lumma | hxxps://mega[.]nz/file/YG0XxYpK#PF-r4bg1WxxpCcf5XsfhfpnCvArx1tTTInXKyyEd5PQ

Analysis

max time kernel
105s
max time network
106s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
25-06-2024 03:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/file/YG0XxYpK#PF-r4bg1WxxpCcf5XsfhfpnCvArx1tTTInXKyyEd5PQ

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://publicitycharetew.shop/api

https://computerexcudesp.shop/api

https://leafcalfconflcitw.shop/api

https://injurypiggyoewirog.shop/api

https://bargainnygroandjwk.shop/api

https://disappointcredisotw.shop/api

https://doughtdrillyksow.shop/api

https://facilitycoursedw.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Executes dropped EXE 3 IoCs

Processes:

Setup.exeSetup.exeSetup.exe

pid process

3908 Setup.exe
1604 Setup.exe
96 Setup.exe
Loads dropped DLL 3 IoCs

Processes:

Setup.exeSetup.exeSetup.exe

pid process

3908 Setup.exe
1604 Setup.exe
96 Setup.exe
Suspicious use of SetThreadContext 3 IoCs

Processes:

Setup.exeSetup.exeSetup.exe

description pid process target process

PID 3908 set thread context of 3532 3908 Setup.exe more.com
PID 1604 set thread context of 1064 1604 Setup.exe more.com
PID 96 set thread context of 600 96 Setup.exe more.com

pid	process
3908	Setup.exe
1604	Setup.exe
96	Setup.exe

pid	process
3908	Setup.exe
1604	Setup.exe
96	Setup.exe

description	pid	process	target process
PID 3908 set thread context of 3532	3908	Setup.exe	more.com
PID 1604 set thread context of 1064	1604	Setup.exe	more.com
PID 96 set thread context of 600	96	Setup.exe	more.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133637612369844618"	chrome.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

Processes:

chrome.exeSetup.exemore.comSetup.exemore.comSetup.exemore.com

pid	process
4472	chrome.exe
4472	chrome.exe
3908	Setup.exe
3908	Setup.exe
3908	Setup.exe
3532	more.com
3532	more.com
1604	Setup.exe
1604	Setup.exe
1604	Setup.exe
1064	more.com
1064	more.com
1064	more.com
1064	more.com
96	Setup.exe
96	Setup.exe
96	Setup.exe
600	more.com
600	more.com
600	more.com
600	more.com

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

Setup.exemore.comSetup.exeSetup.exemore.commore.com

pid process

3908 Setup.exe
3532 more.com
1604 Setup.exe
96 Setup.exe
1064 more.com
600 more.com
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

chrome.exe

pid process

4472 chrome.exe
4472 chrome.exe

pid	process
3908	Setup.exe
3532	more.com
1604	Setup.exe
96	Setup.exe
1064	more.com
600	more.com

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exeAUDIODG.EXE7zG.exe

description	pid	process
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: 33	4280	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4280	AUDIODG.EXE
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeRestorePrivilege	1576	7zG.exe
Token: 35	1576	7zG.exe
Token: SeSecurityPrivilege	1576	7zG.exe
Token: SeSecurityPrivilege	1576	7zG.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

Processes:

chrome.exe7zG.exe7zG.exe

pid	process
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
1576	7zG.exe
4936	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

Setup.exeSetup.exeSetup.exe

pid process

3908 Setup.exe
3908 Setup.exe
1604 Setup.exe
1604 Setup.exe
96 Setup.exe
96 Setup.exe

pid	process
3908	Setup.exe
3908	Setup.exe
1604	Setup.exe
1604	Setup.exe
96	Setup.exe
96	Setup.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 4472 wrote to memory of 3396	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 3396	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 4716	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 4716	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 4716	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 4716	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 4716	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 4716	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 4716	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 4716	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 4716	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 4716	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 4716	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 4716	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 4716	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 4716	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 4716	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 4716	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 4716	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 4716	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 4716	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 4716	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 4716	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 4716	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 4716	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 4716	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 4716	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 4716	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 4716	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 4716	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 4716	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 4716	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 4716	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 4716	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 4716	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 4716	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 4716	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 4716	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 4716	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 4716	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 1996	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 1996	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 1288	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 1288	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 1288	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 1288	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 1288	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 1288	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 1288	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 1288	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 1288	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 1288	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 1288	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 1288	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 1288	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 1288	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 1288	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 1288	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 1288	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 1288	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 1288	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 1288	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 1288	4472	chrome.exe	chrome.exe
PID 4472 wrote to memory of 1288	4472	chrome.exe	chrome.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mega.nz/file/YG0XxYpK#PF-r4bg1WxxpCcf5XsfhfpnCvArx1tTTInXKyyEd5PQ
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4472

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffc85b19758,0x7ffc85b19768,0x7ffc85b19778
2⤵
PID:3396

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1584 --field-trial-handle=1864,i,6024414498777831042,2250158550233282085,131072 /prefetch:2
2⤵
PID:4716

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1876 --field-trial-handle=1864,i,6024414498777831042,2250158550233282085,131072 /prefetch:8
2⤵
PID:1996

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2096 --field-trial-handle=1864,i,6024414498777831042,2250158550233282085,131072 /prefetch:8
2⤵
PID:1288

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2852 --field-trial-handle=1864,i,6024414498777831042,2250158550233282085,131072 /prefetch:1
2⤵
PID:4204

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2860 --field-trial-handle=1864,i,6024414498777831042,2250158550233282085,131072 /prefetch:1
2⤵
PID:5024

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4760 --field-trial-handle=1864,i,6024414498777831042,2250158550233282085,131072 /prefetch:8
2⤵
PID:436

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4868 --field-trial-handle=1864,i,6024414498777831042,2250158550233282085,131072 /prefetch:8
2⤵
PID:4320

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5212 --field-trial-handle=1864,i,6024414498777831042,2250158550233282085,131072 /prefetch:8
2⤵
PID:2812

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4840 --field-trial-handle=1864,i,6024414498777831042,2250158550233282085,131072 /prefetch:8
2⤵
PID:3636

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 --field-trial-handle=1864,i,6024414498777831042,2250158550233282085,131072 /prefetch:8
2⤵
PID:2104

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1356

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x418
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4280

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2108

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap7264:118:7zEvent2901
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1576

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\File_Is_Here\" -an -ai#7zMap10571:144:7zEvent22082
1⤵
- Suspicious use of FindShellTrayWindow
PID:4936

C:\Users\Admin\Downloads\File_Is_Here\Setup.exe
"C:\Users\Admin\Downloads\File_Is_Here\Setup.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:3908

C:\Windows\SysWOW64\more.com
C:\Windows\SysWOW64\more.com
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3532

C:\Windows\SysWOW64\SearchIndexer.exe
C:\Windows\SysWOW64\SearchIndexer.exe
3⤵
PID:1228

C:\Users\Admin\Downloads\File_Is_Here\Setup.exe
"C:\Users\Admin\Downloads\File_Is_Here\Setup.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:1604

C:\Windows\SysWOW64\more.com
C:\Windows\SysWOW64\more.com
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1064

C:\Windows\SysWOW64\SearchIndexer.exe
C:\Windows\SysWOW64\SearchIndexer.exe
3⤵
PID:1948

C:\Users\Admin\Downloads\File_Is_Here\Setup.exe
"C:\Users\Admin\Downloads\File_Is_Here\Setup.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:96

C:\Windows\SysWOW64\more.com
C:\Windows\SysWOW64\more.com
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:600

C:\Windows\SysWOW64\SearchIndexer.exe
C:\Windows\SysWOW64\SearchIndexer.exe
3⤵
PID:1704

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000024
Filesize
17KB

MD5
950eca48e414acbe2c3b5d046dcb8521

SHA1
1731f264e979f18cdf08c405c7b7d32789a6fb59

SHA256
c0bbe530abfce19e06697bc4358eb426e076ccdb9113e22df4a6f32085da67a2

SHA512
27e55525ade4d099a6881011f6e2e0d5d3a9ca7181f4f014dc231d40b3b1907d0d437b0c44d336c25dd7b73209cd773b8563675ac260c43c7752e2d2d694d4d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
72B

MD5
e1a84e9ddb5bca533d85dd7b85d4a5a5

SHA1
a5e1a240beb437eae8b956dafb67aac7de8f0383

SHA256
fcefea6cb91dc1346c80a75137176ce443c066226a1582f4688fea22e99c177f

SHA512
86469acf6120d465e16feb8ec2c6fef2b1da4d90311662956af7b6feda6da23f24a6348b52ba13fc1f7ccf4198a9076d624f029daaae5226b6ae99a5f8c89cf9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
769B

MD5
490ca23becfa163b3d275d2db13b4efd

SHA1
fefd0c36bd9365c901c66c6eb3269cded44333fe

SHA256
6ce8be47d2e3979deb6446a115549c8001b747957e7d4a966812b19cb5150b30

SHA512
54eb82427b0828fc3982e476a6206a0d00657ac46cb45365b605e673c2fd4761d7131df29c78ba26cd596a90e2930468a4765b2e7b7b6c1dadce9c2c8d2aa058

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
538B

MD5
dee1d7a453b0514668887fe86a02b26d

SHA1
bc3d317872935246a211bb3145935feef3d2ae1e

SHA256
3a04def7e2cca3cd02582dfab672923f0b710eb72159a7b84ca726ed49fe997c

SHA512
9da36fa4c92919821e846762cfb6781ef0291d0b5ac7ac80cca5a8fe94e13fd41096fc3cf8e5177b1485543e182e11e05f5222f22fd6a51bb0b3e801434913ce

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
6803afb847803a442d18041e38a90b32

SHA1
f604231c87405971a9a92facce60d0a82ec21e86

SHA256
1431deadda03fc8c87cf4499bedcefe41a788328a812cb2e3c69a387713ec039

SHA512
57e55ec9a5a4045e40edd0254c6416f1ee836218cee3ed3924cbf7391608b0632ebbb02d19bf841d092c434f99917fc21952e675e06ac3d4a47c7f26ee989f09

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
33442984df616ce950584f3e39ff4feb

SHA1
544d072730b2024db321c6cbe73312571dee382c

SHA256
19cc85bffba9310b917e56cff3587d81c2cc75108ed7b2bd7528d99b907b8b62

SHA512
42d8c36b09a02a7f7db892ce73f656a7c8aa7ad7162fa564574d47e08472834b882cbbd908f960c53c0ec078b3f418bfc977ba900b6b89cff3232c05cb27a9f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
fc2f8d65a3631b12771b5f389d2b42d2

SHA1
ccadf52843ebf50c8950e0955cf6ddba93bcc434

SHA256
2e347c96af919b84f9c7a7b0d6cf850e0d1612920a88616a85bda3a229704886

SHA512
03b65e6742004c66d2f072b611723f9c96be69201d5c6d0a21f0d3e97905503289fc05ad71ae7eaf75f382fe3d97cb6729394c30123d2ae61c73f7c068181c06

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
ba8908347669c642696ed964c8454b62

SHA1
388aad504659a8e4024c147c31f7ba1c1bb7db1c

SHA256
a73a4a67cd4646e54f0ecab82dee27257b7ab5738186afb0b5d34eda44587144

SHA512
34822486213eba53a0a1ca0e4d7705fbc3633a59476d47f440aedadc22b4759cec74065de4dd88f0254b0d652c65cfb08be3616620155d5df98777b92dbfcce6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize
72B

MD5
a2b9170c70055f8281216426bf842645

SHA1
9b691bafef27fa67bad94507b80d3f42804962ac

SHA256
4fa4d815dc2f149fd979245477d2af3d5bc27abd8fd4fbbaac3cb95b007dcfea

SHA512
3c7690c8cea0b8e41e03b17f21703bf73a1013da188ed43944b168eccf371e4136a515af8af68bb2b2ceca99a68619c17dd6ccc12d10537ef7a6a843934cc734

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57d031.TMP
Filesize
48B

MD5
9d0a4ed2a5df1eb4d4a960ad48c04b49

SHA1
4f97df607b0aba2a4a3c15958ba73bbbdf6f86be

SHA256
5769cbd5f0332cd6066eeac70a5f5250960fc41518b4cc38d3d832ef3ded900c

SHA512
43db00b0c83dc967c9737b5aa1f91c229db869634cae19df064c8c53648489a1a0b6813b84ce4b6c5653bb0cfaa5c2c4cdf3554fb78a2464d823218db901dec9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
136KB

MD5
1ee55a4781954477f4eaf426bcd09361

SHA1
2adbdc34c961192701f03e978ca05043885b9ce6

SHA256
afc32ea7a2596cded17a1cfadf1812b9cb1569e106f8e70a952154732a4ad2cd

SHA512
cedd70b8177550ef3def49ac9083c42beba7f23153f9655cac974144e09564d81c3ce89f4303a2ed1301634efa77cc0e6a220bfc2366b271c492ea3f6610b75f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
105KB

MD5
fb552a4c40348c0875bb5c6b2cb3c011

SHA1
85e037fe39a31d62fab7d8638396f81eaee0a2c4

SHA256
a16fc621fb78f79a040669001b9277af01cd386c24b0753e88100d02b9549d60

SHA512
063455efb2c8c1c6644b604882b0307b9bf938fd9492cae015562c04dc7c6b664b7b738ee3e1daddbb89bdb2bd6ccb1f54d4be9d94e5f8ab88986ec190d6b820

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57d254.TMP
Filesize
98KB

MD5
88d4e85d2d76ca7b464ad102dec74672

SHA1
00082f82b7c3ccde047bff97bcc356aa46cd20ce

SHA256
3122729cf819e86ce81f041f4a61aeb8e8b8a7ae9961efb052a3b39d2b0bd0e1

SHA512
485a6a1e32e93bd7bca1970bd462f532ea532c52cfa137268b40962d016dac5200cc19ef6a84dbfb139b86612ce061e79776b7d25e3ac39afd42cc5bc70fe93b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7b6edaff
Filesize
1011KB

MD5
9178164909513813c5cbaecf1bd80bfc

SHA1
582fa939b8dcda134db28adef1ae0363ee46e712

SHA256
89668573f2d88032cfa050c60dc2444534a951f9ab161ba08938a657c0014de9

SHA512
9b3cb82a2d6f50296ac8e38ae9f06431e5850f85b749ec2828a0e1d1949cc7242a48606547d9304c155be40ecbbf3da885c4d446d84f24309e064bdc2a981cb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\cea25e56
Filesize
1011KB

MD5
b2abec541007697beb77344844da0f89

SHA1
8735ff39e8f0556f60dcc1076bb107f2643d67ca

SHA256
74de00b3b4cbe3bd600c06fd460c53ea26468220bec2171991c7e83e00844fa4

SHA512
c3cde833c099b9e044b5ec10d60c024cb857267447e1ce727de68d8fa82e4305126b4c5bb073b808fec3bdc4bef45de779fd451078c6e5831cc042979706d8f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\eb4ed984
Filesize
1011KB

MD5
2598e957dfa47523c090f24e94be2a55

SHA1
60cc01054e62767b4c0bc92048727e6ab1df9844

SHA256
122bc073586de459463149aa8098c022db819d5ef82fa8d305131a5033f40572

SHA512
64c12e987f6875b7767c229d8f739fe80eb9b422316fcf062dd3e41c174651063a701131cfc1a2d56d8f68c159a648432d80bcda5e1012a5f8c16bfbf4330402

Download Submit
C:\Users\Admin\Downloads\!!FulLSetup_22334_P@ssKey$!!.zip
Filesize
13.9MB

MD5
c739ae6a85f68db5d7b5cdb741765f8a

SHA1
ba0f09c685237e898fdff52ebb93025399d9d648

SHA256
633ebc42c069155ba0a6f116ab3a3c12c34de60f44a83e1eb0d40fb97731132b

SHA512
eb019ea6c76219080bc50d4e59bc1312635676cd440b99121c0e44deb885c15e1a3d662e3eea1e840beeaf63b6687fd7cbd3b8dd84793ba90d551b7cc95bef22

Download Submit
C:\Users\Admin\Downloads\File_Is_Here\!!fUlLSetup_22334_P@ssKeys!!.rar
Filesize
13.9MB

MD5
56c02bd4cc9ffb61b0d914bb87e6a673

SHA1
4a2253888eb02d7c80c522ce5e55da94fbc08fed

SHA256
aa3096afab2baec1de03c610cd3133bab3abeeb6d1cd11530088f8dfe77c5fc1

SHA512
e4beabf904d93f447d9f2ed532ace40b58e75b3aed064cf53a2e1b23c4397be4fbb1190bff500b23f8280577f52006dd69a3c67425ca435b15d53670b7f1a8be

Download Submit
C:\Users\Admin\Downloads\File_Is_Here\MediaInfo_i386.dll
Filesize
6.2MB

MD5
92ca7e5d272e75a260ac9c326184e561

SHA1
9640262e59714e6909edfab5b0f59fb6fc374e4d

SHA256
bb2451d45677197c42655b51fafb95d7be0c2fc3998e4de8bd3a7ee2146de52b

SHA512
eedbb4f66c04c03d2fcc0e8af8648a1986ea77468a5778d6bca6839d9633ea044cba00535c742478684803f8fc6a72366f654be5ac5b45a35798060d84141235

Download Submit
C:\Users\Admin\Downloads\File_Is_Here\Setup.exe
Filesize
5.5MB

MD5
ae697c5f8ef74fbe8daf09358afd9324

SHA1
8e18a9ee76df13daa5cfaf079872c77a25f15338

SHA256
4fc64e114f80ce755040ac2891bd1fab0492a831177491f3fe1382adf94030f9

SHA512
6f2bdd0c9d746218ab8c215e7d9fe1acaaf39763077eaf1a03754acb4d8ccfd518b052d98675ebf0233bbd3aa87ceffe1ffcdc14219b0a6f308d84a978a5f23a

Download Submit
C:\Users\Admin\Downloads\File_Is_Here\piton.ai
Filesize
779KB

MD5
59e6d97b789486db3427e689a75fac6e

SHA1
3e00320f4cedbe34f4e22d54c279579255a6738f

SHA256
f2b601613bbb70eeb7557aaabea5bf5fe915e049d2dcdc23ef5ef67b0b3e2ab3

SHA512
607b6a2dc1788ddc96259e18eb96b505cd1ad29258ede5a3e83369ef02aaa27017a89d5402ea08e17c76663435da1c0ee4fa01425265b707835dc0766d6aaafc

Download Submit
C:\Users\Admin\Downloads\File_Is_Here\selfrepose.jpg
Filesize
36KB

MD5
643dbb0b31d40d535aa55b408074b669

SHA1
f68dc031ffbfb9d55ff7bbcbc0a7b622b093b0a5

SHA256
a00b85c26bacf364088061eefbc69d5c863777d212b4b63416f492418841b2e2

SHA512
d07aa2db8a0625deeeeacebe10f3160eeeca0d1642d5e1c22ae6c3429c5483af2333a7dd000b8e04a4a954679ce0d7041c4cd7161735ec2d610b5c28336609e4

Download Submit
\??\pipe\crashpad_4472_CTXUKWCQEVVTAOWG
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/96-539-0x00007FFC919C0000-0x00007FFC91B9B000-memory.dmp

Filesize
1.9MB

Download
memory/96-538-0x0000000071620000-0x000000007179B000-memory.dmp

Filesize
1.5MB

Download
memory/96-549-0x0000000071620000-0x000000007179B000-memory.dmp

Filesize
1.5MB

Download
memory/96-551-0x0000000000400000-0x000000000099A000-memory.dmp

Filesize
5.6MB

Download
memory/600-554-0x00007FFC919C0000-0x00007FFC91B9B000-memory.dmp

Filesize
1.9MB

Download
memory/1064-535-0x00007FFC919C0000-0x00007FFC91B9B000-memory.dmp

Filesize
1.9MB

Download
memory/1228-546-0x0000000000840000-0x0000000000898000-memory.dmp

Filesize
352KB

Download
memory/1228-529-0x00007FFC919C0000-0x00007FFC91B9B000-memory.dmp

Filesize
1.9MB

Download
memory/1228-534-0x0000000000840000-0x0000000000898000-memory.dmp

Filesize
352KB

Download
memory/1604-530-0x0000000071620000-0x000000007179B000-memory.dmp

Filesize
1.5MB

Download
memory/1604-532-0x0000000000400000-0x000000000099A000-memory.dmp

Filesize
5.6MB

Download
memory/1604-508-0x00007FFC919C0000-0x00007FFC91B9B000-memory.dmp

Filesize
1.9MB

Download
memory/1604-506-0x0000000071620000-0x000000007179B000-memory.dmp

Filesize
1.5MB

Download
memory/1948-555-0x00007FFC919C0000-0x00007FFC91B9B000-memory.dmp

Filesize
1.9MB

Download
memory/1948-556-0x0000000000340000-0x0000000000398000-memory.dmp

Filesize
352KB

Download
memory/3532-503-0x0000000071620000-0x000000007179B000-memory.dmp

Filesize
1.5MB

Download
memory/3532-500-0x00007FFC919C0000-0x00007FFC91B9B000-memory.dmp

Filesize
1.9MB

Download
memory/3908-498-0x0000000000400000-0x000000000099A000-memory.dmp

Filesize
5.6MB

Download
memory/3908-496-0x0000000071620000-0x000000007179B000-memory.dmp

Filesize
1.5MB

Download
memory/3908-492-0x00007FFC919C0000-0x00007FFC91B9B000-memory.dmp

Filesize
1.9MB

Download
memory/3908-491-0x0000000071620000-0x000000007179B000-memory.dmp

Filesize
1.5MB

Download