lumma | hxxps://github[.]com/raah1l2/L1ghtSpoofer

Analysis

max time kernel
66s
max time network
67s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
10-01-2025 16:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/raah1l2/L1ghtSpoofer

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Executes dropped EXE 6 IoCs

pid	Process
5496	LightSpoofer.exe
5760	batbox.exe
5836	colorecho-vc10-x86_64.exe
5980	GetInput.exe
5200	LightSpoofer.exe
4932	LightSpoofer.exe

Loads dropped DLL 3 IoCs

pid	Process
5496	LightSpoofer.exe
5200	LightSpoofer.exe
4932	LightSpoofer.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 5496 set thread context of 5688	5496	LightSpoofer.exe	120
PID 5200 set thread context of 5248	5200	LightSpoofer.exe	135
PID 4932 set thread context of 5360	4932	LightSpoofer.exe	138

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\4cba6f30-b138-43d0-bf23-af0ca7fa27f7.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20250110161102.pma	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LightSpoofer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_regiis.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	batbox.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GetInput.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LightSpoofer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_regiis.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LightSpoofer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_regiis.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4832	msedge.exe
4832	msedge.exe
444	msedge.exe
444	msedge.exe
3452	identity_helper.exe
3452	identity_helper.exe
2632	msedge.exe
2632	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
444	msedge.exe
444	msedge.exe
444	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	2748	7zG.exe
Token: 35	2748	7zG.exe
Token: SeSecurityPrivilege	2748	7zG.exe
Token: SeSecurityPrivilege	2748	7zG.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
2748	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 444 wrote to memory of 4744	444	msedge.exe	81
PID 444 wrote to memory of 4744	444	msedge.exe	81
PID 444 wrote to memory of 1168	444	msedge.exe	82
PID 444 wrote to memory of 1168	444	msedge.exe	82
PID 444 wrote to memory of 1168	444	msedge.exe	82
PID 444 wrote to memory of 1168	444	msedge.exe	82
PID 444 wrote to memory of 1168	444	msedge.exe	82
PID 444 wrote to memory of 1168	444	msedge.exe	82
PID 444 wrote to memory of 1168	444	msedge.exe	82
PID 444 wrote to memory of 1168	444	msedge.exe	82
PID 444 wrote to memory of 1168	444	msedge.exe	82
PID 444 wrote to memory of 1168	444	msedge.exe	82
PID 444 wrote to memory of 1168	444	msedge.exe	82
PID 444 wrote to memory of 1168	444	msedge.exe	82
PID 444 wrote to memory of 1168	444	msedge.exe	82
PID 444 wrote to memory of 1168	444	msedge.exe	82
PID 444 wrote to memory of 1168	444	msedge.exe	82
PID 444 wrote to memory of 1168	444	msedge.exe	82
PID 444 wrote to memory of 1168	444	msedge.exe	82
PID 444 wrote to memory of 1168	444	msedge.exe	82
PID 444 wrote to memory of 1168	444	msedge.exe	82
PID 444 wrote to memory of 1168	444	msedge.exe	82
PID 444 wrote to memory of 1168	444	msedge.exe	82
PID 444 wrote to memory of 1168	444	msedge.exe	82
PID 444 wrote to memory of 1168	444	msedge.exe	82
PID 444 wrote to memory of 1168	444	msedge.exe	82
PID 444 wrote to memory of 1168	444	msedge.exe	82
PID 444 wrote to memory of 1168	444	msedge.exe	82
PID 444 wrote to memory of 1168	444	msedge.exe	82
PID 444 wrote to memory of 1168	444	msedge.exe	82
PID 444 wrote to memory of 1168	444	msedge.exe	82
PID 444 wrote to memory of 1168	444	msedge.exe	82
PID 444 wrote to memory of 1168	444	msedge.exe	82
PID 444 wrote to memory of 1168	444	msedge.exe	82
PID 444 wrote to memory of 1168	444	msedge.exe	82
PID 444 wrote to memory of 1168	444	msedge.exe	82
PID 444 wrote to memory of 1168	444	msedge.exe	82
PID 444 wrote to memory of 1168	444	msedge.exe	82
PID 444 wrote to memory of 1168	444	msedge.exe	82
PID 444 wrote to memory of 1168	444	msedge.exe	82
PID 444 wrote to memory of 1168	444	msedge.exe	82
PID 444 wrote to memory of 1168	444	msedge.exe	82
PID 444 wrote to memory of 4832	444	msedge.exe	83
PID 444 wrote to memory of 4832	444	msedge.exe	83
PID 444 wrote to memory of 4368	444	msedge.exe	84
PID 444 wrote to memory of 4368	444	msedge.exe	84
PID 444 wrote to memory of 4368	444	msedge.exe	84
PID 444 wrote to memory of 4368	444	msedge.exe	84
PID 444 wrote to memory of 4368	444	msedge.exe	84
PID 444 wrote to memory of 4368	444	msedge.exe	84
PID 444 wrote to memory of 4368	444	msedge.exe	84
PID 444 wrote to memory of 4368	444	msedge.exe	84
PID 444 wrote to memory of 4368	444	msedge.exe	84
PID 444 wrote to memory of 4368	444	msedge.exe	84
PID 444 wrote to memory of 4368	444	msedge.exe	84
PID 444 wrote to memory of 4368	444	msedge.exe	84
PID 444 wrote to memory of 4368	444	msedge.exe	84
PID 444 wrote to memory of 4368	444	msedge.exe	84
PID 444 wrote to memory of 4368	444	msedge.exe	84
PID 444 wrote to memory of 4368	444	msedge.exe	84
PID 444 wrote to memory of 4368	444	msedge.exe	84
PID 444 wrote to memory of 4368	444	msedge.exe	84
PID 444 wrote to memory of 4368	444	msedge.exe	84
PID 444 wrote to memory of 4368	444	msedge.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/raah1l2/L1ghtSpoofer
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffc53dc46f8,0x7ffc53dc4708,0x7ffc53dc4718
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,540755192544544593,3668019337521312457,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,540755192544544593,3668019337521312457,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,540755192544544593,3668019337521312457,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,540755192544544593,3668019337521312457,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,540755192544544593,3668019337521312457,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,540755192544544593,3668019337521312457,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:656
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x10c,0x110,0x114,0x124,0x118,0x7ff744ef5460,0x7ff744ef5470,0x7ff744ef5480
    3⤵
    PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,540755192544544593,3668019337521312457,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,540755192544544593,3668019337521312457,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2092,540755192544544593,3668019337521312457,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,540755192544544593,3668019337521312457,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,540755192544544593,3668019337521312457,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:1
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,540755192544544593,3668019337521312457,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:5644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3848

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:392

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\L1ghtSpoofer-main\" -ad -an -ai#7zMap9968:96:7zEvent22453
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2748

C:\Users\Admin\Downloads\L1ghtSpoofer-main\L1ghtSpoofer-main\LightSpoofer.exe
"C:\Users\Admin\Downloads\L1ghtSpoofer-main\L1ghtSpoofer-main\LightSpoofer.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5496
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5688

C:\Users\Admin\Downloads\L1ghtSpoofer-main\L1ghtSpoofer-main\batbox.exe
"C:\Users\Admin\Downloads\L1ghtSpoofer-main\L1ghtSpoofer-main\batbox.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5760

C:\Users\Admin\Downloads\L1ghtSpoofer-main\L1ghtSpoofer-main\colorecho-vc10-x86_64.exe
"C:\Users\Admin\Downloads\L1ghtSpoofer-main\L1ghtSpoofer-main\colorecho-vc10-x86_64.exe"
1⤵
- Executes dropped EXE
PID:5836

C:\Users\Admin\Downloads\L1ghtSpoofer-main\L1ghtSpoofer-main\GetInput.exe
"C:\Users\Admin\Downloads\L1ghtSpoofer-main\L1ghtSpoofer-main\GetInput.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5980

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\L1ghtSpoofer-main\L1ghtSpoofer-main\Getlen.bat" "
1⤵
PID:6064

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\L1ghtSpoofer-main\L1ghtSpoofer-main\mac.txt
1⤵
PID:652

C:\Users\Admin\Downloads\L1ghtSpoofer-main\L1ghtSpoofer-main\LightSpoofer.exe
"C:\Users\Admin\Downloads\L1ghtSpoofer-main\L1ghtSpoofer-main\LightSpoofer.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5200
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5248

C:\Users\Admin\Downloads\L1ghtSpoofer-main\L1ghtSpoofer-main\LightSpoofer.exe
"C:\Users\Admin\Downloads\L1ghtSpoofer-main\L1ghtSpoofer-main\LightSpoofer.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4932
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\LightSpoofer.exe.log

Filesize
42B

MD5
84cfdb4b995b1dbf543b26b86c863adc

SHA1
d2f47764908bf30036cf8248b9ff5541e2711fa2

SHA256
d8988d672d6915b46946b28c06ad8066c50041f6152a91d37ffa5cf129cc146b

SHA512
485f0ed45e13f00a93762cbf15b4b8f996553baa021152fae5aba051e3736bcd3ca8f4328f0e6d9e3e1f910c96c4a9ae055331123ee08e3c2ce3a99ac2e177ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
69cd4fbd25488dc00a347c8a390c8652

SHA1
22cf04f96e4af55a94c87105201f08cf7ff47aa5

SHA256
23ef6c8a50cc68d03460913947c655fb7c62854cca6108e5c85cc472edcdd5cf

SHA512
02ef1bcd904dcba1f0f035a61593dab52eff317762cebd59261b0d211b0b7f7447814ac5ec6c47481088761a338b6ea00a2865e759565980043b47bc4f60f5bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
90d9cc370060ef5ae526755155220c89

SHA1
3d536fcef3ebde92ca496819539288686ba8528e

SHA256
db4df83a39030515b39da7becb9f640e86fe6daec54296ce4fccaf9423c29e27

SHA512
5179e5b0093b160b3f67fed92fb4edf97ff7439d970dce46c281cdcbf4589f157f7bcd1d8608cef03cc81258f3c0744f31b95db8c70f162bed255efad48e37b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\59d567ef-9fc1-43d3-8f8b-a7ca40354fa0.tmp

Filesize
24KB

MD5
d8c86e7d523ce692226bc2731ee03459

SHA1
a63bb7eba70e607d9557d5f59caf383b5a66161e

SHA256
9c2edac30eb6825a955114fcb679842a742cbba2a06413d3976047c8f1250261

SHA512
e2342039ba773cb0121540b8eb2e2b421db155384c7e48d4e40267f95759120782a905cfcdfc96931f1908f24d0d7eb5179e15e121592c3efd3e812998019f3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
6c4077367ad039e3d122afa8fa26d1e5

SHA1
8569d24ed9ca74ff3c39bc950bf1dbc9e1b594ec

SHA256
34242b1d48f0ac2ef9639cefa67003c3bf1f4dc8c60bd991ce21aa81efdbc14c

SHA512
e7ec4dba76e08d12b45d66cb88194130fe063efa97aaea07388ff89cf96c987d0be52490818861a6f133c71d091207212637c9e8dd2fe065bd604ba5f9dcd0ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
5878b90a9c2052c6753d46ca4591e46e

SHA1
135609a2823cfdbff0f76584e2673d427a831061

SHA256
64c23a4c7ffdf7498d5797efd18140d786c3570fe9f880004f03ed9e1a24e38e

SHA512
f01694e6cac746bdf342a953c19b2df62e66eab1b9d11334276faece8aaae5cf7be8762cdf0a4ba85d6ebf74be190813648f5dd7ec21003e4487ef6f30917308

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4f284b9e08b93cc9d3bdbdbbca38c88e

SHA1
3b7aa1a0ab6f9f9808b2a35c00316c497ecb46aa

SHA256
b0d0f0e34e9123a79fb860164ed963c1296f39479631a2915dd754c7d9729df2

SHA512
d727c7292e0a9f15343cfb2608c6ff87e66599acaf9685ca8f42a550deae8ea54546b8a9eb334638871dbc277cb64fd4a779ee1811bd2b08cb7d063c793602f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
03f6a9dd5ce999972c7ca721e0db9c95

SHA1
355ca0b5768acc514ec5310bd8fc2eb0bb70b5f2

SHA256
a5c38a0db25c2cb55e4c15da4cb361cf52bb41d3a4a66e9647e4a771a2cd6d83

SHA512
85fc8750418fb58eb2ea079f7aee37156cb8bc856ef71aab30daa57923529ac098c1bcccc2060957d71e5fc8dc618d56803e12fd7863fa6438e9436827d17859

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
337193f10afe50d7209100fd8906a3d0

SHA1
1c394ced7a1963b79da06d839429769cf41e7242

SHA256
db1185eb6fe5ff74789f26c23f548e1279c2fe079a0089992a9a28b9bb55ab34

SHA512
e87a1c2ae2b097790b598f995ec749aa0cb3ff91d79b30ef72493f968cc16cf88dde451ff506ad8a290a25fff18ce78deee752eccedeea1e056efe331884a61b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e93350ad54207984a320c9dfd0468e4d

SHA1
2d75b5cf38100c0b0a556b6d8329c8f406d743c2

SHA256
c28719bb55c9ec81595ad8d90c09b8751748f443fddffc98bc3b2d3941e96836

SHA512
dd3126735197329e7d69c2f053f1bc47d5ec4e3f2a25a99980b7868051fd0511fd08bd5360252d4eff2a6383ccf28dfd5eec4c2dba8520c04976eaa5f212002c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
2cad20898338fbc7fb993756151e2fe1

SHA1
740566d988a46b18920bbb42ff71eb145a931aee

SHA256
4c2f60eb2a2e891ea30a7eed7813758fb7d3200f5938e7012a22233b26b9dfa6

SHA512
e1a82109629e89a57d803f1bf0433c07d01a1fcc9db30ca81eff4a415bb4f36dd772bc05272538fc0db97a20f7475f172164fbe3142d507088770a53ec1a0796

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b4fa5cc0cda1d89093a114e02cd73186

SHA1
07fe4094df3ffbc33ec64f73b77829a5c5425e9a

SHA256
aa9040bdd832fbb3e4a35554c50cc821a41bac83b86f018fbbb69d851c12d7ef

SHA512
8b1da0200434cbc5dfdd16c4cda115cd9707ab3d4e0709f834a1b63e27158fc3439964c5c797a39b4dfb26eeae1758dc46e3afe3376361fa8927278aefe3723c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585c06.TMP

Filesize
1KB

MD5
bb896251276315fe827af45e17ecafdc

SHA1
3068c9e8409822e29db8f7b4d194f537c8779d1f

SHA256
0b0612461932642c0bf8e3d5921b5a4b5f4a40120df79c1f5dc85b1b5015b9ed

SHA512
b1589b35801524e39902140d8775e7503a41ac75b6c8acc6d35e192d9b7647aed4aa5dd005c187e4796e85d7cabe6923ee9f3801dfe3e1faf413a246ddc27cae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
510acdee18e7e9db9e01bc8e0c57d77e

SHA1
5fbfc62661fa849bff630c4132fd4d5e38d9ef4d

SHA256
01ff6ad0685713b8597c0d75d623aaf8eedc648a929d9188d36572290994ef4e

SHA512
c136955a2a70df9735c0cd2c1f18fe9c7bf9e83938e70c77c4a16b6cc89dc0172933d0b2361383e002efbd6cf45310d11326c98fb338a6cd547e586eb4b4c113

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e545d9b821e54e265c87b70cecd59f67

SHA1
f55fd429b6ae355a1098d22fc4766d4e5115dcc8

SHA256
28675770e266acc01488daf9ecce0e27c63f06def61385429d9cea08636c46b3

SHA512
33ee1eb53eaca6292898596bf43be8cac68e7d796e0abd58731c502afaf33bf953fdd7d58beb3b4aca143d64fdbbd1f5d1fde5d065d5a2af4375cc2febab12d1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
6fb4b29443b0172f46502a9baa47aaa5

SHA1
cbb70c99d406d8805d0b6fd9acffcc30f128633d

SHA256
40ef0299a3bc1e59efb464ca32d3f7cf2677ce23f59456901c01b56f28aed68a

SHA512
29a13fa3e4f010f437509733c575372b2d11e5a42ac2ca86862ea81bc0aabc17be55d90985a7cb8df149748aade372a7c52d986b5553b6f68d9ce330dd8119d6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
5e920cc6f37bdb1f39428e8f885baf5e

SHA1
02cf8698c95f086e4459f81f9a4dca50a313a1bb

SHA256
d75f95a44bdacde6fda3d095cf345ca52cc451230bdc7ab0d009e533e71fcf71

SHA512
0b26f3e14a0330276a65b4ad6a5ed4ccc4fd1219352ee104f79d52a658bc775c49ba40c74ff080b2b4fbbf5f66f4587f4b20737a66be0c0c80973a76414990e8

Download Submit
C:\Users\Admin\AppData\Roaming\gdi32.dll

Filesize
428KB

MD5
36c0b5018242a87d99e2b5000dfc29ad

SHA1
d46f1ba661e3d18c8b1e7895920368e9bddbc7ae

SHA256
94cc3d303105493943c6cce20473c82eff3942515bfd73df976e802d97be78b4

SHA512
8f10af3f519e2c52539fb79ec16cd82470f25c0863b622030ed4bd59f437c9109caf46d151c18889c4939a44672339d75029c8f757cf7118e759b90355317f0a

Download Submit
C:\Users\Admin\Downloads\L1ghtSpoofer-main.zip

Filesize
779KB

MD5
0645db6d2986bf3c8b039a4fb5653a08

SHA1
879cdf109f0a46795c36d02d3f148f7472afb497

SHA256
5c9e39c6d3c7ddbc684b129d5fabeb951a8e4f7215a46668f19d4e3621aef18c

SHA512
80834f379ee895205560f9630884418d7cc6be3d53001fabc91789283c47b576f638914427f802e3d6b4d02f5bd633f1d2d527748620d957ec7316f6380a4d45

Download Submit
C:\Users\Admin\Downloads\L1ghtSpoofer-main\L1ghtSpoofer-main\GetInput.exe

Filesize
3KB

MD5
2ba62ae6f88b11d0e262af35d8db8ca9

SHA1
69d4ccb476cfebdf572134fead42a12750580e4b

SHA256
3f5c64717a0092ae214154a730e96e2e56921be2e3f1121a3e98b1ba84627665

SHA512
a984212245e401b68872623437a512898a00d71cca7d7b0aa6733663020cae92d50ce1ae3abafbd811542a77e72c8b6a5755492c07d6ddeb2642d908142c2ccb

Download Submit
C:\Users\Admin\Downloads\L1ghtSpoofer-main\L1ghtSpoofer-main\Getlen.bat

Filesize
1KB

MD5
8c1812e76ba7bf09cb87384089a0ab7f

SHA1
d3edf2ba081073139960a955e812e6bb7f63817b

SHA256
83ce5342710a2f2e385a363402661e3426728dd6bcfe9d87e22f2fb858b07bde

SHA512
618abe11f65fe95cdc1f1834bf24ddbbea789c971788af7d2248b880e53d11a3c4302bd8e3c3c36b934f5f7d975d1b142fae8fd23c9ed6cfa118c97e01f6fd14

Download Submit
C:\Users\Admin\Downloads\L1ghtSpoofer-main\L1ghtSpoofer-main\LightSpoofer.exe

Filesize
489KB

MD5
d685ae29670dbc00b6665b5511bda6cb

SHA1
2f49b83a6d7a5f9e5151c6f7f1b3fa9e6f4b25a9

SHA256
0518c095cc948ab003cd4d12a1f95f0579c52c17f9102976b5799cd0bd85e6a2

SHA512
d7705fcd8751a49cc17962ac9b6e228f55ef74aab066cabdd5de74518686feaea951487a042683ea3e055ce04e0b971b528572aac920f325fcf64d34167450de

Download Submit
C:\Users\Admin\Downloads\L1ghtSpoofer-main\L1ghtSpoofer-main\batbox.exe

Filesize
1KB

MD5
cb4a44baa20ad26bf74615a7fc515a84

SHA1
2581868c3d560e2b200d4f21d83271430167b377

SHA256
9553bc17fa0fd08e026c1865812b3388e3d5495a5394bbf671e5a8f21c79989a

SHA512
d19e6d0ccd89e52efdd2363185564cf83fcf3a37b55659dd1fd8b6574cf45b6147989b2c7b1e8029ce8136aa7ff74900494c1a30bbb65b96d9880ab7f77b6140

Download Submit
C:\Users\Admin\Downloads\L1ghtSpoofer-main\L1ghtSpoofer-main\colorecho-vc10-x86_64.exe

Filesize
129KB

MD5
e2f377052409beeebf852803734e007a

SHA1
4d5e977acc59912bd451edae77ad58d977ed086b

SHA256
76fe5f9cef2c3a5c4f765d4c45167f4cf26cc6d469031f0d195d96724e9d82a8

SHA512
d88d3319a32ec3a8475fae03c74b1a5d7d8e92f3f5ffa1bc3326779d7d39e0bd18928a511be1ac965fb1c2e2da1cf0935fea38bbf847f54033887c62b6c842d7

Download Submit
C:\Users\Admin\Downloads\L1ghtSpoofer-main\L1ghtSpoofer-main\mac.txt

Filesize
6KB

MD5
58726bcb98b77afe581a7833c8f35f9a

SHA1
7dcf281240fcdb4b8485a7df76644be817f29cab

SHA256
e53a19f0f36d7e7be98522239e8ac2af3248f4fe4b046d9fe270e3907ce11401

SHA512
34c5ca63ac4d86b8bce0a6a2676aa8c51bab85f673cc7463ec66e505730878d5803bc0897f94a7e5e7b1832a977a728c3899d70fb08ff9a11211b18a5437cce5

Download Submit
memory/5248-431-0x00000000010F0000-0x000000000115C000-memory.dmp

Filesize
432KB

Download
memory/5248-435-0x00000000010F0000-0x000000000115C000-memory.dmp

Filesize
432KB

Download
memory/5248-432-0x00000000010F0000-0x000000000115C000-memory.dmp

Filesize
432KB

Download
memory/5360-445-0x0000000000B30000-0x0000000000B8C000-memory.dmp

Filesize
368KB

Download
memory/5360-449-0x0000000000B30000-0x0000000000B8C000-memory.dmp

Filesize
368KB

Download
memory/5360-446-0x0000000000B30000-0x0000000000B8C000-memory.dmp

Filesize
368KB

Download
memory/5496-371-0x0000000000CD0000-0x0000000000D50000-memory.dmp

Filesize
512KB

Download
memory/5688-379-0x00000000010F0000-0x000000000115B000-memory.dmp

Filesize
428KB

Download
memory/5688-378-0x00000000010F0000-0x000000000115B000-memory.dmp

Filesize
428KB

Download
memory/5688-383-0x00000000010F0000-0x000000000115B000-memory.dmp

Filesize
428KB

Download
memory/5760-387-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/5760-385-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download