Analysis
-
max time kernel
103s -
max time network
106s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250113-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
21-01-2025 07:26
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbFp5OTRvYk4yRmE3UWZ2Ykw2UTgwV1RBcENkUXxBQ3Jtc0tteTgtMW94d090NnpCWnlrZzdPcnVXdElyempfY0wyTWFTb3NpNVVhVXJTazVrUzRPM2hqdlNVVlpCWlUybDZCSnVNQmxiODRuMjVpVGUzdE9zTlpfU3dVZWRwUW9zbXFKVTI3UTVQc3BobXBLVnNXMA&q=https%3A%2F%2Fapp.mediafire.com%2Flwu3tilsok3mw&v=ZdQClilkODs
Resource
win10ltsc2021-20250113-en
General
-
Target
https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbFp5OTRvYk4yRmE3UWZ2Ykw2UTgwV1RBcENkUXxBQ3Jtc0tteTgtMW94d090NnpCWnlrZzdPcnVXdElyempfY0wyTWFTb3NpNVVhVXJTazVrUzRPM2hqdlNVVlpCWlUybDZCSnVNQmxiODRuMjVpVGUzdE9zTlpfU3dVZWRwUW9zbXFKVTI3UTVQc3BobXBLVnNXMA&q=https%3A%2F%2Fapp.mediafire.com%2Flwu3tilsok3mw&v=ZdQClilkODs
Malware Config
Extracted
lumma
https://encirelk.cyou/api
Signatures
-
Lumma family
-
Executes dropped EXE 4 IoCs
pid Process 1068 Loader.exe 3396 Loader.exe 5104 Loader.exe 6092 Loader.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1068 set thread context of 3396 1068 Loader.exe 125 PID 5104 set thread context of 6092 5104 Loader.exe 135 -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\eed7bc31-8e76-456b-8799-ecc661b2ed0d.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20250121072707.pma setup.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 1304 1068 WerFault.exe 123 5232 5104 WerFault.exe 134 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Loader.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2503671516-4119152987-701077851-1000_Classes\Local Settings msedge.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 5992 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3000 msedge.exe 3000 msedge.exe 2812 msedge.exe 2812 msedge.exe 2408 identity_helper.exe 2408 identity_helper.exe 5728 msedge.exe 5728 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
pid Process 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeRestorePrivilege 5260 7zG.exe Token: 35 5260 7zG.exe Token: SeSecurityPrivilege 5260 7zG.exe Token: SeSecurityPrivilege 5260 7zG.exe Token: SeRestorePrivilege 5576 7zG.exe Token: 35 5576 7zG.exe Token: SeSecurityPrivilege 5576 7zG.exe Token: SeSecurityPrivilege 5576 7zG.exe -
Suspicious use of FindShellTrayWindow 46 IoCs
pid Process 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 5260 7zG.exe 5576 7zG.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe 2812 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2812 wrote to memory of 992 2812 msedge.exe 82 PID 2812 wrote to memory of 992 2812 msedge.exe 82 PID 2812 wrote to memory of 2348 2812 msedge.exe 83 PID 2812 wrote to memory of 2348 2812 msedge.exe 83 PID 2812 wrote to memory of 2348 2812 msedge.exe 83 PID 2812 wrote to memory of 2348 2812 msedge.exe 83 PID 2812 wrote to memory of 2348 2812 msedge.exe 83 PID 2812 wrote to memory of 2348 2812 msedge.exe 83 PID 2812 wrote to memory of 2348 2812 msedge.exe 83 PID 2812 wrote to memory of 2348 2812 msedge.exe 83 PID 2812 wrote to memory of 2348 2812 msedge.exe 83 PID 2812 wrote to memory of 2348 2812 msedge.exe 83 PID 2812 wrote to memory of 2348 2812 msedge.exe 83 PID 2812 wrote to memory of 2348 2812 msedge.exe 83 PID 2812 wrote to memory of 2348 2812 msedge.exe 83 PID 2812 wrote to memory of 2348 2812 msedge.exe 83 PID 2812 wrote to memory of 2348 2812 msedge.exe 83 PID 2812 wrote to memory of 2348 2812 msedge.exe 83 PID 2812 wrote to memory of 2348 2812 msedge.exe 83 PID 2812 wrote to memory of 2348 2812 msedge.exe 83 PID 2812 wrote to memory of 2348 2812 msedge.exe 83 PID 2812 wrote to memory of 2348 2812 msedge.exe 83 PID 2812 wrote to memory of 2348 2812 msedge.exe 83 PID 2812 wrote to memory of 2348 2812 msedge.exe 83 PID 2812 wrote to memory of 2348 2812 msedge.exe 83 PID 2812 wrote to memory of 2348 2812 msedge.exe 83 PID 2812 wrote to memory of 2348 2812 msedge.exe 83 PID 2812 wrote to memory of 2348 2812 msedge.exe 83 PID 2812 wrote to memory of 2348 2812 msedge.exe 83 PID 2812 wrote to memory of 2348 2812 msedge.exe 83 PID 2812 wrote to memory of 2348 2812 msedge.exe 83 PID 2812 wrote to memory of 2348 2812 msedge.exe 83 PID 2812 wrote to memory of 2348 2812 msedge.exe 83 PID 2812 wrote to memory of 2348 2812 msedge.exe 83 PID 2812 wrote to memory of 2348 2812 msedge.exe 83 PID 2812 wrote to memory of 2348 2812 msedge.exe 83 PID 2812 wrote to memory of 2348 2812 msedge.exe 83 PID 2812 wrote to memory of 2348 2812 msedge.exe 83 PID 2812 wrote to memory of 2348 2812 msedge.exe 83 PID 2812 wrote to memory of 2348 2812 msedge.exe 83 PID 2812 wrote to memory of 2348 2812 msedge.exe 83 PID 2812 wrote to memory of 2348 2812 msedge.exe 83 PID 2812 wrote to memory of 3000 2812 msedge.exe 84 PID 2812 wrote to memory of 3000 2812 msedge.exe 84 PID 2812 wrote to memory of 2736 2812 msedge.exe 85 PID 2812 wrote to memory of 2736 2812 msedge.exe 85 PID 2812 wrote to memory of 2736 2812 msedge.exe 85 PID 2812 wrote to memory of 2736 2812 msedge.exe 85 PID 2812 wrote to memory of 2736 2812 msedge.exe 85 PID 2812 wrote to memory of 2736 2812 msedge.exe 85 PID 2812 wrote to memory of 2736 2812 msedge.exe 85 PID 2812 wrote to memory of 2736 2812 msedge.exe 85 PID 2812 wrote to memory of 2736 2812 msedge.exe 85 PID 2812 wrote to memory of 2736 2812 msedge.exe 85 PID 2812 wrote to memory of 2736 2812 msedge.exe 85 PID 2812 wrote to memory of 2736 2812 msedge.exe 85 PID 2812 wrote to memory of 2736 2812 msedge.exe 85 PID 2812 wrote to memory of 2736 2812 msedge.exe 85 PID 2812 wrote to memory of 2736 2812 msedge.exe 85 PID 2812 wrote to memory of 2736 2812 msedge.exe 85 PID 2812 wrote to memory of 2736 2812 msedge.exe 85 PID 2812 wrote to memory of 2736 2812 msedge.exe 85 PID 2812 wrote to memory of 2736 2812 msedge.exe 85 PID 2812 wrote to memory of 2736 2812 msedge.exe 85 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbFp5OTRvYk4yRmE3UWZ2Ykw2UTgwV1RBcENkUXxBQ3Jtc0tteTgtMW94d090NnpCWnlrZzdPcnVXdElyempfY0wyTWFTb3NpNVVhVXJTazVrUzRPM2hqdlNVVlpCWlUybDZCSnVNQmxiODRuMjVpVGUzdE9zTlpfU3dVZWRwUW9zbXFKVTI3UTVQc3BobXBLVnNXMA&q=https%3A%2F%2Fapp.mediafire.com%2Flwu3tilsok3mw&v=ZdQClilkODs1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7fff6ad346f8,0x7fff6ad34708,0x7fff6ad347182⤵PID:992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,8693593187988074310,18133822345911295354,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:22⤵PID:2348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,8693593187988074310,18133822345911295354,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,8693593187988074310,18133822345911295354,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:82⤵PID:2736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8693593187988074310,18133822345911295354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:12⤵PID:3368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8693593187988074310,18133822345911295354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:12⤵PID:1988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,8693593187988074310,18133822345911295354,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5624 /prefetch:82⤵PID:3360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings2⤵
- Drops file in Program Files directory
PID:4904 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff708415460,0x7ff708415470,0x7ff7084154803⤵PID:4580
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,8693593187988074310,18133822345911295354,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5624 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8693593187988074310,18133822345911295354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:12⤵PID:444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8693593187988074310,18133822345911295354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6408 /prefetch:12⤵PID:3388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8693593187988074310,18133822345911295354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3632 /prefetch:12⤵PID:3240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2144,8693593187988074310,18133822345911295354,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6532 /prefetch:82⤵PID:1928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8693593187988074310,18133822345911295354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:12⤵PID:4792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8693593187988074310,18133822345911295354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6932 /prefetch:12⤵PID:5136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8693593187988074310,18133822345911295354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:12⤵PID:5376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2144,8693593187988074310,18133822345911295354,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7188 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8693593187988074310,18133822345911295354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7180 /prefetch:12⤵PID:5852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8693593187988074310,18133822345911295354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6524 /prefetch:12⤵PID:756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8693593187988074310,18133822345911295354,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:12⤵PID:5020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8693593187988074310,18133822345911295354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:12⤵PID:5276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8693593187988074310,18133822345911295354,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6468 /prefetch:12⤵PID:5580
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4904
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1724
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:6016
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\GalaxyPr00j33ct2.53v\" -ad -an -ai#7zMap11541:102:7zEvent30951⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5260
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\GalaxyPr00j33ct2.53v\GalaxyPr00j33ct2.53v\GalaxyPr00j33ct2.53v\" -ad -an -ai#7zMap1725:186:7zEvent6571⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5576
-
C:\Users\Admin\Downloads\GalaxyPr00j33ct2.53v\GalaxyPr00j33ct2.53v\GalaxyPr00j33ct2.53v\Loader.exe"C:\Users\Admin\Downloads\GalaxyPr00j33ct2.53v\GalaxyPr00j33ct2.53v\GalaxyPr00j33ct2.53v\Loader.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1068 -
C:\Users\Admin\Downloads\GalaxyPr00j33ct2.53v\GalaxyPr00j33ct2.53v\GalaxyPr00j33ct2.53v\Loader.exe"C:\Users\Admin\Downloads\GalaxyPr00j33ct2.53v\GalaxyPr00j33ct2.53v\GalaxyPr00j33ct2.53v\Loader.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3396
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1068 -s 8042⤵
- Program crash
PID:1304
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1068 -ip 10681⤵PID:3388
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\GalaxyPr00j33ct2.53v\GalaxyPr00j33ct2.53v\GalaxyPr00j33ct2.53v\key.txt1⤵
- Opens file in notepad (likely ransom note)
PID:5992
-
C:\Users\Admin\Downloads\GalaxyPr00j33ct2.53v\GalaxyPr00j33ct2.53v\GalaxyPr00j33ct2.53v\Loader.exe"C:\Users\Admin\Downloads\GalaxyPr00j33ct2.53v\GalaxyPr00j33ct2.53v\GalaxyPr00j33ct2.53v\Loader.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5104 -
C:\Users\Admin\Downloads\GalaxyPr00j33ct2.53v\GalaxyPr00j33ct2.53v\GalaxyPr00j33ct2.53v\Loader.exe"C:\Users\Admin\Downloads\GalaxyPr00j33ct2.53v\GalaxyPr00j33ct2.53v\GalaxyPr00j33ct2.53v\Loader.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6092
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 8082⤵
- Program crash
PID:5232
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5104 -ip 51041⤵PID:6124
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5254fc2a9d1a15f391d493bff79f66f08
SHA16165d5a9de512bb33a82d99d141a2562aa1aabfb
SHA2562bf9282b87bdef746d298cff0734b9a82cd9c24656cb167b24a84c30fb6a1fd0
SHA512484a1c99ee3c3d1ebf0af5ec9e73c9a2ca3cf8918f0ba2a4b543b75fa587ec6b432866b74bcd6b5cdd9372532c882da438d44653bd5bccdbc94ebc27852ff9e2
-
Filesize
152B
MD55c6e737e2bdd88e612b154988c766840
SHA18f958e9b305298bb9885906729268badd6fc6e7b
SHA256436526d1765c814e2e83859bab221115960840c3d4148397b50f33b1303312e2
SHA512cb2c27b62726cf0b51ce1fd2449ae5160ae533d61af1014e4e829b24fd7e04c578f5c7c14535bfcd2d6302c120c2eb3ab1f5a4547fc31c86256a39bd8b4135b0
-
Filesize
152B
MD55408de1548eb3231accfb9f086f2b9db
SHA1f2d8c7e9f3e26cd49ee0a7a4fecd70b2bf2b7e8a
SHA2563052d0885e0ef0d71562958b851db519cfed36fd8e667b57a65374ee1a13a670
SHA512783254d067de3ac40df618665be7f76a6a8acb7e63b875bffc3c0c73b68d138c8a98c437e6267a1eb33f04be976a14b081a528598b1e517cdd9ad2293501acc8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize48B
MD5c5bd1204bcd90e6d322af4a0e8ddc57e
SHA18ee8dd1413d7d7803af0dd394fd34ddba2b867c7
SHA25629eee3100cec7854a2123b2e3ebf957afb829adf85fdc8226947bdd356e549c4
SHA512e42bdbcf849781eae4b74f194dcd087c689ab020795a978caa6a44f763c02e287c00fb0a63cf0bbfe44751940710f539a5078d4ea5726e4e6ff8a7f82765a067
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize984B
MD50ab071e304bae03c987df5c7050c677f
SHA154290d02fed690d53582287751dd0825c4a659e7
SHA25641fc7c50036e21d1bfe1e12cccf8a5b78eb78fa4ef550525f29da61c7722a614
SHA5129fbcc5bb8650ba6c2bbb2d881bc96ebbcec13f368315bb565e9d552171e2461403c4c98aba84f5bffbf4430b19600df77b1c91c47f999bd1e76e5c391389e5f3
-
Filesize
70KB
MD5e5e3377341056643b0494b6842c0b544
SHA1d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA256e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
SHA51283f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef
-
Filesize
3KB
MD533495ac52daa7044996cf912a4c51d41
SHA1affd3aedae66a121a327468352f3a2143e3a5f29
SHA2567aed6857a555d4e23d4393136d975bd9df8287d69a03fd98ab3fd17ea9e76520
SHA512cbbb7f7fb54cb36c1deb01badc6f26296bd6d4234130fe37a1dfcbcf0b700b39253907a60aca2fe3d72cc96943e94bbdb501487843cca98dac5ff04cfdc14c7c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe5892f4.TMP
Filesize59B
MD52800881c775077e1c4b6e06bf4676de4
SHA12873631068c8b3b9495638c865915be822442c8b
SHA256226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
-
Filesize
5KB
MD5f3c47a8b597502d2882d3c01172a6908
SHA176dde2da95d3cac26babc3495fb9103f59790da2
SHA256b993634eca22ce3ee8532bb630a5b02ae80086b76c3ef9168294ef9141575d9b
SHA512c4309d7c96067b9b67efbf902519e48945294c18474a7061d7765ffd0ef78463fd184edd6d8aa3a9e42b70a6f73b5a674f4b38e243284c4416ed28f86f9cdae1
-
Filesize
6KB
MD564b72d3d370006ba6c79c98955d6426c
SHA18880656a210a722b0d30ad834d7581a45cd49a6c
SHA2563547d05f8b9f9e480508a5459e3e1fedd33ce130cc48acee04078364de03160d
SHA5122e35783adeea71a6e874668692e0105269828746b5a895087d184b3e8b6de2be3729a3a365b3085ee05d8b6b3233ee12edc8aaee2d6c884720ae7269bc10e8d4
-
Filesize
8KB
MD556acb9490bc56139b34e5d9239590e82
SHA13b5d1ca4ead176728ea6d061d1d7d7010d2012fe
SHA256ca78a877b30e7b56c2b6b8d10758e513a500c8d64d8164a21e3c6151f68fa780
SHA512901444ea80f8001b651c0c8fec742bd1babbf49cbe445d842b0bd157dbd1852870e09f6bf1efb318c691bb89d9357feec57c7a8980d1fc878f11ba1a37627c2b
-
Filesize
24KB
MD548febe0b0625901956573dfb2378e7ed
SHA1c324173a8f8fd7a6a7398f6bb24dd2ee11d3cf24
SHA256f0fae7ad33efdd05845d0d631ce8341ea4b6dfd4c45be844f0c117738df9c0d0
SHA512fc38a0c64e67e3b5d43f787fe86f700e6f753d8e90bcebc446d4a8c631b9e4362a74fa862a5b2ffc74f3f5236d3ecf006b341042b5469d1cc24f2c325a607a91
-
Filesize
24KB
MD5bc3a0ca62cfef580ff9ebbb7afc92b9b
SHA1fde9832ce521fcd53850d0701a543ef75b772e3b
SHA256b0203fb7c3812937e92ac04ad6065a2129bc165a36a60a4d2fdb0accc4499464
SHA512fc1f3a5bd2106d9b6ed5a678c2f4978550a0d7414172b0ce6954a835b0da01ac28c177955a48c2ef56ea3d517a6672474a9cab873aeccae3f22a45ccf2d070de
-
Filesize
1KB
MD58dee313a90f798ce694a413c8f0eaf92
SHA1cdb905093485b499978c23723296560d00f98c16
SHA256bee699601aac7f8b6fb3ed73422affbc0dae33a6f6b6af1f3dfe263edcd335f0
SHA5121d2af886ca89a3291d7fea4759093cce47115c28f8d17f72bb9bf70ba03e4568ee28b7e61ba8a4d36f2b51f92c5232bc45811e69d88bd469af5ad451fa7160d7
-
Filesize
874B
MD5e680a4a5975f341f64d99e7c3ddfdb8f
SHA1a2a751ed53a607bab23f158e19c991b423031e15
SHA256397528d25896318bcb4d3ea2513593e704b60e21edf4227772629983839e1fa6
SHA512f4915667e2cbfe6839d51501bc331586e4bf3cd0453e479685d5e89dc399499a9dbdd0a58a4503e4e5a665ea0ae3e24aaed5a4290127a956ef4a9830b51264f8
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
8KB
MD540e5ae4b71696a7d6b7e0acfe1fc84d1
SHA134205e049808b6c92df19cc09651c629779de5e5
SHA256d7fe8000d1201555bec3604249022a688508b19c47517b40da6846c6e8662611
SHA512726435af5c4182b630632c8224e05aa3f9ca79809fc5524a065f3338c337ce1a0485ca3d4d7fb9606b6ea7a613f0de8e5be7f68729c6421faf5b6e2fd14a1920
-
Filesize
10KB
MD54b3018e1b4c0c25964a91de064fc0a41
SHA1a032b996509684b9e2c762ce6f4cf98a0fd4d0b0
SHA2566bbcf78e2ab088eb4dda952b5e3bdc179700536a13b82a19945fca78e6485826
SHA51205470ef8c339b5683958995bdaeaeab5f88a87d78651a312e5363105ab6a37b497c9464c45badf3fe3cd9e1d339c9cce35b3c0a5ccfb87925d56966e4b8cacb4
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize3KB
MD530d10b1eb1c42c9f50e012a4326869aa
SHA1f79e035ac46e6e7467a1c864ea52334313dc3eb6
SHA2565dae743da4f800f4593a79bf7bec198ef98e71d44a8930da371db11c17eb98d0
SHA512e86b1b9396746281f011b5e8974ba8ef55b4d5d1968ff306e7f74a28ae5330329d237efd2611e1d657833e484a607136ad4650e0b584e13d6f797b681c9c7d62
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize3KB
MD592e9fde39fdcade74a546c7a96880093
SHA1b8257b2e492abb7d109a55304fcd5fdc6105bbb1
SHA2560c2143cedb0e76d5a2a0c8d5d2fa9f46ea475d5d2823f2bb6873cc9644a8d688
SHA5128fb25d86b5c9a11dfb225ffc841102e1da92868d4cc37b8d0db9cf13a33063d762b9b3f6a2ddfe309669c379f216af96b6f1c74f4245c5c8ec014322928225f2
-
Filesize
6.9MB
MD532fb4a6d6e97b3c7562cb020ad84be50
SHA1717a8e382d4500c675309d95951ea3dbcdd6b067
SHA256f44151283372b284613de83b17b3f9fdb64b69d820b2a647b70488772268fe5e
SHA512b28b31bacc3cc3fd244bc56fd4a5b5cb43fce9f72654683a19aaca5f30c262e1fdd51259ee9b9445efd736f78514df5f91bad0fcfb5207c388975af20255d3dd
-
Filesize
6.9MB
MD53f32ed300cd863135cf746e87f67c7ed
SHA11b84585f0cf35f9f7fe5f72acfc16732045c8c85
SHA256234718e321a9cd6bd587448b4a5280b67aeec2268a90537f9e8773d2eca66ca9
SHA51232f30bdce5244d50a677094fce18f2e681604aa36c5df0e30a6b26b55ac7888481bc1462d1b4542fd15611623dbe9b52411221c372ba09ad0e1ea60c3653c768
-
Filesize
409KB
MD56f948c0c995e10a6b890acf13d676b66
SHA1b4929a5678cbcee64d386df0f1e36eee5fc445d5
SHA256fbf3286e17db42b192e91f002526bb6721203a5c6488d4b65d5a5740074e2dcd
SHA512a0af340cdb7ec23d06bed3f3f58ad0517b0a04f50bbf4ffaed12895e8551761cc46cd45ec7a76a9837354ac226ddd46e18156e0c5d63a309cfe9594d21be7419
-
Filesize
79B
MD534a5e6be9ebf6a1dfa749ec60066306d
SHA1ae70830c9e1083b6ba10db926643d08bba10f12a
SHA25612b8972d278becf0d8abfd7e3c7036fcdea772655d154b204371c5101b78f4e8
SHA51211de0910235e12b13860ee4cf4441ed81c4ef8ac0c59c279329abf4b1deeb507de7e3ecdbd066a39d7658eb3e38672d1d212d5c889376949b78f97798e825d2d