Analysis
- user interaction
yes - max time kernel
900s - max time network
902s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
05/07/2026, 15:25
General
- Target Lumen.exe
- Size 14.5MB
- Sample260705-stx5kads2x
- SHA256 706e800661c2be0d87cab256a3d2bb49491b6eecf471ede8d4137d2e4daf9675
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
- Drops file in Windows directory 35 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 6 IoCs
- Modifies Internet Explorer settings 1 TTPs 4 IoCs
- Modifies data under HKEY_USERS 3 IoCs
- Modifies registry class 53 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 44 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Lumen.exe"C:\Users\Admin\AppData\Local\Temp\Lumen.exe"1⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\system32\SystemSettingsAdminFlows.exe"C:\Windows\system32\SystemSettingsAdminFlows.exe" StorageAdminHelper1⤵
-
C:\Windows\system32\SystemSettingsAdminFlows.exe"C:\Windows\system32\SystemSettingsAdminFlows.exe" TurnOnDeveloperFeatures DeveloperUnlock1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\SplitRestart.mht3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2cc,0x2f4,0x2f8,0x2c8,0x304,0x7ffebda6c188,0x7ffebda6c194,0x7ffebda6c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2016,i,15059584872605174837,15388696389942765273,524288 --field-trial-handle=2236,i,12666620475685078788,18402521731563206541,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1896,i,15141570876564670801,199415664438838036,262144 --field-trial-handle=2236,i,12666620475685078788,18402521731563206541,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,9916238781369018966,15910145763941887271,524288 --field-trial-handle=2236,i,12666620475685078788,18402521731563206541,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,4031028489479090910,11510647725480700815,2097152 --field-trial-handle=2236,i,12666620475685078788,18402521731563206541,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,6555281800557757049,10909010800780823461,2097152 --field-trial-handle=2236,i,12666620475685078788,18402521731563206541,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,11645525410419076918,7987724324335788646,2097152 --field-trial-handle=2236,i,12666620475685078788,18402521731563206541,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,16216084062417173712,17085348168012575011,2097152 --field-trial-handle=2236,i,12666620475685078788,18402521731563206541,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5168,i,2169882106787959517,12974050195204865772,2097152 --field-trial-handle=2236,i,12666620475685078788,18402521731563206541,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,3462968319266661941,17319202722708112141,524288 --field-trial-handle=2236,i,12666620475685078788,18402521731563206541,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,5688236990170125959,2224300759196529367,524288 --field-trial-handle=2236,i,12666620475685078788,18402521731563206541,262144 --variations-seed-version --mojo-platform-channel-handle=4056 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,17271244338217304472,3100948655005593548,524288 --field-trial-handle=2236,i,12666620475685078788,18402521731563206541,262144 --variations-seed-version --mojo-platform-channel-handle=3996 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,9370578395432870085,17661534254328834073,524288 --field-trial-handle=2236,i,12666620475685078788,18402521731563206541,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,9370578395432870085,17661534254328834073,524288 --field-trial-handle=2236,i,12666620475685078788,18402521731563206541,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,16506067475856755120,6526156028634713355,524288 --field-trial-handle=2236,i,12666620475685078788,18402521731563206541,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,15453386593330010040,2334793518930491287,524288 --field-trial-handle=2236,i,12666620475685078788,18402521731563206541,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,7646696995795156230,17514447363260755745,524288 --field-trial-handle=2236,i,12666620475685078788,18402521731563206541,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4692,i,7054998658424557223,17156802299639242554,524288 --field-trial-handle=2236,i,12666620475685078788,18402521731563206541,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4704,i,14003939160970744517,17319613373692748967,524288 --field-trial-handle=2236,i,12666620475685078788,18402521731563206541,262144 --variations-seed-version --mojo-platform-channel-handle=1288 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4196,i,3215036706476533221,4629173505344696873,524288 --field-trial-handle=2236,i,12666620475685078788,18402521731563206541,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=1280,i,848148711847007439,3781646317446403695,2097152 --field-trial-handle=2236,i,12666620475685078788,18402521731563206541,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=3980,i,14957587173389371065,11312423951289281430,2097152 --field-trial-handle=2236,i,12666620475685078788,18402521731563206541,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,716733823703450837,2685058419464861582,524288 --field-trial-handle=2236,i,12666620475685078788,18402521731563206541,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6860,i,1020328880629566112,15069170126926458598,2097152 --field-trial-handle=2236,i,12666620475685078788,18402521731563206541,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1456,i,12237284717358378917,1024387357513994694,524288 --field-trial-handle=2236,i,12666620475685078788,18402521731563206541,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7204,i,5291797979320801511,5478376503135523759,2097152 --field-trial-handle=2236,i,12666620475685078788,18402521731563206541,262144 --variations-seed-version --mojo-platform-channel-handle=7232 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7428,i,1354007234472268266,11917986937693426005,2097152 --field-trial-handle=2236,i,12666620475685078788,18402521731563206541,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=4216,i,16739160581952369695,7765720368367388839,2097152 --field-trial-handle=2236,i,12666620475685078788,18402521731563206541,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7284,i,14956989956435843946,13827121223140907876,2097152 --field-trial-handle=2236,i,12666620475685078788,18402521731563206541,262144 --variations-seed-version --mojo-platform-channel-handle=7196 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4328,i,9959681901515334183,8815474484405001990,262144 --field-trial-handle=2236,i,12666620475685078788,18402521731563206541,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window4⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2a0,0x7ffebda6c188,0x7ffebda6c194,0x7ffebda6c1a05⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,5270221221498975717,1239394697757818858,262144 --field-trial-handle=2232,i,6779882751155956840,10250029984144745714,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,806384551715933409,5129528387965498044,524288 --field-trial-handle=2232,i,6779882751155956840,10250029984144745714,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,7960564706642837714,16636068411823014456,524288 --field-trial-handle=2232,i,6779882751155956840,10250029984144745714,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:135⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,10472108315944069229,523105156167539829,524288 --field-trial-handle=2232,i,6779882751155956840,10250029984144745714,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,10472108315944069229,523105156167539829,524288 --field-trial-handle=2232,i,6779882751155956840,10250029984144745714,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4472,i,9922067124619076625,8683970444503882480,524288 --field-trial-handle=2232,i,6779882751155956840,10250029984144745714,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,13714643235656199733,8838511857651434631,524288 --field-trial-handle=2232,i,6779882751155956840,10250029984144745714,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,7684550350869530094,5437432040725980680,524288 --field-trial-handle=2232,i,6779882751155956840,10250029984144745714,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,18311070241004362146,7057299093730828797,524288 --field-trial-handle=2232,i,6779882751155956840,10250029984144745714,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,15224364594610812675,6310803499299438523,524288 --field-trial-handle=2232,i,6779882751155956840,10250029984144745714,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,6290422149225795560,2906595457620240925,524288 --field-trial-handle=2232,i,6779882751155956840,10250029984144745714,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4820,i,12081620196245471217,1016961459824992898,524288 --field-trial-handle=2232,i,6779882751155956840,10250029984144745714,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4996,i,8960063925848191046,12700487173213388151,262144 --field-trial-handle=2232,i,6779882751155956840,10250029984144745714,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:105⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=824,i,9827054323634133977,10495113564563690688,524288 --field-trial-handle=2232,i,6779882751155956840,10250029984144745714,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4708,i,7395131851052792802,8192491541533522735,524288 --field-trial-handle=2232,i,6779882751155956840,10250029984144745714,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4708,i,6177432720076547628,5268239453351766227,524288 --field-trial-handle=2232,i,6779882751155956840,10250029984144745714,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4160,i,17580104111968529140,8666301366684837824,524288 --field-trial-handle=2232,i,6779882751155956840,10250029984144745714,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,6312021583394041807,13539699663837411026,524288 --field-trial-handle=2232,i,6779882751155956840,10250029984144745714,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,7507880863443004029,2506464104852271108,524288 --field-trial-handle=2232,i,6779882751155956840,10250029984144745714,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,4269668232497458089,1603277834875168840,524288 --field-trial-handle=2232,i,6779882751155956840,10250029984144745714,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,14762389484750556024,17168413288991691601,524288 --field-trial-handle=2232,i,6779882751155956840,10250029984144745714,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:145⤵
-
-
-
-
-
C:\Windows\system32\sudo.exe"C:\Windows\system32\sudo.exe" config --enable forceNewWindow2⤵
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\oobe\UserOOBEBroker.exeC:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding1⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
settings.dat
settings.dat
settings.dat
settings.dat
3ada47f4-ed63-4472-8c81-8f7feb71e3f5.tmp
5627688b-4afa-418c-8098-f47113509dff.tmp
BookmarkMergedSurfaceOrdering
f_000070
the-real-index
the-real-index
the-real-index~RFe611193.TMP
data_1
SiteList-Enterprise.json
Edge Profile.ico
000003.log
LOG
computed_hashes.json
verified_contents.json
content.js
Favicons
History
000003.log
LOG
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
Secure Preferences
LOG
000003.log
LOG
000003.log
LOG
sync_diagnostic.log
Web Data
000003.log
LOG
000003.log
LOG
ace6175c-ab08-4f0d-90f2-f486c88e2604.tmp
data_1
data_1
Last Version
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe6187ec.TMP
data_1
Variations
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
05c59012-9608-44ef-8a33-cf41f1fa2419.tmp
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
content_new.js
5f7b5f1e01b83767.automaticDestinations-ms
f01b4d95cf55d32a.automaticDestinations-ms
LICENSE
memory/1436-39-0x0000022202CC0000-0x0000022202CE0000-memory.dmp
memory/1436-1137-0x000002221E110000-0x000002221E210000-memory.dmp
memory/1436-7-0x0000022200100000-0x0000022200200000-memory.dmp
memory/1436-268-0x0000022219D30000-0x0000022219E30000-memory.dmp
memory/1436-8-0x0000022200100000-0x0000022200200000-memory.dmp
memory/1436-1136-0x000002221D210000-0x000002221D310000-memory.dmp
memory/1436-9-0x0000022200100000-0x0000022200200000-memory.dmp
memory/1436-825-0x000002221D530000-0x000002221D630000-memory.dmp
memory/1436-53-0x00000222140C0000-0x00000222140E0000-memory.dmp
memory/1436-23-0x0000022202D40000-0x0000022202E40000-memory.dmp
memory/1436-21-0x00000222027E0000-0x0000022202800000-memory.dmp
memory/5576-3009-0x0000019CA78A0000-0x0000019CA79FF000-memory.dmp
memory/5576-595-0x0000019CA78A0000-0x0000019CA79FF000-memory.dmp
memory/5576-5-0x0000019CA78A0000-0x0000019CA79FF000-memory.dmp
memory/5576-1594-0x0000019CA78A0000-0x0000019CA79FF000-memory.dmp
memory/5712-4-0x000001D5440A0000-0x000001D5440A2000-memory.dmp