63ed1fcbed2cec2a6e19ebacb062dff139b813195a3b28932d19c40b0758112f

Analysis

user interaction
yes
max time kernel
110s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 07:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LuminApp Setup 0.1.9.exe
Size 136.6MB
Sample260711-jbee3ady3p
SHA256 63ed1fcbed2cec2a6e19ebacb062dff139b813195a3b28932d19c40b0758112f
MD5 4956b50c3788b7f0b09857a562e8a55d
SHA1 e305aab0896327301163ed2d026442cbbf1eeab1
SHA512 9bb648b9bed199da77e13d34d3b00fc9a1563db74566784ea0c4a76db9b11cff8e9ecc18a7732ff464506ddcccc0356397514ffa2276abd47fa23217e6fd6b87
SSDEEP 3145728:2ZU4a71jvcbEWhFRyVhEhYLR7v1FUMFke79wbxBqMYqzz4:Ga7tBWzRrYNoemxe
TLSH
T1106833D603507661E4AC8A7E16410FEC56AC35E78FA10F2CDA2403D57BAB43B7F98786
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Executes dropped EXE 7 IoCs

pid	Process
5432	LuminApp.exe
1196	LuminApp.exe
1952	LuminApp.exe
972	LuminApp.exe
1784	LuminApp.exe
2336	LuminApp.exe
1552	LuminApp.exe

Loads dropped DLL 24 IoCs

pid	Process
1844	LuminApp Setup 0.1.9.exe
1844	LuminApp Setup 0.1.9.exe
1844	LuminApp Setup 0.1.9.exe
1844	LuminApp Setup 0.1.9.exe
1844	LuminApp Setup 0.1.9.exe
1844	LuminApp Setup 0.1.9.exe
1844	LuminApp Setup 0.1.9.exe
1844	LuminApp Setup 0.1.9.exe
1844	LuminApp Setup 0.1.9.exe
5432	LuminApp.exe
5432	LuminApp.exe
5432	LuminApp.exe
5432	LuminApp.exe
5432	LuminApp.exe
5432	LuminApp.exe
5432	LuminApp.exe
5432	LuminApp.exe
1196	LuminApp.exe
972	LuminApp.exe
1784	LuminApp.exe
5432	LuminApp.exe
5432	LuminApp.exe
2336	LuminApp.exe
1552	LuminApp.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Command and Scripting Interpreter: PowerShell 1 TTPs 20 IoCs

Run Powershell to get system information.

execution

PowerShell

T1059.001

pid	Process
4412	powershell.exe
2904	powershell.exe
4500	powershell.exe
2960	powershell.exe
1096	powershell.exe
2988	powershell.exe
1540	powershell.exe
1248	powershell.exe
3268	powershell.exe
2884	powershell.exe
1228	powershell.exe
5232	powershell.exe
5160	powershell.exe
3020	powershell.exe
700	powershell.exe
4372	powershell.exe
3420	powershell.exe
4768	powershell.exe
1072	powershell.exe
428	powershell.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 4 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
4500	powershell.exe
4216	powershell.exe
3440	powershell.exe
2904	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LuminApp Setup 0.1.9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 30 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2952	ping.exe
2480	ping.exe
4160	ping.exe
2556	ping.exe
264	ping.exe
3524	ping.exe
3792	ping.exe
3228	ping.exe
3432	ping.exe
4768	ping.exe
464	ping.exe
3044	ping.exe
4152	ping.exe
3268	ping.exe
3524	ping.exe
424	ping.exe
4544	ping.exe
3852	ping.exe
1056	ping.exe
700	ping.exe
2004	ping.exe
916	ping.exe
2568	ping.exe
4212	ping.exe
5736	ping.exe
1088	ping.exe
6096	ping.exe
4836	ping.exe
4688	ping.exe
1756	ping.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	LuminApp.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	LuminApp.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	LuminApp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	LuminApp.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	LuminApp.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	LuminApp.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	LuminApp.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	LuminApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	LuminApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	LuminApp.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	LuminApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	LuminApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	LuminApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	LuminApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	LuminApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	LuminApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	LuminApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	LuminApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	LuminApp.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	LuminApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	LuminApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	LuminApp.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	LuminApp.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	LuminApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	LuminApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	LuminApp.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	LuminApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	LuminApp.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	LuminApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	LuminApp.exe

Detects videocard installed 1 TTPs 3 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
6132	WMIC.exe
5256	WMIC.exe
4328	WMIC.exe

Gathers network information 2 TTPs 8 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1296	NETSTAT.EXE
4896	ipconfig.exe
2296	NETSTAT.EXE
1088	ipconfig.exe
5232	NETSTAT.EXE
3764	ipconfig.exe
4080	NETSTAT.EXE
1580	ipconfig.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3408	taskkill.exe

Modifies registry class 7 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\lumin\URL Protocol	LuminApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\lumin\ = "URL:lumin"	LuminApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\lumin\shell\open\command	LuminApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\lumin\shell	LuminApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\lumin\shell\open	LuminApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\lumin\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\luminapp\\LuminApp.exe\" \"%1\""	LuminApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\lumin	LuminApp.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
4148	reg.exe
4800	reg.exe
1676	reg.exe
1188	reg.exe

Runs net.exe

Runs ping.exe 1 TTPs 30 IoCs

Remote System Discovery

T1018

pid	Process
2952	ping.exe
3524	ping.exe
916	ping.exe
3268	ping.exe
5736	ping.exe
1088	ping.exe
4768	ping.exe
4212	ping.exe
6096	ping.exe
4544	ping.exe
1756	ping.exe
4160	ping.exe
2004	ping.exe
4688	ping.exe
700	ping.exe
1056	ping.exe
3044	ping.exe
2480	ping.exe
4152	ping.exe
3432	ping.exe
2556	ping.exe
2568	ping.exe
424	ping.exe
264	ping.exe
3852	ping.exe
464	ping.exe
3792	ping.exe
3228	ping.exe
3524	ping.exe
4836	ping.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
4216	powershell.exe
4216	powershell.exe
1248	powershell.exe
1248	powershell.exe
1844	LuminApp Setup 0.1.9.exe
1844	LuminApp Setup 0.1.9.exe
4412	powershell.exe
4412	powershell.exe
3440	powershell.exe
3440	powershell.exe
3440	powershell.exe
3420	powershell.exe
3420	powershell.exe
3420	powershell.exe
6132	WMIC.exe
6132	WMIC.exe
6132	WMIC.exe
6132	WMIC.exe
4768	powershell.exe
4768	powershell.exe
4768	powershell.exe
5232	powershell.exe
5232	powershell.exe
5232	powershell.exe
5256	WMIC.exe
5256	WMIC.exe
5256	WMIC.exe
5256	WMIC.exe
3268	powershell.exe
3268	powershell.exe
2960	powershell.exe
2960	powershell.exe
1072	powershell.exe
1072	powershell.exe
5160	powershell.exe
5160	powershell.exe
3268	powershell.exe
2960	powershell.exe
5160	powershell.exe
1072	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4216	powershell.exe
Token: SeDebugPrivilege	1248	powershell.exe
Token: SeDebugPrivilege	4412	powershell.exe
Token: SeIncreaseQuotaPrivilege	4412	powershell.exe
Token: SeSecurityPrivilege	4412	powershell.exe
Token: SeTakeOwnershipPrivilege	4412	powershell.exe
Token: SeLoadDriverPrivilege	4412	powershell.exe
Token: SeSystemProfilePrivilege	4412	powershell.exe
Token: SeSystemtimePrivilege	4412	powershell.exe
Token: SeProfSingleProcessPrivilege	4412	powershell.exe
Token: SeIncBasePriorityPrivilege	4412	powershell.exe
Token: SeCreatePagefilePrivilege	4412	powershell.exe
Token: SeBackupPrivilege	4412	powershell.exe
Token: SeRestorePrivilege	4412	powershell.exe
Token: SeShutdownPrivilege	4412	powershell.exe
Token: SeDebugPrivilege	4412	powershell.exe
Token: SeSystemEnvironmentPrivilege	4412	powershell.exe
Token: SeRemoteShutdownPrivilege	4412	powershell.exe
Token: SeUndockPrivilege	4412	powershell.exe
Token: SeManageVolumePrivilege	4412	powershell.exe
Token: 33	4412	powershell.exe
Token: 34	4412	powershell.exe
Token: 35	4412	powershell.exe
Token: 36	4412	powershell.exe
Token: SeSecurityPrivilege	1844	LuminApp Setup 0.1.9.exe
Token: SeDebugPrivilege	3440	powershell.exe
Token: SeDebugPrivilege	3420	powershell.exe
Token: SeShutdownPrivilege	5432	LuminApp.exe
Token: SeCreatePagefilePrivilege	5432	LuminApp.exe
Token: SeShutdownPrivilege	5432	LuminApp.exe
Token: SeCreatePagefilePrivilege	5432	LuminApp.exe
Token: SeShutdownPrivilege	5432	LuminApp.exe
Token: SeCreatePagefilePrivilege	5432	LuminApp.exe
Token: SeIncreaseQuotaPrivilege	6132	WMIC.exe
Token: SeSecurityPrivilege	6132	WMIC.exe
Token: SeTakeOwnershipPrivilege	6132	WMIC.exe
Token: SeLoadDriverPrivilege	6132	WMIC.exe
Token: SeSystemProfilePrivilege	6132	WMIC.exe
Token: SeSystemtimePrivilege	6132	WMIC.exe
Token: SeProfSingleProcessPrivilege	6132	WMIC.exe
Token: SeIncBasePriorityPrivilege	6132	WMIC.exe
Token: SeCreatePagefilePrivilege	6132	WMIC.exe
Token: SeBackupPrivilege	6132	WMIC.exe
Token: SeRestorePrivilege	6132	WMIC.exe
Token: SeShutdownPrivilege	6132	WMIC.exe
Token: SeDebugPrivilege	6132	WMIC.exe
Token: SeSystemEnvironmentPrivilege	6132	WMIC.exe
Token: SeRemoteShutdownPrivilege	6132	WMIC.exe
Token: SeUndockPrivilege	6132	WMIC.exe
Token: SeManageVolumePrivilege	6132	WMIC.exe
Token: 33	6132	WMIC.exe
Token: 34	6132	WMIC.exe
Token: 35	6132	WMIC.exe
Token: 36	6132	WMIC.exe
Token: SeIncreaseQuotaPrivilege	6132	WMIC.exe
Token: SeSecurityPrivilege	6132	WMIC.exe
Token: SeTakeOwnershipPrivilege	6132	WMIC.exe
Token: SeLoadDriverPrivilege	6132	WMIC.exe
Token: SeSystemProfilePrivilege	6132	WMIC.exe
Token: SeSystemtimePrivilege	6132	WMIC.exe
Token: SeProfSingleProcessPrivilege	6132	WMIC.exe
Token: SeIncBasePriorityPrivilege	6132	WMIC.exe
Token: SeCreatePagefilePrivilege	6132	WMIC.exe
Token: SeBackupPrivilege	6132	WMIC.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
5432	LuminApp.exe
5432	LuminApp.exe
5432	LuminApp.exe
5432	LuminApp.exe
5432	LuminApp.exe
5432	LuminApp.exe
5432	LuminApp.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5432	LuminApp.exe
5432	LuminApp.exe
5432	LuminApp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 4216	1844	LuminApp Setup 0.1.9.exe	87
PID 1844 wrote to memory of 1248	1844	LuminApp Setup 0.1.9.exe	89
PID 1844 wrote to memory of 4412	1844	LuminApp Setup 0.1.9.exe	91
PID 5432 wrote to memory of 5124	5432	LuminApp.exe	96
PID 5124 wrote to memory of 4828	5124	cmd.exe	98
PID 5432 wrote to memory of 124	5432	LuminApp.exe	99
PID 124 wrote to memory of 3440	124	cmd.exe	101
PID 5432 wrote to memory of 4792	5432	LuminApp.exe	102
PID 4792 wrote to memory of 3276	4792	cmd.exe	104
PID 3276 wrote to memory of 1476	3276	net.exe	105
PID 5432 wrote to memory of 4980	5432	LuminApp.exe	106
PID 4980 wrote to memory of 700	4980	cmd.exe	108
PID 5432 wrote to memory of 3420	5432	LuminApp.exe	109
PID 5432 wrote to memory of 1196	5432	LuminApp.exe	110
PID 5432 wrote to memory of 1952	5432	LuminApp.exe	112
PID 5432 wrote to memory of 972	5432	LuminApp.exe	113
PID 5432 wrote to memory of 4148	5432	LuminApp.exe	114
PID 5432 wrote to memory of 1784	5432	LuminApp.exe	116
PID 5432 wrote to memory of 3984	5432	LuminApp.exe	117
PID 3984 wrote to memory of 6132	3984	cmd.exe	119
PID 5432 wrote to memory of 2516	5432	LuminApp.exe	120
PID 2516 wrote to memory of 2428	2516	cmd.exe	122
PID 5432 wrote to memory of 3044	5432	LuminApp.exe	125
PID 5432 wrote to memory of 2952	5432	LuminApp.exe	127
PID 5432 wrote to memory of 2480	5432	LuminApp.exe	129
PID 5432 wrote to memory of 5736	5432	LuminApp.exe	131
PID 5432 wrote to memory of 4152	5432	LuminApp.exe	133
PID 5432 wrote to memory of 6008	5432	LuminApp.exe	135
PID 5432 wrote to memory of 3524	5432	LuminApp.exe	137
PID 5432 wrote to memory of 4736	5432	LuminApp.exe	139
PID 5432 wrote to memory of 3764	5432	LuminApp.exe	141
PID 5432 wrote to memory of 1780	5432	LuminApp.exe	143
PID 5432 wrote to memory of 5620	5432	LuminApp.exe	145
PID 5432 wrote to memory of 1088	5432	LuminApp.exe	146
PID 5432 wrote to memory of 3080	5432	LuminApp.exe	149
PID 5432 wrote to memory of 3792	5432	LuminApp.exe	150
PID 5432 wrote to memory of 5236	5432	LuminApp.exe	153
PID 5432 wrote to memory of 2764	5432	LuminApp.exe	155
PID 5432 wrote to memory of 4108	5432	LuminApp.exe	157
PID 5432 wrote to memory of 5796	5432	LuminApp.exe	159
PID 5432 wrote to memory of 3228	5432	LuminApp.exe	160
PID 5432 wrote to memory of 2160	5432	LuminApp.exe	163
PID 5432 wrote to memory of 716	5432	LuminApp.exe	165
PID 5432 wrote to memory of 1404	5432	LuminApp.exe	167
PID 5432 wrote to memory of 3432	5432	LuminApp.exe	169
PID 5432 wrote to memory of 3828	5432	LuminApp.exe	171
PID 5432 wrote to memory of 3360	5432	LuminApp.exe	173
PID 5432 wrote to memory of 3972	5432	LuminApp.exe	175
PID 5432 wrote to memory of 5092	5432	LuminApp.exe	177
PID 5432 wrote to memory of 916	5432	LuminApp.exe	179
PID 5432 wrote to memory of 4272	5432	LuminApp.exe	181
PID 5432 wrote to memory of 5496	5432	LuminApp.exe	183
PID 5432 wrote to memory of 2412	5432	LuminApp.exe	185
PID 5432 wrote to memory of 4208	5432	LuminApp.exe	187
PID 5432 wrote to memory of 4768	5432	LuminApp.exe	189
PID 5432 wrote to memory of 1876	5432	LuminApp.exe	191
PID 5432 wrote to memory of 1600	5432	LuminApp.exe	193
PID 5432 wrote to memory of 2728	5432	LuminApp.exe	195
PID 5432 wrote to memory of 3436	5432	LuminApp.exe	282
PID 5432 wrote to memory of 4544	5432	LuminApp.exe	199
PID 5432 wrote to memory of 4936	5432	LuminApp.exe	201
PID 5432 wrote to memory of 5580	5432	LuminApp.exe	203
PID 5432 wrote to memory of 2064	5432	LuminApp.exe	205
PID 5432 wrote to memory of 2568	5432	LuminApp.exe	207

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\LuminApp Setup 0.1.9.exe
"C:\Users\Admin\AppData\Local\Temp\LuminApp Setup 0.1.9.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4216
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1248
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\luminapp', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4412

C:\Users\Admin\AppData\Local\Programs\luminapp\LuminApp.exe
"C:\Users\Admin\AppData\Local\Programs\luminapp\LuminApp.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5124
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:4828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-PSDrive -Name 'C' -ErrorAction SilentlyContinue).DisplayRoot""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:124
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-PSDrive -Name 'C' -ErrorAction SilentlyContinue).DisplayRoot"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4792
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3276
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:1476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "chcp"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "Get-WmiObject Win32_VideoController | ForEach-Object { $_.Name }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3420
- C:\Users\Admin\AppData\Local\Programs\luminapp\LuminApp.exe
  C:\Users\Admin\AppData\Local\Programs\luminapp\LuminApp.exe --type=cs --cs-app=LuminApp --uid=iideainhokonikhkplkkigbmjcfepfgfiaahlfkd --phase=4 --muid=5aa84da6-805f-d96a-20be-16310f6c6368 --muidv2=d720ace8-ffe3-4bcd-a152-ad8587c92e0f --version=39.8.10-beta.9 --first-run
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1196
- C:\Users\Admin\AppData\Local\Programs\luminapp\LuminApp.exe
  "C:\Users\Admin\AppData\Local\Programs\luminapp\LuminApp.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --use-angle=swiftshader-webgl --use-gl=angle --user-data-dir="C:\Users\Admin\AppData\Roaming\LuminApp" --standard-schemes=owepm --secure-schemes=owepm --bypasscsp-schemes=owepm --fetch-schemes=owepm --streaming-schemes=owepm --field-trial-handle=2288,i,12770638162639261097,2347960225828001506,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2284 /prefetch:11
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Users\Admin\AppData\Local\Programs\luminapp\LuminApp.exe
  "C:\Users\Admin\AppData\Local\Programs\luminapp\LuminApp.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\LuminApp" --standard-schemes=owepm --secure-schemes=owepm --bypasscsp-schemes=owepm --fetch-schemes=owepm --streaming-schemes=owepm --app-user-model-id=com.lumin.app --app-path="C:\Users\Admin\AppData\Local\Programs\luminapp\resources\app.asar" --enable-sandbox --no-sandbox --disable-accelerated-video-decode --disable-accelerated-video-encode --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2288,i,12770638162639261097,2347960225828001506,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:972
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\DirectX\UserGpuPreferences /v C:\Users\Admin\AppData\Local\Programs\luminapp\LuminApp.exe /t REG_SZ /d GpuPreference=2; /f
  2⤵
  - Modifies registry key
  PID:4148
- C:\Users\Admin\AppData\Local\Programs\luminapp\LuminApp.exe
  "C:\Users\Admin\AppData\Local\Programs\luminapp\LuminApp.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\LuminApp" --standard-schemes=owepm --secure-schemes=owepm --bypasscsp-schemes=owepm --fetch-schemes=owepm --streaming-schemes=owepm --app-user-model-id=com.lumin.app --app-path="C:\Users\Admin\AppData\Local\Programs\luminapp\resources\app.asar" --enable-sandbox --no-sandbox --disable-accelerated-video-decode --disable-accelerated-video-encode --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2288,i,12770638162639261097,2347960225828001506,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get Name,DriverVersion,AdapterRAM,PNPDeviceID /format:list 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3984
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get Name,DriverVersion,AdapterRAM,PNPDeviceID /format:list
    3⤵
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "where nvidia-smi 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Windows\system32\where.exe
    where nvidia-smi
    3⤵
    PID:2428
- C:\Windows\System32\ping.exe
  C:\Windows\System32\ping.exe -n 1 -w 1500 dynamodb.us-east-1.amazonaws.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3044
- C:\Windows\System32\ping.exe
  C:\Windows\System32\ping.exe -n 1 -w 1500 dynamodb.us-east-1.amazonaws.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2952
- C:\Windows\System32\ping.exe
  C:\Windows\System32\ping.exe -n 1 -w 1500 dynamodb.us-east-1.amazonaws.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2480
- C:\Windows\System32\ping.exe
  C:\Windows\System32\ping.exe -n 1 -w 1500 dynamodb.us-east-2.amazonaws.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5736
- C:\Windows\System32\ping.exe
  C:\Windows\System32\ping.exe -n 1 -w 1500 dynamodb.us-east-2.amazonaws.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4152
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\BraveSoftwareUpdateTaskMachineCore" /fo LIST /v
  2⤵
  PID:6008
- C:\Windows\System32\ping.exe
  C:\Windows\System32\ping.exe -n 1 -w 1500 dynamodb.us-east-2.amazonaws.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3524
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\BraveSoftwareUpdateTaskMachineUA" /fo LIST /v
  2⤵
  PID:4736
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\MicrosoftEdgeUpdateTaskMachineCore" /fo LIST /v
  2⤵
  PID:3764
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\MicrosoftEdgeUpdateTaskMachineUA" /fo LIST /v
  2⤵
  PID:1780
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\VisualStudio\Updates\BackgroundDownload" /fo LIST /v
  2⤵
  PID:5620
- C:\Windows\System32\ping.exe
  C:\Windows\System32\ping.exe -n 1 -w 1500 dynamodb.us-west-1.amazonaws.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1088
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" /fo LIST /v
  2⤵
  PID:3080
- C:\Windows\System32\ping.exe
  C:\Windows\System32\ping.exe -n 1 -w 1500 dynamodb.us-west-1.amazonaws.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3792
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\Application Experience\PcaPatchDbTask" /fo LIST /v
  2⤵
  PID:5236
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\Application Experience\PcaWallpaperAppDetect" /fo LIST /v
  2⤵
  PID:2764
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\Application Experience\ProgramDataUpdater" /fo LIST /v
  2⤵
  PID:4108
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\ApplicationData\appuriverifierdaily" /fo LIST /v
  2⤵
  PID:5796
- C:\Windows\System32\ping.exe
  C:\Windows\System32\ping.exe -n 1 -w 1500 dynamodb.us-west-1.amazonaws.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3228
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator" /fo LIST /v
  2⤵
  PID:2160
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\Customer Experience Improvement Program\UsbCeip" /fo LIST /v
  2⤵
  PID:716
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\Diagnosis\RecommendedTroubleshootingScanner" /fo LIST /v
  2⤵
  PID:1404
- C:\Windows\System32\ping.exe
  C:\Windows\System32\ping.exe -n 1 -w 1500 dynamodb.us-west-2.amazonaws.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3432
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\Diagnosis\Scheduled" /fo LIST /v
  2⤵
  PID:3828
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector" /fo LIST /v
  2⤵
  PID:3360
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver" /fo LIST /v
  2⤵
  PID:3972
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\DiskFootprint\Diagnostics" /fo LIST /v
  2⤵
  PID:5092
- C:\Windows\System32\ping.exe
  C:\Windows\System32\ping.exe -n 1 -w 1500 dynamodb.us-west-2.amazonaws.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:916
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\Feedback\Siuf\DmClient" /fo LIST /v
  2⤵
  PID:4272
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\Feedback\Siuf\DmClientOnScenarioDownload" /fo LIST /v
  2⤵
  PID:5496
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\MemoryDiagnostic\ProcessMemoryDiagnosticEvents" /fo LIST /v
  2⤵
  PID:2412
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\MemoryDiagnostic\RunFullMemoryDiagnostic" /fo LIST /v
  2⤵
  PID:4208
- C:\Windows\System32\ping.exe
  C:\Windows\System32\ping.exe -n 1 -w 1500 dynamodb.us-west-2.amazonaws.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4768
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\NetTrace\GatherNetworkInfo" /fo LIST /v
  2⤵
  PID:1876
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem" /fo LIST /v
  2⤵
  PID:1600
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\Windows Error Reporting\QueueReporting" /fo LIST /v
  2⤵
  PID:2728
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\AppListBackup\Backup" /fo LIST /v
  2⤵
  PID:3436
- C:\Windows\System32\ping.exe
  C:\Windows\System32\ping.exe -n 1 -w 1500 dynamodb.ca-central-1.amazonaws.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4544
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\AppListBackup\BackupNonMaintenance" /fo LIST /v
  2⤵
  PID:4936
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\CloudExperienceHost\CreateObjectTask" /fo LIST /v
  2⤵
  PID:5580
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\CloudRestore\Backup" /fo LIST /v
  2⤵
  PID:2064
- C:\Windows\System32\ping.exe
  C:\Windows\System32\ping.exe -n 1 -w 1500 dynamodb.ca-central-1.amazonaws.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2568
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\Input\InputSettingsRestoreDataAvailable" /fo LIST /v
  2⤵
  PID:5116
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\Input\LocalUserSyncDataAvailable" /fo LIST /v
  2⤵
  PID:2480
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\Input\MouseSyncDataAvailable" /fo LIST /v
  2⤵
  PID:2504
- C:\Windows\System32\ping.exe
  C:\Windows\System32\ping.exe -n 1 -w 1500 dynamodb.ca-central-1.amazonaws.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4212
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\Input\PenSyncDataAvailable" /fo LIST /v
  2⤵
  PID:6092
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\Input\syncpensettings" /fo LIST /v
  2⤵
  PID:1156
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\Input\TouchpadSyncDataAvailable" /fo LIST /v
  2⤵
  PID:2272
- C:\Windows\System32\ping.exe
  C:\Windows\System32\ping.exe -n 1 -w 1500 dynamodb.eu-central-1.amazonaws.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3852
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\Maps\MapsToastTask" /fo LIST /v
  2⤵
  PID:3416
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\Maps\MapsUpdateTask" /fo LIST /v
  2⤵
  PID:3524
- C:\Windows\System32\ping.exe
  C:\Windows\System32\ping.exe -n 1 -w 1500 dynamodb.eu-central-1.amazonaws.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:464
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\XblGameSave\XblGameSaveTask" /fo LIST /v
  2⤵
  PID:5620
- C:\Windows\System32\ping.exe
  C:\Windows\System32\ping.exe -n 1 -w 1500 dynamodb.eu-central-1.amazonaws.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:424
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\XblGameSave\XblGameSaveTaskLogon" /fo LIST /v
  2⤵
  PID:3080
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\GameBar\PresenceUserTick" /fo LIST /v
  2⤵
  PID:4572
- C:\Windows\System32\ping.exe
  C:\Windows\System32\ping.exe -n 1 -w 1500 dynamodb.eu-west-1.amazonaws.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4688
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319" /fo LIST /v
  2⤵
  PID:1360
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 64" /fo LIST /v
  2⤵
  PID:5684
- C:\Windows\System32\ping.exe
  C:\Windows\System32\ping.exe -n 1 -w 1500 dynamodb.eu-west-1.amazonaws.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1756
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\Defrag\ScheduledDefrag" /fo LIST /v
  2⤵
  PID:3188
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\Device Information\Device" /fo LIST /v
  2⤵
  PID:6128
- C:\Windows\System32\ping.exe
  C:\Windows\System32\ping.exe -n 1 -w 1500 dynamodb.eu-west-1.amazonaws.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2556
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\Device Information\Device User" /fo LIST /v
  2⤵
  PID:2240
- C:\Windows\System32\ping.exe
  C:\Windows\System32\ping.exe -n 1 -w 1500 dynamodb.ap-northeast-1.amazonaws.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1056
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\DiskCleanup\SilentCleanup" /fo LIST /v
  2⤵
  PID:3288
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\DiskFootprint\StorageSense" /fo LIST /v
  2⤵
  PID:4628
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\Location\Notifications" /fo LIST /v
  2⤵
  PID:5708
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\Maintenance\WinSAT" /fo LIST /v
  2⤵
  PID:896
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\RemoteAssistance\RemoteAssistanceTask" /fo LIST /v
  2⤵
  PID:2268
- C:\Windows\System32\ping.exe
  C:\Windows\System32\ping.exe -n 1 -w 1500 dynamodb.ap-northeast-1.amazonaws.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4160
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\Speech\SpeechModelDownloadTask" /fo LIST /v
  2⤵
  PID:4364
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\UPnP\UPnPHostConfig" /fo LIST /v
  2⤵
  PID:5852
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\HelloFace\FODCleanupTask" /fo LIST /v
  2⤵
  PID:3500
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\Multimedia\SystemSoundsService" /fo LIST /v
  2⤵
  PID:1304
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\Shell\FamilySafetyMonitor" /fo LIST /v
  2⤵
  PID:4332
- C:\Windows\System32\ping.exe
  C:\Windows\System32\ping.exe -n 1 -w 1500 dynamodb.ap-northeast-1.amazonaws.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:6096
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\Shell\FocusAssistConfigurator" /fo LIST /v
  2⤵
  PID:5276
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3436
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\Shell\IndexerAutomaticMaintenance" /fo LIST /v
  2⤵
  PID:1012
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\Widgets\WebExperience" /fo LIST /v
  2⤵
  PID:1768
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\Windows Search\PluginManager" /fo LIST /v
  2⤵
  PID:1648
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\AppxDeploymentClient\UCPD velocity" /fo LIST /v
  2⤵
  PID:1964
- C:\Windows\System32\ping.exe
  C:\Windows\System32\ping.exe -n 1 -w 1500 dynamodb.ap-southeast-2.amazonaws.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:700
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\InstallService\SmartRetry" /fo LIST /v
  2⤵
  PID:6044
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\Subscription\LicenseAcquisition" /fo LIST /v
  2⤵
  PID:3248
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\UNP\RunUpdateNotificationMgr" /fo LIST /v
  2⤵
  PID:5312
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" /fo LIST /v
  2⤵
  PID:1576
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\UpdateOrchestrator\UpdateModelTask" /fo LIST /v
  2⤵
  PID:5680
- C:\Windows\System32\ping.exe
  C:\Windows\System32\ping.exe -n 1 -w 1500 dynamodb.ap-southeast-2.amazonaws.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:264
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker" /fo LIST /v
  2⤵
  PID:4736
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\WaaSMedic\PerformRemediation" /fo LIST /v
  2⤵
  PID:1300
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /fo LIST /v
  2⤵
  PID:4808
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\ApplicationData\appuriverifierinstall" /fo LIST /v
  2⤵
  PID:5184
- C:\Windows\System32\ping.exe
  C:\Windows\System32\ping.exe -n 1 -w 1500 dynamodb.ap-southeast-2.amazonaws.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3524
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\ApplicationData\DsSvcCleanup" /fo LIST /v
  2⤵
  PID:1088
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\AppxDeploymentClient\Pre-stagedAppCleanup" /fo LIST /v
  2⤵
  PID:1348
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "\Microsoft\Windows\CertificateServicesClient\CryptoPolicyTask" /fo LIST /v
  2⤵
  PID:3080
- C:\Windows\System32\ping.exe
  C:\Windows\System32\ping.exe -n 1 -w 1500 dynamodb.sa-east-1.amazonaws.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2004
- C:\Windows\System32\ping.exe
  C:\Windows\System32\ping.exe -n 1 -w 1500 dynamodb.sa-east-1.amazonaws.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3268
- C:\Windows\System32\ping.exe
  C:\Windows\System32\ping.exe -n 1 -w 1500 dynamodb.sa-east-1.amazonaws.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4836
- C:\Users\Admin\AppData\Local\Programs\luminapp\LuminApp.exe
  "C:\Users\Admin\AppData\Local\Programs\luminapp\LuminApp.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\LuminApp" --standard-schemes=owepm --secure-schemes=owepm --bypasscsp-schemes=owepm --fetch-schemes=owepm --streaming-schemes=owepm --app-user-model-id=com.lumin.app --app-path="C:\Users\Admin\AppData\Local\Programs\luminapp\resources\app.asar" --enable-sandbox --no-sandbox --disable-accelerated-video-decode --disable-accelerated-video-encode --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2288,i,12770638162639261097,2347960225828001506,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=4528 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2336
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /Delete /TN LuminApp\Autostart /F
  2⤵
  PID:4532
- C:\Windows\System32\reg.exe
  C:\Windows\System32\reg.exe delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v LuminApp /f
  2⤵
  - Modifies registry key
  PID:4800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netstat -r"
  2⤵
  PID:5920
- - C:\Windows\system32\NETSTAT.EXE
    netstat -r
    3⤵
    - Gathers network information
    PID:1296
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print
      4⤵
      PID:1656
    - - C:\Windows\system32\ROUTE.EXE
        
        C:\Windows\system32\route.exe print
        5⤵
        
        PID:2468
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance Win32_NetworkAdapter | fl *; echo '#-#-#-#';Get-CimInstance Win32_NetworkAdapterConfiguration | fl DHCPEnabled"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4768
- C:\Users\Admin\AppData\Local\Programs\luminapp\LuminApp.exe
  "C:\Users\Admin\AppData\Local\Programs\luminapp\LuminApp.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\LuminApp" --standard-schemes=owepm --secure-schemes=owepm --bypasscsp-schemes=owepm --fetch-schemes=owepm --streaming-schemes=owepm --app-user-model-id=com.lumin.app --app-path="C:\Users\Admin\AppData\Local\Programs\luminapp\resources\app.asar" --enable-sandbox --enable-blink-features --disable-blink-features --js-flags=--expose_gc --disable-crash-reporting --no-sandbox --disable-accelerated-video-decode --disable-accelerated-video-encode --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=2288,i,12770638162639261097,2347960225828001506,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4444 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "where nvidia-smi 2>nul"
  2⤵
  PID:3048
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2468
- - C:\Windows\system32\where.exe
    where nvidia-smi
    3⤵
    PID:2884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s 2>nul"
  2⤵
  PID:4508
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
    3⤵
    PID:5944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" /s 2>nul"
  2⤵
  PID:5580
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" /s
    3⤵
    PID:5220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
  2⤵
  PID:3420
- - C:\Windows\system32\netsh.exe
    netsh lan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
  2⤵
  PID:3416
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:4896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "try { $u = Get-LocalUser -SID ([System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value) -ErrorAction Stop; $u.PrincipalSource.ToString() } catch { '' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s 2>nul"
  2⤵
  PID:1972
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
    3⤵
    PID:4180
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" /s 2>nul"
  2⤵
  PID:3532
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" /s
    3⤵
    PID:4328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get Name,DriverVersion,AdapterRAM,PNPDeviceID /format:list 2>nul"
  2⤵
  PID:4512
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get Name,DriverVersion,AdapterRAM,PNPDeviceID /format:list
    3⤵
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    PID:5256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "where nvidia-smi 2>nul"
  2⤵
  PID:424
- - C:\Windows\system32\where.exe
    where nvidia-smi
    3⤵
    PID:1940
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance Win32_Battery | select BatteryStatus, DesignCapacity, DesignVoltage, EstimatedChargeRemaining, DeviceID | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3268
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; (Get-WmiObject -Class BatteryStaticData -Namespace ROOT/WMI).DesignedCapacity"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5160
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; (Get-CimInstance -Class BatteryFullChargedCapacity -Namespace ROOT/WMI).FullChargedCapacity"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1072
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance Win32_SystemEnclosure | select Model,Manufacturer,ChassisTypes,Version,SerialNumber,PartNumber,SKU,SMBIOSAssetTag | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netstat -r"
  2⤵
  PID:1756
- - C:\Windows\system32\NETSTAT.EXE
    netstat -r
    3⤵
    - Gathers network information
    PID:2296
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print
      4⤵
      PID:1964
    - - C:\Windows\system32\ROUTE.EXE
        
        C:\Windows\system32\route.exe print
        5⤵
        
        PID:1260
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance Win32_NetworkAdapter | fl *; echo '#-#-#-#';Get-CimInstance Win32_NetworkAdapterConfiguration | fl DHCPEnabled"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s 2>nul"
  2⤵
  PID:4128
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
    3⤵
    PID:4984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" /s 2>nul"
  2⤵
  PID:1976
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3764
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" /s
    3⤵
    PID:1300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
  2⤵
  PID:2492
- - C:\Windows\system32\netsh.exe
    netsh lan show profiles
    3⤵
    PID:5304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
  2⤵
  PID:4380
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:1088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netstat -r"
  2⤵
  PID:3132
- - C:\Windows\system32\NETSTAT.EXE
    netstat -r
    3⤵
    - Gathers network information
    PID:5232
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print
      4⤵
      PID:3188
    - - C:\Windows\system32\ROUTE.EXE
        
        C:\Windows\system32\route.exe print
        5⤵
        
        PID:616
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance Win32_NetworkAdapter | fl *; echo '#-#-#-#';Get-CimInstance Win32_NetworkAdapterConfiguration | fl DHCPEnabled"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2884
- C:\Windows\system32\reg.exe
  reg query HKCU\Software\Valve\Steam /v SteamPath
  2⤵
  - Modifies registry key
  PID:1676
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Valve\Steam /v InstallPath
  2⤵
  - Modifies registry key
  PID:1188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "try { $u = Get-LocalUser -SID ([System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value) -ErrorAction Stop; $u.PrincipalSource.ToString() } catch { '' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
  2⤵
  PID:1608
- - C:\Windows\system32\netsh.exe
    netsh lan show profiles
    3⤵
    PID:2568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
  2⤵
  PID:5416
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4896
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:3764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get Name,DriverVersion,AdapterRAM,PNPDeviceID /format:list 2>nul"
  2⤵
  PID:1568
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get Name,DriverVersion,AdapterRAM,PNPDeviceID /format:list
    3⤵
    - Detects videocard installed
    PID:4328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "where nvidia-smi 2>nul"
  2⤵
  PID:4324
- - C:\Windows\system32\where.exe
    where nvidia-smi
    3⤵
    PID:5832
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance Win32_Battery | select BatteryStatus, DesignCapacity, DesignVoltage, EstimatedChargeRemaining, DeviceID | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4372
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; (Get-WmiObject -Class BatteryStaticData -Namespace ROOT/WMI).DesignedCapacity"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2988
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; (Get-CimInstance -Class BatteryFullChargedCapacity -Namespace ROOT/WMI).FullChargedCapacity"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:428
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1940
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance Win32_SystemEnclosure | select Model,Manufacturer,ChassisTypes,Version,SerialNumber,PartNumber,SKU,SMBIOSAssetTag | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netstat -r"
  2⤵
  PID:5684
- - C:\Windows\system32\NETSTAT.EXE
    netstat -r
    3⤵
    - Gathers network information
    PID:4080
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print
      4⤵
      PID:4232
    - - C:\Windows\system32\ROUTE.EXE
        
        C:\Windows\system32\route.exe print
        5⤵
        
        PID:3808
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance Win32_NetworkAdapter | fl *; echo '#-#-#-#';Get-CimInstance Win32_NetworkAdapterConfiguration | fl DHCPEnabled"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "try { $adapters = Get-NetAdapter | Where-Object { $_.Status -eq \"Up\" }; $result = @{ ethernet = $false; wifi = $false; ethernetIp = $null; reasons = @() }; foreach ($a in $adapters) { $desc = $a.InterfaceDescription; $isVirtual = $desc -match \"Virtual|Loopback|Tunnel|TAP|VPN|Hyper-V|vmware|VirtualBox\"; $isEth = $a.MediaType -eq \"802.3\" -and $a.PhysicalMediaType -ne \"Wireless LAN\" -and $a.PhysicalMediaType -ne \"Native 802.11\" -and -not $isVirtual; $isWifi = $a.PhysicalMediaType -eq \"Wireless LAN\" -or $a.PhysicalMediaType -eq \"Native 802.11\" -or $a.MediaType -eq \"Native 802.11\"; if ($isEth) { $ip = Get-NetIPAddress -InterfaceIndex $a.InterfaceIndex -AddressFamily IPv4 -ErrorAction SilentlyContinue | Where-Object { $_.IPAddress -notmatch \"^169\.\" } | Select-Object -First 1; if ($ip) { $result.ethernet = $true; $result.ethernetIp = $ip.IPAddress; $result.reasons += \"eth:\"+$a.Name } } if ($isWifi) { $result.wifi = $true; $result.reasons += \"wifi:\"+$a.Name } } $result | ConvertTo-Json -Compress } catch { Write-Output \"{}\" }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  PID:2904
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4180
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
  2⤵
  PID:3092
- - C:\Windows\system32\netsh.exe
    netsh lan show profiles
    3⤵
    PID:5660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
  2⤵
  PID:2836
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:1580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "try { $adapters = Get-NetAdapter | Where-Object { $_.Status -eq \"Up\" }; $result = @{ ethernet = $false; wifi = $false; ethernetIp = $null; reasons = @() }; foreach ($a in $adapters) { $desc = $a.InterfaceDescription; $isVirtual = $desc -match \"Virtual|Loopback|Tunnel|TAP|VPN|Hyper-V|vmware|VirtualBox\"; $isEth = $a.MediaType -eq \"802.3\" -and $a.PhysicalMediaType -ne \"Wireless LAN\" -and $a.PhysicalMediaType -ne \"Native 802.11\" -and -not $isVirtual; $isWifi = $a.PhysicalMediaType -eq \"Wireless LAN\" -or $a.PhysicalMediaType -eq \"Native 802.11\" -or $a.MediaType -eq \"Native 802.11\"; if ($isEth) { $ip = Get-NetIPAddress -InterfaceIndex $a.InterfaceIndex -AddressFamily IPv4 -ErrorAction SilentlyContinue | Where-Object { $_.IPAddress -notmatch \"^169\.\" } | Select-Object -First 1; if ($ip) { $result.ethernet = $true; $result.ethernetIp = $ip.IPAddress; $result.reasons += \"eth:\"+$a.Name } } if ($isWifi) { $result.wifi = $true; $result.reasons += \"wifi:\"+$a.Name } } $result | ConvertTo-Json -Compress } catch { Write-Output \"{}\" }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  PID:4500
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM LibreHardwareMonitor.exe /T
  2⤵
  - Kills process with taskkill
  PID:3408
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "try { $u = Get-LocalUser -SID ([System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value) -ErrorAction Stop; $u.PrincipalSource.ToString() } catch { '' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

c69d41ffb27e831a.enc

Path C:\ProgramData\LuminApp\data\066788213d959c3edf713cafed1929ba\c69d41ffb27e831a.enc
Size 188B
SHA256 84b3f1c98f646e69f4b3cee57a2833b113f6d0fb589e4c4addf4028de9817007
MD5 d4f8477ccebac351bda99068d2d75fad
SHA1 6ec76d2403cc9c4a682d0af8d76d92d0719d60eb
SHA512 a15c04a6e0ce66d8e0f930bc5ece12361637cafc3483c9aedf4f77e16a3a50446e3154ae2d378545930c8f932adef7f322b886b15df45ab20f9fea06ff0f545f
TLSH
T199C022C00893F9CE8C039A50D10EA90892C48E148061C3A320892A661DE5920E9128AC
MD5 SHA1 SHA512 TLSH

Submit Download

d3e92f879a1b5234.enc

Path C:\ProgramData\LuminApp\data\066788213d959c3edf713cafed1929ba\d3e92f879a1b5234.enc
Size 1KB
SHA256 ae86c9301b8c79a548e80986769a2d537148dd6bf3467279fa89c4d9b6108a58
MD5 ceb5f507057925eff13601881f3f5a3e
SHA1 d60a126af4f5ead77a22b27bac0a35757ea8a67f
SHA512 5ce4eaed4731df58d557d44199dea81b23b7d519126ec7fe45e6b065dd31506c5ebf5f1e5889bd9c90ba1e9aaf8a1a59b731682d0bbdedb468881b5032184323
TLSH
T10121F989E0B1E46E4BB3354E2A37E43201D60867F1E025BC69B068773E56BAFD568CC4
MD5 SHA1 SHA512 TLSH

Submit Download

d3e92f879a1b5234.enc.tmp

Path C:\ProgramData\LuminApp\data\066788213d959c3edf713cafed1929ba\d3e92f879a1b5234.enc.tmp
Size 1KB
SHA256 04d0bae5820a495c23e284e653f9b4667534c68eff540fffc3963972bf4fd753
MD5 7ae35b594493d133e3019be1b8877383
SHA1 afc4fe757dad9df804d03365414847e0ac109f2c
SHA512 32f782c9cebb6c20e92bf08321c1ba81c5d979b42e596e19450bedb7c4584241d1fd7443ba3a0677a8e854c9b2a6af0f4db4015e441d61547c68116c96fe4333
TLSH
T1962196E9449C87AB119F7B53228D391A2CB819883C459847F7F7D0B44B4829CE090FA5
MD5 SHA1 SHA512 TLSH

Submit Download

e9fa3c234b7d8e42.enc

Path C:\ProgramData\LuminApp\data\066788213d959c3edf713cafed1929ba\e9fa3c234b7d8e42.enc
Size 764B
SHA256 99c63b2676a1919e93b5a10d7a19bd921f5af9f9729758b274fca7bdb7daf5bd
MD5 478714e2d466fe826040026f4818ea80
SHA1 ab0dd75bd9143151bda56e03adac8753390c4add
SHA512 291dc8e9c476a37de6f9e1f1ed21e7990f87e0511f2b8463fd5bd9b74436c831435229b4236cf65062c7e6b9e17f5c50891c0fea291eb72605089d46a0445796
TLSH
T13901B5578102096AA148CDAC00AAE8C8EE8C8AE7492419189ACB434D82900F2BEE4273
MD5 SHA1 SHA512 TLSH

Submit Download

e9fa3c234b7d8e42.enc

Path C:\ProgramData\LuminApp\data\066788213d959c3edf713cafed1929ba\e9fa3c234b7d8e42.enc
Size 880B
SHA256 b550a0ad08835824eb679ef78230bb13465b067a237cfb67deeab1d5f2064eb0
MD5 0d8ea07c6b5f50e380710fd8d93b6585
SHA1 6f498593fb610e08905ec0fdadf4e842bcb21c5d
SHA512 71a92cf239b880b9e6100c95a7d6dcdf5e8d950a1c0e87e497612dcf6e07274c4fa05a9c83bb86be518b36bd6222c6b9372ba0635f76839debc2e2b5a1b81413
TLSH
T183119686C7B03A60F124D3659ED1A0019EB394A8CD74CC9935F72E5D580EC8C2DCBA4B
MD5 SHA1 SHA512 TLSH

Submit Download

e9fa3c234b7d8e42.enc.tmp

Path C:\ProgramData\LuminApp\data\066788213d959c3edf713cafed1929ba\e9fa3c234b7d8e42.enc.tmp
Size 567B
SHA256 f763a6c097c10a0d2bd7c60430e392ff55e04e12aaf440506ffd50b455c162d6
MD5 9a2fff04ae119ad5b9848ff7ea85ce87
SHA1 928116f93993913778f7374639b07c4dc1627b28
SHA512 cc6d3ff12697972d16124ccaab84c59196a1f599db5c008224e14565742ffc991562dc831ef49e6af19b35b67bc438a1ec6e7f12693eb4a0ce7df9a4e4b5c6c6
TLSH
T1A3F0269ADF3E97541D5DC1D6EC30918D2E0D742075BAFEAD6540DA79223FC08C810D75
MD5 SHA1 SHA512 TLSH

Submit Download

e9fa3c234b7d8e42.enc.tmp

Path C:\ProgramData\LuminApp\data\066788213d959c3edf713cafed1929ba\e9fa3c234b7d8e42.enc.tmp
Size 700B
SHA256 c7a2d11df74fe21ebb5ddddd078736556c8e92b7c27d5a68af097375305c1252
MD5 e5290ce4ddfdf274a3fc189eb9317043
SHA1 78dc88646aa986e993e5fc84855bea12be85400e
SHA512 ae0e7882ec090d8cd892db79df26ac8347f591f6d9f1d3da4f0ad7f918eb4b2d7fbc73d1330a844b03eac4769d8790e4322b0e59d23f7e46815d8c0ddb128c63
TLSH
T1D00194852C6C749980395B8F70826C2A9BF35DCB30106C742F244ECCDBC2E21DC26000
MD5 SHA1 SHA512 TLSH

Submit Download

e9fa3c234b7d8e42.enc.tmp

Path C:\ProgramData\LuminApp\data\066788213d959c3edf713cafed1929ba\e9fa3c234b7d8e42.enc.tmp
Size 876B
SHA256 10e435235e4cc4778f999b166685f05bf14b15434a7993263cb35a72672ed3dd
MD5 ea4d17159543d145ecd4a1f9c0a9eed3
SHA1 0d36c589a6bcd6e7d27c27367469a1143b5c3137
SHA512 1d59b4a91837b3c8cbdb987210cd146be1e4681d8ce3d3317ab932422353ac7f8d1d3220d365ebf68bc1714b877c791a21d407af9213f91e2ab2228bb6fec500
TLSH
T1D51167B48AA9AAD469C5DA20CC0844E2E1219219939933D595A5102A7BB4262F05CE4D
MD5 SHA1 SHA512 TLSH

Submit Download

.lumin-wprobe.tmp

Path C:\ProgramData\LuminApp\data\5c6803d79ca916037a0f15373da7ba7a\.lumin-wprobe.tmp
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 b5264930c0738488a0fa8534326524f346d35a3ffc6152a481822fc53600378d
MD5 06348e7c15c3e2543253e5aeeb00aa07
SHA1 d15aec6a442646f49fc077229f090d8f34338cca
SHA512 84922131b669cb430b4cba2f43582c05681df223ef0918695d1a08db0f105362ae530d55c2f588252d3b153296780e83f5a3c7a229d6ab2a18e68d3fff3ec286
SSDEEP 1536:/KLg0xCw2hkovpfKQVAflJdpHYWh4iUx9R40i71Yi+MQyPRWrxMV3CNBQkj2Va5E:/KLg0xCw2hkovpfKQVAflJd9YWqiU9Rc
TLSH
T1C1636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download