	WerFault.exe	141

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Menu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Menu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Menu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Menu.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2272	msedge.exe
2272	msedge.exe
2352	msedge.exe
2352	msedge.exe
3700	identity_helper.exe
3700	identity_helper.exe
5384	msedge.exe
5384	msedge.exe
6016	7zFM.exe
6016	7zFM.exe
6016	7zFM.exe
6016	7zFM.exe
6016	7zFM.exe
6016	7zFM.exe
6016	7zFM.exe
6016	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6016	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	6016	7zFM.exe
Token: 35	6016	7zFM.exe
Token: SeSecurityPrivilege	6016	7zFM.exe
Token: SeSecurityPrivilege	6016	7zFM.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5548	OpenWith.exe
5688	OpenWith.exe
5688	OpenWith.exe
5688	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 1632	2352	msedge.exe	83
PID 2352 wrote to memory of 1632	2352	msedge.exe	83
PID 2352 wrote to memory of 2904	2352	msedge.exe	84
PID 2352 wrote to memory of 2904	2352	msedge.exe	84
PID 2352 wrote to memory of 2904	2352	msedge.exe	84
PID 2352 wrote to memory of 2904	2352	msedge.exe	84
PID 2352 wrote to memory of 2904	2352	msedge.exe	84
PID 2352 wrote to memory of 2904	2352	msedge.exe	84
PID 2352 wrote to memory of 2904	2352	msedge.exe	84
PID 2352 wrote to memory of 2904	2352	msedge.exe	84
PID 2352 wrote to memory of 2904	2352	msedge.exe	84
PID 2352 wrote to memory of 2904	2352	msedge.exe	84
PID 2352 wrote to memory of 2904	2352	msedge.exe	84
PID 2352 wrote to memory of 2904	2352	msedge.exe	84
PID 2352 wrote to memory of 2904	2352	msedge.exe	84
PID 2352 wrote to memory of 2904	2352	msedge.exe	84
PID 2352 wrote to memory of 2904	2352	msedge.exe	84
PID 2352 wrote to memory of 2904	2352	msedge.exe	84
PID 2352 wrote to memory of 2904	2352	msedge.exe	84
PID 2352 wrote to memory of 2904	2352	msedge.exe	84
PID 2352 wrote to memory of 2904	2352	msedge.exe	84
PID 2352 wrote to memory of 2904	2352	msedge.exe	84
PID 2352 wrote to memory of 2904	2352	msedge.exe	84
PID 2352 wrote to memory of 2904	2352	msedge.exe	84
PID 2352 wrote to memory of 2904	2352	msedge.exe	84
PID 2352 wrote to memory of 2904	2352	msedge.exe	84
PID 2352 wrote to memory of 2904	2352	msedge.exe	84
PID 2352 wrote to memory of 2904	2352	msedge.exe	84
PID 2352 wrote to memory of 2904	2352	msedge.exe	84
PID 2352 wrote to memory of 2904	2352	msedge.exe	84
PID 2352 wrote to memory of 2904	2352	msedge.exe	84
PID 2352 wrote to memory of 2904	2352	msedge.exe	84
PID 2352 wrote to memory of 2904	2352	msedge.exe	84
PID 2352 wrote to memory of 2904	2352	msedge.exe	84
PID 2352 wrote to memory of 2904	2352	msedge.exe	84
PID 2352 wrote to memory of 2904	2352	msedge.exe	84
PID 2352 wrote to memory of 2904	2352	msedge.exe	84
PID 2352 wrote to memory of 2904	2352	msedge.exe	84
PID 2352 wrote to memory of 2904	2352	msedge.exe	84
PID 2352 wrote to memory of 2904	2352	msedge.exe	84
PID 2352 wrote to memory of 2904	2352	msedge.exe	84
PID 2352 wrote to memory of 2904	2352	msedge.exe	84
PID 2352 wrote to memory of 2272	2352	msedge.exe	85
PID 2352 wrote to memory of 2272	2352	msedge.exe	85
PID 2352 wrote to memory of 4664	2352	msedge.exe	86
PID 2352 wrote to memory of 4664	2352	msedge.exe	86
PID 2352 wrote to memory of 4664	2352	msedge.exe	86
PID 2352 wrote to memory of 4664	2352	msedge.exe	86
PID 2352 wrote to memory of 4664	2352	msedge.exe	86
PID 2352 wrote to memory of 4664	2352	msedge.exe	86
PID 2352 wrote to memory of 4664	2352	msedge.exe	86
PID 2352 wrote to memory of 4664	2352	msedge.exe	86
PID 2352 wrote to memory of 4664	2352	msedge.exe	86
PID 2352 wrote to memory of 4664	2352	msedge.exe	86
PID 2352 wrote to memory of 4664	2352	msedge.exe	86
PID 2352 wrote to memory of 4664	2352	msedge.exe	86
PID 2352 wrote to memory of 4664	2352	msedge.exe	86
PID 2352 wrote to memory of 4664	2352	msedge.exe	86
PID 2352 wrote to memory of 4664	2352	msedge.exe	86
PID 2352 wrote to memory of 4664	2352	msedge.exe	86
PID 2352 wrote to memory of 4664	2352	msedge.exe	86
PID 2352 wrote to memory of 4664	2352	msedge.exe	86
PID 2352 wrote to memory of 4664	2352	msedge.exe	86
PID 2352 wrote to memory of 4664	2352	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\Leak-New-01-05.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc6cca46f8,0x7ffc6cca4708,0x7ffc6cca4718
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,5613176164751959632,8054347570468008094,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,5613176164751959632,8054347570468008094,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,5613176164751959632,8054347570468008094,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5613176164751959632,8054347570468008094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5613176164751959632,8054347570468008094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5613176164751959632,8054347570468008094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4576 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,5613176164751959632,8054347570468008094,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,5613176164751959632,8054347570468008094,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5613176164751959632,8054347570468008094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5613176164751959632,8054347570468008094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5613176164751959632,8054347570468008094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6712 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2136,5613176164751959632,8054347570468008094,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5613176164751959632,8054347570468008094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5613176164751959632,8054347570468008094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6660 /prefetch:1
  2⤵
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5613176164751959632,8054347570468008094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7052 /prefetch:1
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5613176164751959632,8054347570468008094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6516 /prefetch:1
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5613176164751959632,8054347570468008094,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7040 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5613176164751959632,8054347570468008094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6644 /prefetch:1
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5613176164751959632,8054347570468008094,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,5613176164751959632,8054347570468008094,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4256

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:432

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5548

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5688

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5932

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Leak.rar"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:6016
- C:\Users\Admin\AppData\Local\Temp\7zO087169C8\Menu.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO087169C8\Menu.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:4608
- - C:\Users\Admin\AppData\Local\Temp\7zO087169C8\Menu.exe
    "C:\Users\Admin\AppData\Local\Temp\7zO087169C8\Menu.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5364
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4608 -s 152
    3⤵
    - Program crash
    PID:2080
- C:\Users\Admin\AppData\Local\Temp\7zO087F1159\Menu.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO087F1159\Menu.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:2368
- - C:\Users\Admin\AppData\Local\Temp\7zO087F1159\Menu.exe
    "C:\Users\Admin\AppData\Local\Temp\7zO087F1159\Menu.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5736
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 148
    3⤵
    - Program crash
    PID:5988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4608 -ip 4608
1⤵
PID:4588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2368 -ip 2368
1⤵
PID:5752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002e

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
443104db5518d8f4b2e12961d56f1c82

SHA1
b149f354b9f7198c9f4311694daab4965514fd97

SHA256
a84ea496bbb9a4b5be3381e636b8d08b15a9f31217ef54e941934ee2696ef4d3

SHA512
188158c767a05bd2f652664dd9a1b0250af29fcc2fc5c602cedaede0365b3bb58a4c5d27062b87f6d7f05e25b61a7359e525f1fdd7aa83709fe96f3278df8721

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
a75975903c8c7af60002980ac21f9af5

SHA1
4f4c40b65363ce47b733bb2f0747e02432334670

SHA256
4290332e18602728afba8a5c41f8a99c4e2350f52dd670911a5409996fe50834

SHA512
7f095313f84fac1bb3b70639d92f3d949715054b4a8104deafb82c534517e3b802bb361a23148f1a023c20bef061238dfd9b0d26f9ce8d9c6e20a2377c858173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ae5abbb247184034f0a738b5e936737a

SHA1
401598b2bd6a3d4621a02b6c653c9680cf37d120

SHA256
79f9afd5d8b77d8b37f62247c770608ea598567fc6f96ab4b374e2447f3dc240

SHA512
723818ab955a0ecce00c9a27637014d260b21eeb6d3d3d62cb65d6b77ff7f37d4c7c0355b71e3864acca102ae3687b2dfbb4e88fdb55bc198ec4cb9b1d24ca28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
d350c30278a81d6857c7b9a22818faa4

SHA1
48dfb7ffd1d6e13a0f584b824075000912072fb8

SHA256
fb53f7b023b1047831bad4f6cf12d8da6eb250686598cec2f6bc105106fb9971

SHA512
d1845f19d9b6e9ba8f9ded08575ee96e2468104bd4e8273cb8158332246aa3da0026e0735c1e42582bbbe82b3ac942633870442e09aed06ab85633a8cdbe0147

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4d3e25550f505084af9bf3ab1a7a5246

SHA1
95240097a141e2a2400acecb8fd79ea3ef70c03a

SHA256
89a2f9cddc2143065a6d55a0c62bdeda3b2e6110c541c49b534dfce0929bbf9c

SHA512
c4e1e8d5000acdf4592d0dcec569a2c1fc48ecf232e7f926f3b37fcfa0af382ad387b8b3a91b65032b5f62c43bf653f32d68d9afbc313fa460e6805731e6eb29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
399917d718036e4bab29c77138bd3efa

SHA1
d5675a4916dae772ad27f94174d1954b04ba6831

SHA256
7ce8cbac1cbfb684ddc34b81bd5c90e3a02e79f2843104550e929e800c5996fd

SHA512
a2736f7bb8b991cdcc1b3c79a8bef5dbac19e3e38eb0e9f432568a00aca59db48cea9bddc6d356d744fb382f39e0d79d063915d225cb342f795f12ddc47b6d5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
76787137fdb6ec88de480280306802e6

SHA1
4471cbbb7bc698ea453b32e904d59be93fd8c5b8

SHA256
852ca3dc79dc5dd89d2e157dfe2a8d0fbf06c42dd6cbfe2b07c2b7ff76a76ea6

SHA512
29b6afb88f5ee46867f7f534bd608539c75244722e6d84c09c02293d866d333a6d56ddc30f5e36fb383a3275ea04c51a9bb59e5a884fb5cf1932db496ded2d42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
6836be374775f3cfefec097aac228889

SHA1
fea6394a5d61014bcf6b6caf88f7ac006787fb65

SHA256
4fedd21ed3bb34d1f9244f8e041a4f0c17303afe1db806d675d353ee65e4fbde

SHA512
e2d4a3d05f622fc0f73ffba6a975eee48ec3c4b1df29141b86a4085415b8dc134541e46111174d62dbd547310e224a8f73ab69c1cde2f96644a46cff442a4cd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe580923.TMP

Filesize
48B

MD5
dbc84b5e5de4aedfb0a7d621f4cf34ae

SHA1
937c9aed1a9fe62c68123ac711d7229795698808

SHA256
6371ac98dc29656e0218e35679eabd0d4fb5fba53c92978e74d0a55ca36558a2

SHA512
113161a86d05a15caf22b74f0e1100656268c7b2552185537395822c3fe111ec120ad67f8c71c36b3b52aa47bfdb34e347977b405ecc3caf6537731857bce42d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0cf34f70c95b0272d816c86a6a16bfd8

SHA1
d33f6210071fb735e1a23d52d9d367bc8a5bf34e

SHA256
79b1a15c16c9a44f91cfa36cd6a903f49f40330ad79edddd241bccb02a737917

SHA512
66dec0b3418e65bf2ca027a6e075eb28843547bf1052167ea494dc651e3e762982882a4d1cb28dee54a5a3616271a48852bdaff061eb9bdfdd2c82a1b2ef7fb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d9f5.TMP

Filesize
1KB

MD5
7cc4daec66f4f2b4995f77e0572f84a9

SHA1
74a56e484fe17333b95d8661f780c99229bc4d8d

SHA256
bcd73abb0020ac5afa1a880f53f5501bf79c8989dd774fba85995be2326133f7

SHA512
9f52e1fd0235dab918ca9689576bd997d1cf12007c34d65eefe0f659c916387dc1325d43e0e6ca90b6b7d874fde405b9784e3d201a623ceebac4309c491420c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
75e50054953b4d11e70b4a51af9fe03e

SHA1
bc8223f8cff65fcc8d8fb2f1b0929ac5f640fe23

SHA256
ba112614cc9bc814fccf2180fb7f0b12ed4e11497d14804068a21bd1ae73e7f5

SHA512
9967328deaa7b4c352df976a9419541364a6b89650e95a0dca6036fc988f53636f1edf416c1a8f551766bf0006bb91bcb97e8e35dee26a899d015c0c6b31ccaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8236c47e43f964e88131966c48bd1961

SHA1
e5a490eabb1b49d8cd2d13c7e1b721d624d89089

SHA256
00ca2b3627c0e69d142855b7fefc294a9d22ec0560557273014b7b3682f3cd3a

SHA512
fd9a806dfa5da03d806f26cb8bef64ff69e32605866d2019aa53420d6904d13ad98a69d75618937a5cbc0c5e73e8421882b606da1314dcdfe03aa20b3a16be56

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO087169C8\Menu.exe

Filesize
392KB

MD5
af0d343773e02615e49e585eedce1af5

SHA1
f597daa0c79e2857952ffc3398844ac35a34b5a8

SHA256
4a786a20c814801cef10b65caa02afadb5f89e5cc8db20adad5e29ddc49b0c3f

SHA512
d8cffba66967fc7c38a2b722213915dda931c66a4b4655fe16d3780e94db7b991fa0e4a846118f94f5a4a79d94f389e4d68f1dd7040ba88251c20085d7ff3870

Download Submit
C:\Users\Admin\Downloads\Leak.rar

Filesize
46.3MB

MD5
6964738534c5179ab96fe5b4e34c630a

SHA1
24e4e3dbea878cbfdb682580f0e420785ecf185d

SHA256
7de55dd605346df0435ea5e369291acb4372ff86b411d234ba6787d79c95d6cc

SHA512
e7143b499a659cf6e1cc193631b0dd6e269dfeea903de397f0ffa875a8a4ab3551588a14fdd25d5c33adddcf7f2571143e606a9b04e45d2938d4ee673cb476f7

Download Submit
memory/4608-420-0x0000000000B50000-0x0000000000BBA000-memory.dmp

Filesize
424KB

Download
memory/4608-421-0x0000000005C30000-0x00000000061D4000-memory.dmp

Filesize
5.6MB

Download
memory/5364-423-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/5364-425-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download