lumma | hxxps://darknessonyx[.]com/ryos

Resubmissions

15-01-2025 13:22

250115-qmnw7stncw 10

15-01-2025 13:22

250115-ql7mxsvqbm 3

Analysis

max time kernel
105s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15-01-2025 13:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://darknessonyx.com/ryos

Score

10^/10

lumma discovery phishing stealer

Malware Config

Extracted

Family

lumma

https://uprootquincju.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
A potential corporate email address has been identified in the URL: [email protected]
phishing
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4268	msedge.exe
4268	msedge.exe
2180	msedge.exe
2180	msedge.exe
2840	identity_helper.exe
2840	identity_helper.exe
5028	msedge.exe
5028	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 30 IoCs

pid	Process
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2820	2180	msedge.exe	82
PID 2180 wrote to memory of 2820	2180	msedge.exe	82
PID 2180 wrote to memory of 2716	2180	msedge.exe	83
PID 2180 wrote to memory of 2716	2180	msedge.exe	83
PID 2180 wrote to memory of 2716	2180	msedge.exe	83
PID 2180 wrote to memory of 2716	2180	msedge.exe	83
PID 2180 wrote to memory of 2716	2180	msedge.exe	83
PID 2180 wrote to memory of 2716	2180	msedge.exe	83
PID 2180 wrote to memory of 2716	2180	msedge.exe	83
PID 2180 wrote to memory of 2716	2180	msedge.exe	83
PID 2180 wrote to memory of 2716	2180	msedge.exe	83
PID 2180 wrote to memory of 2716	2180	msedge.exe	83
PID 2180 wrote to memory of 2716	2180	msedge.exe	83
PID 2180 wrote to memory of 2716	2180	msedge.exe	83
PID 2180 wrote to memory of 2716	2180	msedge.exe	83
PID 2180 wrote to memory of 2716	2180	msedge.exe	83
PID 2180 wrote to memory of 2716	2180	msedge.exe	83
PID 2180 wrote to memory of 2716	2180	msedge.exe	83
PID 2180 wrote to memory of 2716	2180	msedge.exe	83
PID 2180 wrote to memory of 2716	2180	msedge.exe	83
PID 2180 wrote to memory of 2716	2180	msedge.exe	83
PID 2180 wrote to memory of 2716	2180	msedge.exe	83
PID 2180 wrote to memory of 2716	2180	msedge.exe	83
PID 2180 wrote to memory of 2716	2180	msedge.exe	83
PID 2180 wrote to memory of 2716	2180	msedge.exe	83
PID 2180 wrote to memory of 2716	2180	msedge.exe	83
PID 2180 wrote to memory of 2716	2180	msedge.exe	83
PID 2180 wrote to memory of 2716	2180	msedge.exe	83
PID 2180 wrote to memory of 2716	2180	msedge.exe	83
PID 2180 wrote to memory of 2716	2180	msedge.exe	83
PID 2180 wrote to memory of 2716	2180	msedge.exe	83
PID 2180 wrote to memory of 2716	2180	msedge.exe	83
PID 2180 wrote to memory of 2716	2180	msedge.exe	83
PID 2180 wrote to memory of 2716	2180	msedge.exe	83
PID 2180 wrote to memory of 2716	2180	msedge.exe	83
PID 2180 wrote to memory of 2716	2180	msedge.exe	83
PID 2180 wrote to memory of 2716	2180	msedge.exe	83
PID 2180 wrote to memory of 2716	2180	msedge.exe	83
PID 2180 wrote to memory of 2716	2180	msedge.exe	83
PID 2180 wrote to memory of 2716	2180	msedge.exe	83
PID 2180 wrote to memory of 2716	2180	msedge.exe	83
PID 2180 wrote to memory of 2716	2180	msedge.exe	83
PID 2180 wrote to memory of 4268	2180	msedge.exe	84
PID 2180 wrote to memory of 4268	2180	msedge.exe	84
PID 2180 wrote to memory of 3748	2180	msedge.exe	85
PID 2180 wrote to memory of 3748	2180	msedge.exe	85
PID 2180 wrote to memory of 3748	2180	msedge.exe	85
PID 2180 wrote to memory of 3748	2180	msedge.exe	85
PID 2180 wrote to memory of 3748	2180	msedge.exe	85
PID 2180 wrote to memory of 3748	2180	msedge.exe	85
PID 2180 wrote to memory of 3748	2180	msedge.exe	85
PID 2180 wrote to memory of 3748	2180	msedge.exe	85
PID 2180 wrote to memory of 3748	2180	msedge.exe	85
PID 2180 wrote to memory of 3748	2180	msedge.exe	85
PID 2180 wrote to memory of 3748	2180	msedge.exe	85
PID 2180 wrote to memory of 3748	2180	msedge.exe	85
PID 2180 wrote to memory of 3748	2180	msedge.exe	85
PID 2180 wrote to memory of 3748	2180	msedge.exe	85
PID 2180 wrote to memory of 3748	2180	msedge.exe	85
PID 2180 wrote to memory of 3748	2180	msedge.exe	85
PID 2180 wrote to memory of 3748	2180	msedge.exe	85
PID 2180 wrote to memory of 3748	2180	msedge.exe	85
PID 2180 wrote to memory of 3748	2180	msedge.exe	85
PID 2180 wrote to memory of 3748	2180	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://darknessonyx.com/ryos
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffded8446f8,0x7ffded844708,0x7ffded844718
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,16250434155243086329,13882487128577231198,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,16250434155243086329,13882487128577231198,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,16250434155243086329,13882487128577231198,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16250434155243086329,13882487128577231198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16250434155243086329,13882487128577231198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16250434155243086329,13882487128577231198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16250434155243086329,13882487128577231198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16250434155243086329,13882487128577231198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16250434155243086329,13882487128577231198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,16250434155243086329,13882487128577231198,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,16250434155243086329,13882487128577231198,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16250434155243086329,13882487128577231198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16250434155243086329,13882487128577231198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16250434155243086329,13882487128577231198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16250434155243086329,13882487128577231198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16250434155243086329,13882487128577231198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16250434155243086329,13882487128577231198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16250434155243086329,13882487128577231198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16250434155243086329,13882487128577231198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16250434155243086329,13882487128577231198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16250434155243086329,13882487128577231198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16250434155243086329,13882487128577231198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16250434155243086329,13882487128577231198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16250434155243086329,13882487128577231198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16250434155243086329,13882487128577231198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16250434155243086329,13882487128577231198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16250434155243086329,13882487128577231198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16250434155243086329,13882487128577231198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7192 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16250434155243086329,13882487128577231198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7208 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16250434155243086329,13882487128577231198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16250434155243086329,13882487128577231198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7464 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16250434155243086329,13882487128577231198,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7452 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16250434155243086329,13882487128577231198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16250434155243086329,13882487128577231198,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7344 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2136,16250434155243086329,13882487128577231198,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1936 /prefetch:8
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16250434155243086329,13882487128577231198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7488 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,16250434155243086329,13882487128577231198,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1344

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3588

C:\Users\Admin\Downloads\8WL@O7_XlRY\Bootstrapper.exe
"C:\Users\Admin\Downloads\8WL@O7_XlRY\Bootstrapper.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2604

C:\Users\Admin\Downloads\8WL@O7_XlRY\Bootstrapper.exe
"C:\Users\Admin\Downloads\8WL@O7_XlRY\Bootstrapper.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3640

C:\Users\Admin\Downloads\8WL@O7_XlRY\Bootstrapper.exe
"C:\Users\Admin\Downloads\8WL@O7_XlRY\Bootstrapper.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2784

C:\Users\Admin\Downloads\8WL@O7_XlRY\Bootstrapper.exe
"C:\Users\Admin\Downloads\8WL@O7_XlRY\Bootstrapper.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4108

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\8WL@O7_XlRY\README.txt
1⤵
PID:1328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
744B

MD5
ddc80b57ad82e3a59853ca1bdd13db7a

SHA1
e876755d15afc71a9bb3b83ee0e47b538d822fcc

SHA256
47b1888d084caeee5e5af411e787b61a7aa785dc89c59c486531ae35850cb70f

SHA512
5134b23d667c70d5e6c16759c1143d40665f9d4d7b108ca533d7f6a46a03790cf266bcfe3575d86dd7daf93e80de0cad5331307cfa2c85d12937181764f0feb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
dafab94e46583a6e3d877013cb9f8760

SHA1
92c3f834695d865ac7618887ca4b8416f2c68265

SHA256
2ce959c71ecec1687799000f8058289b4c2a34cde1b80b8445f9fa5f8cefde9d

SHA512
49f2c9841e7d1f882708725170bd8275b098959f7dda71bf11b167efa4ab27d514d4a6f4aa28a9d784089cc879095694df145b747477fe100cdea6f447ed0057

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5f4e5d14ac0148bc24bd27058a000599

SHA1
7ca8889cfdc034c70a2696439b589ceddace3564

SHA256
a1a19bbe7a636617f4f36adc10612e5c152ec5e8874068f55a44e34a6cfd474c

SHA512
9b1a6cf98abd7d708093887b6a5eec9f0ffd7187b3ea3b6772f6d122f3625a561c7cd25ef36d73cb9bd6b5b93b95d03ced4a223a75639eb6b13e40300ea17275

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
85d5ba680b5b9c392fe97d11fa12149b

SHA1
b42ede8d933ec87799ebd4d7a718561d9f3b4483

SHA256
565cb5642fafad0d2ebfcb5a9ce4cd837a95e675c2ac5eaa7ed0a30e7bedb02a

SHA512
e3dc2bbf9a77cdbed31925a11c13ef74bcf45cb19a48bab6057327466e7846330496069b92a89cf19e85ffd3ccf7c8f44ed9046f705d605b904b74ab5bb4b67c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8b55fbe65dabe4c0cfce37c3b38a19c8

SHA1
cd5e9f3c03bea6b8ae0e5b4da571486016f04115

SHA256
644d2bdc85553a5a450eebfe906bf46dc9d4ca4a86e608eb7b3e9683a84a8887

SHA512
39a6ae160c68dfb35ed729f48231701fde21d0c065ddacb5dfb7fbeb8682b3faadb7ee4cc63594eba7a44f0c82ae74a77ad0c1bdad4c5447dd57d708eda9c7a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6424f506f5381ef358bfb90e870a5fd8

SHA1
09e01b6341a004678b45b07d29d19462d38a7450

SHA256
24eeec7214b359a8f37a22cd88ce1d9f7c9a910b1b2f2dff4d715a6bdebaf1d0

SHA512
482741d108caf66fc5a313c9afd41d598f0b86cd97a8a69f0bf41afbecbd3a905c895861597b9dc12e807cd85dd8f41bf02273a05d29e21258de6ed3ac4e2f32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7eeff84acf50479118389937bc180241

SHA1
1cbd9057d3b23f475fd754cfbb31e12568a65311

SHA256
52c0c5192e7a371ca4d4ddecee2cebb8dda3a1f351f44adc487307e59ce78e6c

SHA512
84e9b218a9cebb762e81bf1cfb7f5086b7c43554b8b16c80b8a9e9abbfc03384fb35a8a802e7a4e1d24abdfd99e03ff78bc3d8b2f7ed48db64dec7745adbe18a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
778ca1bfdb7b2de45b7afca89930d7a9

SHA1
9f25030a5f503af4b69dfdc3f9cba6e6a0b6016d

SHA256
60e7b935686bbdd501e90dfe55650c1a0f919e0c5a7dff8459e61e3651ebcc68

SHA512
6a9b187a3ef4f57926d6e9c771cc88c0885a1e21db3a0c452f6c37068e6f6ded048df9f365ccb96527c9727f3cca144dbfb7c2e0e2bc762c44b559d87abdfccb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57df83.TMP

Filesize
539B

MD5
d11b46dfea79e32466bb38d48e96df1c

SHA1
b32c21e878e8a13598aa0fb157b455b7d5d7c7c0

SHA256
217c1456e443e4150ede0ce303d8d347f77c58813272b0097cfe169b61bff129

SHA512
3c56c1e66d17a55ac2aa6b15293f1c3b51bff2c05b4ecbf3bba92bd86d2f224214b75db928861751b1ffc34e2dc290f25dddee9c311a45b1471ac9a79f90a935

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
520acab1c14a842f855451775a2cfeaf

SHA1
d0099f30221fb0047f933141b813fc2f401f1c75

SHA256
ce9304d6c569ce46b1907a3e6a614e96f5a85a545d76111429f67af52016396b

SHA512
cc91a1295c506f1a6aa1c56084c66ba6aa23cdb8f19afee89c8e24a9078a8471afb55d3e85807804bab865a566cf830f189855d9db5b9f3ecfdf110e034daf16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
195b243aa97785cb021a9f5206a0b76a

SHA1
710229a53eea9a9917635998782b5ad8b2cbc5c5

SHA256
96190518db6e73d138dcc174ed3180f4ee946add1257d1fb8d524eb97d818546

SHA512
15898d7b2fcc72763ffeac2186e01bf6f1b96dac1f5a3e16b27ce79d3ef73c40e655c0f500b1e7c8108a7a0c2299ca7d38d730d3a4dde6b82d7fccc05f460921

Download Submit
C:\Users\Admin\Downloads\8WL@O7_XlRY.zip

Filesize
1.3MB

MD5
f2a2deb66220dec15632f27d91bbdb16

SHA1
8edd492215d95f2df5088a2626fb87664697790a

SHA256
de94a3e312de49229cfd088163fb38610b286c7399eb5dc15410e46a25fafb2e

SHA512
ee611e2b151627adb6ce2caa5a29091a0d8e202099de56fa99fdea022a3ca03b26b5da2747a340198f81d12f57a00b58e5c7169d1ee29a38fd84e4a51fc51fd5

Download Submit
memory/2604-318-0x0000000001580000-0x00000000015D8000-memory.dmp

Filesize
352KB

Download
memory/2604-317-0x00000000036C0000-0x00000000037B8000-memory.dmp

Filesize
992KB

Download
memory/2604-316-0x00000000036C0000-0x00000000037B8000-memory.dmp

Filesize
992KB

Download
memory/2604-321-0x0000000001580000-0x00000000015D8000-memory.dmp

Filesize
352KB

Download
memory/2604-320-0x0000000001580000-0x00000000015D8000-memory.dmp

Filesize
352KB

Download
memory/2604-319-0x0000000001580000-0x00000000015D8000-memory.dmp

Filesize
352KB

Download
memory/2604-323-0x00000000036C0000-0x00000000037B8000-memory.dmp

Filesize
992KB

Download
memory/2604-324-0x0000000000AA0000-0x0000000000CD2000-memory.dmp

Filesize
2.2MB

Download
memory/2604-315-0x0000000003300000-0x00000000033F9000-memory.dmp

Filesize
996KB

Download
memory/2604-322-0x0000000001580000-0x00000000015D8000-memory.dmp

Filesize
352KB

Download
memory/2784-345-0x0000000000AA0000-0x0000000000CD2000-memory.dmp

Filesize
2.2MB

Download
memory/2784-337-0x0000000003070000-0x0000000003168000-memory.dmp

Filesize
992KB

Download
memory/2784-338-0x0000000001040000-0x0000000001098000-memory.dmp

Filesize
352KB

Download
memory/2784-339-0x0000000001040000-0x0000000001098000-memory.dmp

Filesize
352KB

Download
memory/2784-340-0x0000000001040000-0x0000000001098000-memory.dmp

Filesize
352KB

Download
memory/2784-342-0x0000000001040000-0x0000000001098000-memory.dmp

Filesize
352KB

Download
memory/2784-343-0x0000000003070000-0x0000000003168000-memory.dmp

Filesize
992KB

Download
memory/2784-341-0x0000000001040000-0x0000000001098000-memory.dmp

Filesize
352KB

Download
memory/3640-332-0x0000000000D70000-0x0000000000DC8000-memory.dmp

Filesize
352KB

Download
memory/3640-327-0x0000000003360000-0x0000000003458000-memory.dmp

Filesize
992KB

Download
memory/3640-331-0x0000000000D70000-0x0000000000DC8000-memory.dmp

Filesize
352KB

Download
memory/3640-333-0x0000000003360000-0x0000000003458000-memory.dmp

Filesize
992KB

Download
memory/3640-328-0x0000000000D70000-0x0000000000DC8000-memory.dmp

Filesize
352KB

Download
memory/3640-329-0x0000000000D70000-0x0000000000DC8000-memory.dmp

Filesize
352KB

Download
memory/3640-330-0x0000000000D70000-0x0000000000DC8000-memory.dmp

Filesize
352KB

Download
memory/3640-334-0x0000000000AA0000-0x0000000000CD2000-memory.dmp

Filesize
2.2MB

Download
memory/4108-348-0x00000000031E0000-0x00000000032D8000-memory.dmp

Filesize
992KB

Download
memory/4108-352-0x0000000001000000-0x0000000001058000-memory.dmp

Filesize
352KB

Download
memory/4108-353-0x0000000001000000-0x0000000001058000-memory.dmp

Filesize
352KB

Download
memory/4108-354-0x00000000031E0000-0x00000000032D8000-memory.dmp

Filesize
992KB

Download
memory/4108-351-0x0000000001000000-0x0000000001058000-memory.dmp

Filesize
352KB

Download
memory/4108-350-0x0000000001000000-0x0000000001058000-memory.dmp

Filesize
352KB

Download
memory/4108-349-0x0000000001000000-0x0000000001058000-memory.dmp

Filesize
352KB

Download
memory/4108-355-0x0000000000AA0000-0x0000000000CD2000-memory.dmp

Filesize
2.2MB

Download