lumma | hxxps://darknessonyx[.]com/ryos

Analysis

max time kernel
114s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-01-2025 12:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://darknessonyx.com/ryos

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://jubbenjusk.biz/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Executes dropped EXE 3 IoCs

pid	Process
1072	Bootstrapper.exe
3424	Bootstrapper.exe
2728	Bootstrapper.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3460	1072	WerFault.exe	133
2392	3424	WerFault.exe	141

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
992	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1264	msedge.exe
1264	msedge.exe
2616	msedge.exe
2616	msedge.exe
4944	identity_helper.exe
4944	identity_helper.exe
2748	msedge.exe
2748	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	428	7zG.exe
Token: 35	428	7zG.exe
Token: SeSecurityPrivilege	428	7zG.exe
Token: SeSecurityPrivilege	428	7zG.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
428	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 1852	2616	msedge.exe	83
PID 2616 wrote to memory of 1852	2616	msedge.exe	83
PID 2616 wrote to memory of 1080	2616	msedge.exe	84
PID 2616 wrote to memory of 1080	2616	msedge.exe	84
PID 2616 wrote to memory of 1080	2616	msedge.exe	84
PID 2616 wrote to memory of 1080	2616	msedge.exe	84
PID 2616 wrote to memory of 1080	2616	msedge.exe	84
PID 2616 wrote to memory of 1080	2616	msedge.exe	84
PID 2616 wrote to memory of 1080	2616	msedge.exe	84
PID 2616 wrote to memory of 1080	2616	msedge.exe	84
PID 2616 wrote to memory of 1080	2616	msedge.exe	84
PID 2616 wrote to memory of 1080	2616	msedge.exe	84
PID 2616 wrote to memory of 1080	2616	msedge.exe	84
PID 2616 wrote to memory of 1080	2616	msedge.exe	84
PID 2616 wrote to memory of 1080	2616	msedge.exe	84
PID 2616 wrote to memory of 1080	2616	msedge.exe	84
PID 2616 wrote to memory of 1080	2616	msedge.exe	84
PID 2616 wrote to memory of 1080	2616	msedge.exe	84
PID 2616 wrote to memory of 1080	2616	msedge.exe	84
PID 2616 wrote to memory of 1080	2616	msedge.exe	84
PID 2616 wrote to memory of 1080	2616	msedge.exe	84
PID 2616 wrote to memory of 1080	2616	msedge.exe	84
PID 2616 wrote to memory of 1080	2616	msedge.exe	84
PID 2616 wrote to memory of 1080	2616	msedge.exe	84
PID 2616 wrote to memory of 1080	2616	msedge.exe	84
PID 2616 wrote to memory of 1080	2616	msedge.exe	84
PID 2616 wrote to memory of 1080	2616	msedge.exe	84
PID 2616 wrote to memory of 1080	2616	msedge.exe	84
PID 2616 wrote to memory of 1080	2616	msedge.exe	84
PID 2616 wrote to memory of 1080	2616	msedge.exe	84
PID 2616 wrote to memory of 1080	2616	msedge.exe	84
PID 2616 wrote to memory of 1080	2616	msedge.exe	84
PID 2616 wrote to memory of 1080	2616	msedge.exe	84
PID 2616 wrote to memory of 1080	2616	msedge.exe	84
PID 2616 wrote to memory of 1080	2616	msedge.exe	84
PID 2616 wrote to memory of 1080	2616	msedge.exe	84
PID 2616 wrote to memory of 1080	2616	msedge.exe	84
PID 2616 wrote to memory of 1080	2616	msedge.exe	84
PID 2616 wrote to memory of 1080	2616	msedge.exe	84
PID 2616 wrote to memory of 1080	2616	msedge.exe	84
PID 2616 wrote to memory of 1080	2616	msedge.exe	84
PID 2616 wrote to memory of 1080	2616	msedge.exe	84
PID 2616 wrote to memory of 1264	2616	msedge.exe	85
PID 2616 wrote to memory of 1264	2616	msedge.exe	85
PID 2616 wrote to memory of 2864	2616	msedge.exe	86
PID 2616 wrote to memory of 2864	2616	msedge.exe	86
PID 2616 wrote to memory of 2864	2616	msedge.exe	86
PID 2616 wrote to memory of 2864	2616	msedge.exe	86
PID 2616 wrote to memory of 2864	2616	msedge.exe	86
PID 2616 wrote to memory of 2864	2616	msedge.exe	86
PID 2616 wrote to memory of 2864	2616	msedge.exe	86
PID 2616 wrote to memory of 2864	2616	msedge.exe	86
PID 2616 wrote to memory of 2864	2616	msedge.exe	86
PID 2616 wrote to memory of 2864	2616	msedge.exe	86
PID 2616 wrote to memory of 2864	2616	msedge.exe	86
PID 2616 wrote to memory of 2864	2616	msedge.exe	86
PID 2616 wrote to memory of 2864	2616	msedge.exe	86
PID 2616 wrote to memory of 2864	2616	msedge.exe	86
PID 2616 wrote to memory of 2864	2616	msedge.exe	86
PID 2616 wrote to memory of 2864	2616	msedge.exe	86
PID 2616 wrote to memory of 2864	2616	msedge.exe	86
PID 2616 wrote to memory of 2864	2616	msedge.exe	86
PID 2616 wrote to memory of 2864	2616	msedge.exe	86
PID 2616 wrote to memory of 2864	2616	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://darknessonyx.com/ryos
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb906b46f8,0x7ffb906b4708,0x7ffb906b4718
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,13041718717925493866,10029400384956429412,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,13041718717925493866,10029400384956429412,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,13041718717925493866,10029400384956429412,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13041718717925493866,10029400384956429412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13041718717925493866,10029400384956429412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13041718717925493866,10029400384956429412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3848 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13041718717925493866,10029400384956429412,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13041718717925493866,10029400384956429412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13041718717925493866,10029400384956429412,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,13041718717925493866,10029400384956429412,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,13041718717925493866,10029400384956429412,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13041718717925493866,10029400384956429412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13041718717925493866,10029400384956429412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13041718717925493866,10029400384956429412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1820 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13041718717925493866,10029400384956429412,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2772 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13041718717925493866,10029400384956429412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13041718717925493866,10029400384956429412,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2112,13041718717925493866,10029400384956429412,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4688 /prefetch:8
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13041718717925493866,10029400384956429412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1156 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2112,13041718717925493866,10029400384956429412,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3380

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4432

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\0P3NME\" -spe -an -ai#7zMap2580:74:7zEvent8713
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:428

C:\Users\Admin\Downloads\0P3NME\Bootstrapper.exe
"C:\Users\Admin\Downloads\0P3NME\Bootstrapper.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1072
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1072 -s 1304
  2⤵
  - Program crash
  PID:3460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1072 -ip 1072
1⤵
PID:4348

C:\Users\Admin\Downloads\0P3NME\Bootstrapper.exe
"C:\Users\Admin\Downloads\0P3NME\Bootstrapper.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3424
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 1324
  2⤵
  - Program crash
  PID:2392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3424 -ip 3424
1⤵
PID:1964

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\0P3NME\README.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:992

C:\Users\Admin\Downloads\0P3NME\Bootstrapper.exe
"C:\Users\Admin\Downloads\0P3NME\Bootstrapper.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
744B

MD5
025d91bcfe8344fd47bb045a58e4fe60

SHA1
146edc0b67f6571d3f6ae23fd85f08b572131d46

SHA256
855984bef56b78df9c19a9e550cc802a1dc6c575db77afeb2ebe7f152f5bc917

SHA512
5a173918b35dce9278bb02429af4b154820be0d58b900eb6b08357a9b7069f8146f955c093ada5873bd88e909a8111257c72f7d4d18903694bebd20981138d9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
28b1b2959f70e8219e381487168c2dbd

SHA1
5fdfc942c9631be32ad1a26fcd86c2d7c93d230e

SHA256
c13414bf85ed45d624d3820175d254e28a21904963655ee115929104946765f4

SHA512
aedbedbb30c2ac6d7cc7b0cf93929217afb0640450e12df2c5c2d72d674cb7a308683e7a30fbe9ad7ad71847efdb16dc86cdbfc34bac290818dae25b00c2c66f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d4b66b1d7edb53db85d9a5e243190cb3

SHA1
1ec4e7ba8aac269102c033a97e26053ec71ea7bb

SHA256
a2a101b9dd9c4063db8a0bf30d3119faec4ff78942dc27cbbf0cea227727e9af

SHA512
157ece81cc3a70abe9b8186daa1600130c0ca23b1bedc2608bd9238cba36268a2f51844f54bf6cbd570478850332be5fb9834da6d885ceea341cdfa1da6e11ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bb26576e33c9d8e586805c3fce6e82fc

SHA1
743caecc2dc911e8523e021edd348649037170b6

SHA256
5b0c449828b96e00e2c2bcb7db40e15d291c8ef4a2bbbe640219419bce6dc8e4

SHA512
983f7be9a209bd3c3beafaf21d2ccc2c88dadb959fb7469f37b237db9dc5dc908ff101fb7a8891dff5141b55b019d2b30a618b65d804e79434e97f7850894adb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8b98c3f2e762b36eb48e12e0d2d62e54

SHA1
68216a468aa87d7bfa5d725555663a7cd5a18cc7

SHA256
8a8b224fc91214f037328e4b9904f0ae000766be468b0efbcb9a49495a596e05

SHA512
26aedd16e40d4340d8877217d4346f1babaa349011641a893a517472462169eb1d5e77864f6ac57776cea80be3253b4d3ef55213505cc2a19b0be68eb20e9d8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dd641de5383d760c6f1ef3baec3161db

SHA1
c1d7605be52f318b3af1da2e889d6be9d9a04de8

SHA256
ca8bd0118516d5e61694bd1019348e13a38c98f22744bd000b69053aa4bb0960

SHA512
f12dc98db8d37e5b09bba439474a6ed67c6a9ed148e679f3cd298573ec142479572773a6e476e7ad1c1034177cd86f8c50808944d0012c178940d9d5fd74c97f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8c28a33d30db8652e51e0ffbd02bcde1

SHA1
72bb6dd1270211f51c21b0802547ccc0ee157d1f

SHA256
4261e3af62a558f3a367842015451aceafa21afd435f90ac4445bfc34060c555

SHA512
f4636cfb8b200767b5660d5b0b4b189d3c43e1b93a1948bd97a1586078b12ee9965aae3ca5caddb234dc60bf1b1c95758a76d18f6ab40384e7e9bb0eb91a12bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d919caae45a3590ede26ea5e42e99e76

SHA1
3c37edd752083543e87de4e724b99b51dbc4e9e3

SHA256
b38c4d4cb4abbd88417e44f9b7decdb9c86e7382027142d9885fb97ed154e4b2

SHA512
8e8b0a31da6a25819f53ae2ea1342adf57acbd054539d819ed087f82860be0c6a27efe00732487634382aab55f1a690110fe2b50de0dcafb611a91154c7cac59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0fb7e40d61cf2e5cfa0fb06cf6f32251

SHA1
0d848c0da1919021a4b4f7ef22d7a98fec2123b4

SHA256
14ba67ef9d1c293623e94e921dba34737b122f69b084f1d436ccb3c495af55fa

SHA512
c960c336acfbbcf73fff83faa7df4a79ff6a39d67954fc4ef7db1934d96046e58e91951e214523f68bbfb52e24cdbd6014f5bd34bdee78768ae5c6ee8edbeb0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5dd3ab46a3911a95e7b93ee0b87ba795

SHA1
2f35a2c14e8fc49507e0f49c38b7b7927e5e7e78

SHA256
21b3f4f4bc77cee82587cf08ba7310c296e3332b9ab23b684ea4a6b092be4f42

SHA512
554c85e55e563b5ad94b9b640e8651825ad884b581d8e80cb9311393c0fbde6b12142ec06b063904e2da114478c76343ca7147e8bcf7f42d9263b9cf69def61e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57df92.TMP

Filesize
533B

MD5
5a421f7c0a4147725457b7b859175363

SHA1
2cec15e2b6ea829a573b14ca0f6be6289daf1c03

SHA256
390ed25186b9d96ea4db00254edfe92d78ce991291d71c4dba418e08dd53b77a

SHA512
b1a7f0a8f7096f54cd22ee8c300c43072759d71950f4f553bcff95961a6c1adc08bd00102091eafff836183cd43535191f007f3803c72658e2ea1262d729df31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ad5c3b6b07c220f946c92d4042f2278d

SHA1
f5e989c704d5f9ec67574caf9f2d29f84f3ae2a6

SHA256
1aaeae5561ea870f10955f7c9ec8680b26bfec95419e825e814f2560a9ba54dc

SHA512
177504b2f79296d7f1818e52f93875c36e3a3d9fc0384feadcedffd7c869d053383f8f675224ad4801464e7eaba1bd3047f28234a8054bd27866a9328a045962

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
030d0a7938d9cec5a900bf7f940f1188

SHA1
3d34bc401cad6c7d649221d1373cc1806061d01b

SHA256
fb1699bcc98c5ff3b6bc01737c5447a229790e06770279a103daece4b7417b76

SHA512
b97f7126c5cf01e15df9722aa93655fb9f06533b092f7229c5089974f36c2eefc517de8374bcef620dfb6645722c312b480645125d42f39f52c1392613afa10c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ae29a3797f9048c0573ea4436d8140a4

SHA1
d53780892ac08ee2f1e7bbb2760a1160cba4ef3b

SHA256
24215536c4d055207e60f7a40baaa56c94f26f25e05de552f61cbab56f36678f

SHA512
bf22d7c70d0c5582f234b87f2ad555b532e5240ed5a3ee81324838e0804b7414ef4b0cebc4a62293b84197b0e6b466bf290e902533c6225669f1e4b0e0519ed8

Download Submit
C:\Users\Admin\Downloads\0P3NME.zip

Filesize
394KB

MD5
ac1a755bb3864daf490a75532cbd46e6

SHA1
be0f461692e39d539222129f15ecb61e1278dfff

SHA256
4bcbbb006cb4015b317e0a819575c0ed2310b5e4a1c16de462e003122e420815

SHA512
92ae375fa40f9c2701e2b2cb10a14858612b460bfecd49d45bc56a9b31bbd3b63fbe7ba660831d06ccaca4ae8ebaf6764951db003a3f9fa91309179bc5321360

Download Submit
C:\Users\Admin\Downloads\0P3NME\Bootstrapper.exe

Filesize
394KB

MD5
36abf21cd1360d76625e6f5a59f88745

SHA1
b1d19f5848a4f04dcc9b4ce81782e8fa3980c64b

SHA256
57598e8781cc58d0fbd89b739799dcb02e8d0dfb34a7a7ec0f84f12a876dff3d

SHA512
4211443b8b27890f2420c3b7186ae5ed13f2009f405802b46a39391f6036fdc496d1b301a890c59a21e7e4326f2d48d17e1ce9749fbaf16ffe3d7f53ad2605ed

Download Submit
C:\Users\Admin\Downloads\0P3NME\README.txt

Filesize
124B

MD5
3b4bb14e17a60137e3e93c7adac41bcb

SHA1
de09ed28df13d9325e816d0c656582a929077876

SHA256
bde691c014e6a2527d5ef783d065edf14bcfe83b20c1ff97c22d280633b5287e

SHA512
ec76f39b6ab4c6f822a1777c78212d659d86760458da9f050fba48bef12cba054573f25fc96278b49cdb163bed41a157123c01d3897226584cd1b57a653dfb50

Download Submit
memory/1072-274-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/3424-292-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download