umbral | hxxps://github[.]com/d1skq/Discord-Nitro-Generator/blob/main/lastloader[.]exe

Analysis

max time kernel
55s
max time network
58s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
28/01/2025, 00:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/d1skq/Discord-Nitro-Generator/blob/main/lastloader.exe

Score

10^/10

umbral defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral2/files/0x001900000002ab4a-165.dat	family_umbral
behavioral2/memory/1324-224-0x0000020EF2CC0000-0x0000020EF2D00000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Umbral family
umbral

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1236	powershell.exe
1436	powershell.exe
4076	powershell.exe
1728	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
33	2100	msedge.exe

Executes dropped EXE 1 IoCs

pid	Process
1324	lastloader.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
37	discord.com
20	discord.com
21	raw.githubusercontent.com
33	raw.githubusercontent.com
34	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\lastloader.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3572	cmd.exe
3192	PING.EXE

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
1372	wmic.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 5 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 183992.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 762708.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\lastloader.exe:Zone.Identifier	msedge.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\x4VN6.scr\:SmartScreen:$DATA	lastloader.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\x4VN6.scr\:Zone.Identifier:$DATA	lastloader.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3192	PING.EXE

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
2100	msedge.exe
2100	msedge.exe
1980	msedge.exe
1980	msedge.exe
2300	identity_helper.exe
2300	identity_helper.exe
4540	msedge.exe
4540	msedge.exe
3572	msedge.exe
3572	msedge.exe
1728	powershell.exe
1728	powershell.exe
1728	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1436	powershell.exe
1436	powershell.exe
1436	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
4076	powershell.exe
4076	powershell.exe
4076	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1324	lastloader.exe
Token: SeDebugPrivilege	1728	powershell.exe
Token: SeDebugPrivilege	1236	powershell.exe
Token: SeDebugPrivilege	1436	powershell.exe
Token: SeDebugPrivilege	1256	powershell.exe
Token: SeIncreaseQuotaPrivilege	2112	wmic.exe
Token: SeSecurityPrivilege	2112	wmic.exe
Token: SeTakeOwnershipPrivilege	2112	wmic.exe
Token: SeLoadDriverPrivilege	2112	wmic.exe
Token: SeSystemProfilePrivilege	2112	wmic.exe
Token: SeSystemtimePrivilege	2112	wmic.exe
Token: SeProfSingleProcessPrivilege	2112	wmic.exe
Token: SeIncBasePriorityPrivilege	2112	wmic.exe
Token: SeCreatePagefilePrivilege	2112	wmic.exe
Token: SeBackupPrivilege	2112	wmic.exe
Token: SeRestorePrivilege	2112	wmic.exe
Token: SeShutdownPrivilege	2112	wmic.exe
Token: SeDebugPrivilege	2112	wmic.exe
Token: SeSystemEnvironmentPrivilege	2112	wmic.exe
Token: SeRemoteShutdownPrivilege	2112	wmic.exe
Token: SeUndockPrivilege	2112	wmic.exe
Token: SeManageVolumePrivilege	2112	wmic.exe
Token: 33	2112	wmic.exe
Token: 34	2112	wmic.exe
Token: 35	2112	wmic.exe
Token: 36	2112	wmic.exe
Token: SeIncreaseQuotaPrivilege	2112	wmic.exe
Token: SeSecurityPrivilege	2112	wmic.exe
Token: SeTakeOwnershipPrivilege	2112	wmic.exe
Token: SeLoadDriverPrivilege	2112	wmic.exe
Token: SeSystemProfilePrivilege	2112	wmic.exe
Token: SeSystemtimePrivilege	2112	wmic.exe
Token: SeProfSingleProcessPrivilege	2112	wmic.exe
Token: SeIncBasePriorityPrivilege	2112	wmic.exe
Token: SeCreatePagefilePrivilege	2112	wmic.exe
Token: SeBackupPrivilege	2112	wmic.exe
Token: SeRestorePrivilege	2112	wmic.exe
Token: SeShutdownPrivilege	2112	wmic.exe
Token: SeDebugPrivilege	2112	wmic.exe
Token: SeSystemEnvironmentPrivilege	2112	wmic.exe
Token: SeRemoteShutdownPrivilege	2112	wmic.exe
Token: SeUndockPrivilege	2112	wmic.exe
Token: SeManageVolumePrivilege	2112	wmic.exe
Token: 33	2112	wmic.exe
Token: 34	2112	wmic.exe
Token: 35	2112	wmic.exe
Token: 36	2112	wmic.exe
Token: SeIncreaseQuotaPrivilege	3556	wmic.exe
Token: SeSecurityPrivilege	3556	wmic.exe
Token: SeTakeOwnershipPrivilege	3556	wmic.exe
Token: SeLoadDriverPrivilege	3556	wmic.exe
Token: SeSystemProfilePrivilege	3556	wmic.exe
Token: SeSystemtimePrivilege	3556	wmic.exe
Token: SeProfSingleProcessPrivilege	3556	wmic.exe
Token: SeIncBasePriorityPrivilege	3556	wmic.exe
Token: SeCreatePagefilePrivilege	3556	wmic.exe
Token: SeBackupPrivilege	3556	wmic.exe
Token: SeRestorePrivilege	3556	wmic.exe
Token: SeShutdownPrivilege	3556	wmic.exe
Token: SeDebugPrivilege	3556	wmic.exe
Token: SeSystemEnvironmentPrivilege	3556	wmic.exe
Token: SeRemoteShutdownPrivilege	3556	wmic.exe
Token: SeUndockPrivilege	3556	wmic.exe
Token: SeManageVolumePrivilege	3556	wmic.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 2356	1980	msedge.exe	77
PID 1980 wrote to memory of 2356	1980	msedge.exe	77
PID 1980 wrote to memory of 4740	1980	msedge.exe	78
PID 1980 wrote to memory of 4740	1980	msedge.exe	78
PID 1980 wrote to memory of 4740	1980	msedge.exe	78
PID 1980 wrote to memory of 4740	1980	msedge.exe	78
PID 1980 wrote to memory of 4740	1980	msedge.exe	78
PID 1980 wrote to memory of 4740	1980	msedge.exe	78
PID 1980 wrote to memory of 4740	1980	msedge.exe	78
PID 1980 wrote to memory of 4740	1980	msedge.exe	78
PID 1980 wrote to memory of 4740	1980	msedge.exe	78
PID 1980 wrote to memory of 4740	1980	msedge.exe	78
PID 1980 wrote to memory of 4740	1980	msedge.exe	78
PID 1980 wrote to memory of 4740	1980	msedge.exe	78
PID 1980 wrote to memory of 4740	1980	msedge.exe	78
PID 1980 wrote to memory of 4740	1980	msedge.exe	78
PID 1980 wrote to memory of 4740	1980	msedge.exe	78
PID 1980 wrote to memory of 4740	1980	msedge.exe	78
PID 1980 wrote to memory of 4740	1980	msedge.exe	78
PID 1980 wrote to memory of 4740	1980	msedge.exe	78
PID 1980 wrote to memory of 4740	1980	msedge.exe	78
PID 1980 wrote to memory of 4740	1980	msedge.exe	78
PID 1980 wrote to memory of 4740	1980	msedge.exe	78
PID 1980 wrote to memory of 4740	1980	msedge.exe	78
PID 1980 wrote to memory of 4740	1980	msedge.exe	78
PID 1980 wrote to memory of 4740	1980	msedge.exe	78
PID 1980 wrote to memory of 4740	1980	msedge.exe	78
PID 1980 wrote to memory of 4740	1980	msedge.exe	78
PID 1980 wrote to memory of 4740	1980	msedge.exe	78
PID 1980 wrote to memory of 4740	1980	msedge.exe	78
PID 1980 wrote to memory of 4740	1980	msedge.exe	78
PID 1980 wrote to memory of 4740	1980	msedge.exe	78
PID 1980 wrote to memory of 4740	1980	msedge.exe	78
PID 1980 wrote to memory of 4740	1980	msedge.exe	78
PID 1980 wrote to memory of 4740	1980	msedge.exe	78
PID 1980 wrote to memory of 4740	1980	msedge.exe	78
PID 1980 wrote to memory of 4740	1980	msedge.exe	78
PID 1980 wrote to memory of 4740	1980	msedge.exe	78
PID 1980 wrote to memory of 4740	1980	msedge.exe	78
PID 1980 wrote to memory of 4740	1980	msedge.exe	78
PID 1980 wrote to memory of 4740	1980	msedge.exe	78
PID 1980 wrote to memory of 4740	1980	msedge.exe	78
PID 1980 wrote to memory of 2100	1980	msedge.exe	79
PID 1980 wrote to memory of 2100	1980	msedge.exe	79
PID 1980 wrote to memory of 2872	1980	msedge.exe	80
PID 1980 wrote to memory of 2872	1980	msedge.exe	80
PID 1980 wrote to memory of 2872	1980	msedge.exe	80
PID 1980 wrote to memory of 2872	1980	msedge.exe	80
PID 1980 wrote to memory of 2872	1980	msedge.exe	80
PID 1980 wrote to memory of 2872	1980	msedge.exe	80
PID 1980 wrote to memory of 2872	1980	msedge.exe	80
PID 1980 wrote to memory of 2872	1980	msedge.exe	80
PID 1980 wrote to memory of 2872	1980	msedge.exe	80
PID 1980 wrote to memory of 2872	1980	msedge.exe	80
PID 1980 wrote to memory of 2872	1980	msedge.exe	80
PID 1980 wrote to memory of 2872	1980	msedge.exe	80
PID 1980 wrote to memory of 2872	1980	msedge.exe	80
PID 1980 wrote to memory of 2872	1980	msedge.exe	80
PID 1980 wrote to memory of 2872	1980	msedge.exe	80
PID 1980 wrote to memory of 2872	1980	msedge.exe	80
PID 1980 wrote to memory of 2872	1980	msedge.exe	80
PID 1980 wrote to memory of 2872	1980	msedge.exe	80
PID 1980 wrote to memory of 2872	1980	msedge.exe	80
PID 1980 wrote to memory of 2872	1980	msedge.exe	80

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3084	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/d1skq/Discord-Nitro-Generator/blob/main/lastloader.exe
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff977b3cb8,0x7fff977b3cc8,0x7fff977b3cd8
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,8732467612740805868,11105257135318873519,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,8732467612740805868,11105257135318873519,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,8732467612740805868,11105257135318873519,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,8732467612740805868,11105257135318873519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,8732467612740805868,11105257135318873519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,8732467612740805868,11105257135318873519,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,8732467612740805868,11105257135318873519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,8732467612740805868,11105257135318873519,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,8732467612740805868,11105257135318873519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,8732467612740805868,11105257135318873519,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,8732467612740805868,11105257135318873519,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,8732467612740805868,11105257135318873519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,8732467612740805868,11105257135318873519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1904,8732467612740805868,11105257135318873519,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1904,8732467612740805868,11105257135318873519,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3436 /prefetch:8
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1904,8732467612740805868,11105257135318873519,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3572
- C:\Users\Admin\Downloads\lastloader.exe
  "C:\Users\Admin\Downloads\lastloader.exe"
  2⤵
  - Executes dropped EXE
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  PID:1324
- - C:\Windows\SYSTEM32\attrib.exe
    "attrib.exe" +h +s "C:\Users\Admin\Downloads\lastloader.exe"
    3⤵
    - Views/modifies file attributes
    PID:3084
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\lastloader.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1728
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1236
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1436
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1256
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" os get Caption
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2112
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" computersystem get totalphysicalmemory
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3556
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    PID:728
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4076
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:1372
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\Downloads\lastloader.exe" && pause
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3572
  - - C:\Windows\system32\PING.EXE
      ping localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3192

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4904

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
554d6d27186fa7d6762d95dde7a17584

SHA1
93ea7b20b8fae384cf0be0d65e4295097112fdca

SHA256
2fa6145571e1f1ece9850a1ac94661213d3e0d82f1cef7ac1286ff6b2c2017cb

SHA512
57d9008ccabc315bd0e829b19fe91e24bab6ef20bcfab651b937b0f38eec840b58d0aed092a3bbedd2d6a95d5c150372a1e51087572de55672172adc1fc468a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a28bb0d36049e72d00393056dce10a26

SHA1
c753387b64cc15c0efc80084da393acdb4fc01d0

SHA256
684d797e28b7fd86af84bfb217d190e4f5e03d92092d988a6091b2c7bbbd67c1

SHA512
20940fee33aa2194c36a3db92d4fd314ce7eacc2aa745abec62aa031c2a53ba4ff89f2568626e7bd2536090175f8d045c3bb52c5faa5ecc8da8410ab5fc519f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
d529e0fe57ebed74aec4ef20787126f7

SHA1
9743377a2053029f5ea6619d87971e9385bcdcc4

SHA256
12d243ab37b2f7546f0045797eb0a5c52b7f4e90d3be88b529346541978cba70

SHA512
466443b85ab3c16f03d7fb80cbea97ea0cddeb78f60e6cff3d530a526a6a1e2c236f318d88fc532af1de8f699d0d9a3c5e39bf19044367194b750c46f841a6ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
20KB

MD5
5f055f45d209c8ecb3f9c21ce28dc576

SHA1
b6b5792d26a9e957693571d546a76ad81e79b5f9

SHA256
85d4e2f2d1b68cd98eeac8561a02990ce098b14fcb3d7818662ea79b20c0526b

SHA512
c9635e63c3e0001bd51fbedb69a4a95d6200bf6aa0ff894c2c17edbd39a205e11162713d527d31af47c180203c16133b6b125e27f7187aee8c4f940b7d4914dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
10KB

MD5
749f128902136f80c0ed00343f7d912d

SHA1
0a4d09bb0574f827365321a9b6e5cc961c872a39

SHA256
95ab1d81d9d96d869a019f78c0588de69e99745c38d799fb90b177416205b0d6

SHA512
d80af971550bbb16e326f0138bce9984315d00bcde24f1dc3f18c59d69bea8e3c30e44be6e4a2a69f16c07d142ed01e618722464ac327ec7b160b94a7c207e44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dc080f44873ea04235f94d176a1a239f

SHA1
f1e11f546e9e86ac8e3ba94efdf801d301ac37f3

SHA256
1755dfe29278243b483a43f90c79d1c72f4ba3f3ea2bc60d13e4da9a4813a1bc

SHA512
d115d8dc32c07274651c0086529a90d0993a54f701b882b4ff64222b2b7d3f29b99d713e04c28d80cb33feac0fd4637753656bb64fb1376ba6d87ed32db0a8ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9fc55c735504cb6236092a78729114e4

SHA1
7d25fecb8d26927c9823e217d09339d11f32b67b

SHA256
1801fb761972d5e7ede770e8dbcc7a7343d963f46fa47527899b13df6dd7c818

SHA512
e0c53f27ce56741fc26cfd3551729d5ea779e805cfd694fe1cb88b73b558661175da7977f856d77730d36532ed05a4db8b328213ccd8f0d3b077d3e93a537be3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
81debf1898e0336e134c3a45a9c708f0

SHA1
6343ec6627b0a2a14d2901de70b9e310857a3be1

SHA256
58b265ebeff809003a823557ca899fa9510e440fe24e629c192d1ad3b6fbcd7e

SHA512
15bca0b114bcb4b8c3d2dffd66b7afcba84fb44d3616b08685caa4069e375e2f015f0871a37b2553fbd53caf61be6deaaac3ee36edcc146f647f9b8b0e392111

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7b7648089cc090452b734de0665ff3e7

SHA1
4dbefcdac861a13f3f1070593bb976d17897212f

SHA256
085dda93372f53bacd0d0352633c710f6dddf10b4656702c56d873bf6a09ccf7

SHA512
77c531bc6764cb834a86f3002d7e3c44777d54e9ea246d550a63959af3d8c8b74b51e93e06d911345fe2b91f39c59ff9d7176dde6918722eb61f8a771da5e18c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57dff0.TMP

Filesize
874B

MD5
f8209cb3c2ecd40b0ae59d027bf383f5

SHA1
54056dc3f853251949b68ee92d11c050c7649daa

SHA256
9bcac8d19636a26a723aa3a7ac59a44d1cf4afefaae55c4987ce3df87ac9716d

SHA512
def393abb79935a581003f972a8b6e31b67b2e6ac1e2310c9d56e2646e031263688e6c256a608a8d3eedcd27cd840acd1fefd0fe57fd1af793fe4c4b344c6942

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
de62feb7f9aa5b8a70ba9ed1ee13580a

SHA1
d9bb28d426a14a8a05ec2d0ab47b21e36bb2ef66

SHA256
a0746371ddb3b123aeaeb37468122f2ef91af7ff6842f387fa467cdd2639db8a

SHA512
6e433c43efe12ae4cf3ae6a31c2478d2e19104fc1e213099ced0c5c849a9245f6de07aa7e254e11fa5917c6090562fa92a402ef5cd8aabbf8b65f51888d3376d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f7daeef4e51b1bc955dc02d7af7f7008

SHA1
058011399965daeca23b0f6a0013ce8af5b508b5

SHA256
adf690741a6f4e724256a1c740f99bd49b358699cbd75eef5f3f3aa0ac4fd85e

SHA512
76ba2307cf118f768ebe125f2b515ac85e1e85b92e340173fae0e1eed6b83350b39acadc955b07e070e0f7a0d887ac065d8b3c8e33d1102cd9011326ad70d21a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d0a4a3b9a52b8fe3b019f6cd0ef3dad6

SHA1
fed70ce7834c3b97edbd078eccda1e5effa527cd

SHA256
21942e513f223fdad778348fbb20617dd29f986bccd87824c0ae7f15649f3f31

SHA512
1a66f837b4e7fb6346d0500aeacb44902fb8a239bce23416271263eba46fddae58a17075e188ae43eb516c841e02c87e32ebd73256c7cc2c0713d00c35f1761b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
6490e5c0581c173062323b1c20cfd9ff

SHA1
1652893659f99b780fd9733243637eb7795f5212

SHA256
a552b6d7bebb1714f01a5f3d8b5493e1b369c93ee68c62256dfddcc7f3f4fe79

SHA512
fdb077b40b4371a74cb70ae74d28a4433399e5c4a69fe9a5652409a62c2435d3197da42808d5cb65e9b7ff35bc2e593ad70fa83581c7fd672d631b25f53d3c65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
7332074ae2b01262736b6fbd9e100dac

SHA1
22f992165065107cc9417fa4117240d84414a13c

SHA256
baea84fda6c1f13090b8cbd91c920848946f10ce155ef31a1df4cd453ee7e4aa

SHA512
4ae6f0e012c31ac1fc2ff4a8877ce2b4667c45b6e651de798318a39a2b6fd39a6f72dffa8b0b89b7a045a27d724d195656faa25a9fec79b22f37ddebb5d22da2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
904f85d0680c0607d4ee5b294c8b691f

SHA1
2a0ed43d2ac47bfb3fb3ec1e0557275a39be1b29

SHA256
41f0446501a9891c8a38047d6d072aa63013cceb6bdd1ee1c3c853f9b0797ad6

SHA512
37b6404603ece4041149e9da3c6e15eacdd22c0d28776ecb9205b7f356c223c128de19faebd5e9b864c0d7a9bb54170b3b5329b395356707060e2e60aa343f64

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tvadgtlt.sab.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 183992.crdownload

Filesize
229KB

MD5
9b2b8035bbaf9833d6e847234ee5023e

SHA1
6ec9dad5457a128c8efdf78aba65ea587ed9af0e

SHA256
93ee149a8f5066e8547d306a306dcf25a145ced96466882dec36af362ca05e8c

SHA512
e54fdf9a2f86abf67db4cadefd77f89b08753f8c6a6fc6856975e9dcad9f0fa58e33c6bb763536ff5c663befc3ac6b241bfd3ce48c33ebd659b96a9c470fbde5

Download Submit
C:\Users\Admin\Downloads\lastloader.exe:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
memory/1324-251-0x0000020EF5240000-0x0000020EF5290000-memory.dmp

Filesize
320KB

Download
memory/1324-250-0x0000020EF5590000-0x0000020EF5606000-memory.dmp

Filesize
472KB

Download
memory/1324-254-0x0000020EF3200000-0x0000020EF321E000-memory.dmp

Filesize
120KB

Download
memory/1324-224-0x0000020EF2CC0000-0x0000020EF2D00000-memory.dmp

Filesize
256KB

Download
memory/1324-291-0x0000020EF4B10000-0x0000020EF4B1A000-memory.dmp

Filesize
40KB

Download
memory/1324-292-0x0000020EF5290000-0x0000020EF52A2000-memory.dmp

Filesize
72KB

Download
memory/1728-225-0x000001F1E7B80000-0x000001F1E7BA2000-memory.dmp

Filesize
136KB

Download