lumma | hxxps://www[.]mediafire[.]com/folder/adhrcozj0eema/Nova

Analysis

max time kernel
139s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2024 18:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/folder/adhrcozj0eema/Nova

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://extorteauhhwigw.shop/api

https://potterryisiw.shop/api

https://foodypannyjsud.shop/api

https://contintnetksows.shop/api

https://reinforcedirectorywd.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Suspicious use of SetThreadContext 3 IoCs

Processes:

Nova.exeNova.exeNova.exe

description	pid	process	target process
PID 5252 set thread context of 4200	5252	Nova.exe	RegAsm.exe
PID 4656 set thread context of 2860	4656	Nova.exe	RegAsm.exe
PID 4016 set thread context of 2712	4016	Nova.exe	RegAsm.exe

Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

4372 5252 WerFault.exe Nova.exe
5468 4656 WerFault.exe Nova.exe
5172 4016 WerFault.exe Nova.exe

pid	pid_target	process	target process
4372	5252	WerFault.exe	Nova.exe
5468	4656	WerFault.exe	Nova.exe
5172	4016	WerFault.exe	Nova.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exesvchost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

Processes:

svchost.exesvchost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2080292272-204036150-2159171770-1000\{5850587F-E99D-4D91-A06B-7E0C1D3CCB69}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2080292272-204036150-2159171770-1000\{8CDFE8D7-8C86-434F-9BCA-37AFEB8C63A5}	svchost.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid process

3492 msedge.exe
3492 msedge.exe
220 msedge.exe
220 msedge.exe
5052 identity_helper.exe
5052 identity_helper.exe
5360 msedge.exe
5360 msedge.exe

pid	process
3492	msedge.exe
3492	msedge.exe
220	msedge.exe
220	msedge.exe
5052	identity_helper.exe
5052	identity_helper.exe
5360	msedge.exe
5360	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

Processes:

msedge.exe

pid	process
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

Processes:

msedge.exe

pid	process
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

OpenWith.exeOpenWith.exeOpenWith.exe

pid process

5680 OpenWith.exe
3380 OpenWith.exe
4912 OpenWith.exe

pid	process
5680	OpenWith.exe
3380	OpenWith.exe
4912	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 220 wrote to memory of 4316	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4316	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 1328	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 1328	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 1328	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 1328	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 1328	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 1328	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 1328	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 1328	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 1328	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 1328	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 1328	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 1328	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 1328	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 1328	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 1328	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 1328	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 1328	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 1328	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 1328	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 1328	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 1328	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 1328	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 1328	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 1328	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 1328	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 1328	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 1328	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 1328	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 1328	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 1328	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 1328	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 1328	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 1328	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 1328	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 1328	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 1328	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 1328	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 1328	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 1328	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 1328	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 3492	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 3492	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 5112	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 5112	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 5112	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 5112	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 5112	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 5112	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 5112	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 5112	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 5112	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 5112	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 5112	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 5112	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 5112	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 5112	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 5112	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 5112	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 5112	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 5112	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 5112	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 5112	220	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/folder/adhrcozj0eema/Nova
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa00d46f8,0x7ffaa00d4708,0x7ffaa00d4718
2⤵
PID:4316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,13458977521296115957,5234469034703453821,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
2⤵
PID:1328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,13458977521296115957,5234469034703453821,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,13458977521296115957,5234469034703453821,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
2⤵
PID:5112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13458977521296115957,5234469034703453821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
2⤵
PID:3136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13458977521296115957,5234469034703453821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
2⤵
PID:4132

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,13458977521296115957,5234469034703453821,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5976 /prefetch:8
2⤵
PID:3240

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,13458977521296115957,5234469034703453821,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5976 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13458977521296115957,5234469034703453821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
2⤵
PID:3880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13458977521296115957,5234469034703453821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
2⤵
PID:4604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13458977521296115957,5234469034703453821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
2⤵
PID:3404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13458977521296115957,5234469034703453821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
2⤵
PID:4480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13458977521296115957,5234469034703453821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6240 /prefetch:1
2⤵
PID:1288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13458977521296115957,5234469034703453821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6476 /prefetch:1
2⤵
PID:3328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13458977521296115957,5234469034703453821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6816 /prefetch:1
2⤵
PID:5284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13458977521296115957,5234469034703453821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6944 /prefetch:1
2⤵
PID:5524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13458977521296115957,5234469034703453821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7156 /prefetch:1
2⤵
PID:5764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13458977521296115957,5234469034703453821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6920 /prefetch:1
2⤵
PID:5848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13458977521296115957,5234469034703453821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7652 /prefetch:1
2⤵
PID:5924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13458977521296115957,5234469034703453821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6996 /prefetch:1
2⤵
PID:6008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2148,13458977521296115957,5234469034703453821,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7280 /prefetch:8
2⤵
PID:5380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13458977521296115957,5234469034703453821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7700 /prefetch:1
2⤵
PID:5516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2148,13458977521296115957,5234469034703453821,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7292 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13458977521296115957,5234469034703453821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
2⤵
PID:5648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13458977521296115957,5234469034703453821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6932 /prefetch:1
2⤵
PID:5784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13458977521296115957,5234469034703453821,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
2⤵
PID:5808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13458977521296115957,5234469034703453821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7628 /prefetch:1
2⤵
PID:5428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13458977521296115957,5234469034703453821,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7668 /prefetch:1
2⤵
PID:5356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3840

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3308

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2288

C:\Users\Admin\Downloads\Nova 1.6\Nova.exe
"C:\Users\Admin\Downloads\Nova 1.6\Nova.exe"
1⤵
- Suspicious use of SetThreadContext
PID:5252

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:3624

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:4200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5252 -s 324
2⤵
- Program crash
PID:4372

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:4460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5252 -ip 5252
1⤵
PID:4436

C:\Users\Admin\Downloads\Nova 1.6\Nova.exe
"C:\Users\Admin\Downloads\Nova 1.6\Nova.exe"
1⤵
- Suspicious use of SetThreadContext
PID:4656

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:1800

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:2860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 288
2⤵
- Program crash
PID:5468

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4656 -ip 4656
1⤵
PID:3288

C:\Users\Admin\Downloads\Nova 1.6\Nova.exe
"C:\Users\Admin\Downloads\Nova 1.6\Nova.exe"
1⤵
- Suspicious use of SetThreadContext
PID:4016

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:4136

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:1344

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:2712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 288
2⤵
- Program crash
PID:5172

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4016 -ip 4016
1⤵
PID:5324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:5188

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
81e892ca5c5683efdf9135fe0f2adb15

SHA1
39159b30226d98a465ece1da28dc87088b20ecad

SHA256
830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17

SHA512
c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
56067634f68231081c4bd5bdbfcc202f

SHA1
5582776da6ffc75bb0973840fc3d15598bc09eb1

SHA256
8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4

SHA512
c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002d
Filesize
211KB

MD5
151fb811968eaf8efb840908b89dc9d4

SHA1
7ec811009fd9b0e6d92d12d78b002275f2f1bee1

SHA256
043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed

SHA512
83aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000037
Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
2KB

MD5
e59b8bce1d998ccd5c67af530e703a80

SHA1
9499b3048a9ad177eee0258295a06412ed4f527e

SHA256
691c77f03a442b1ab5c49e5947bc7da75a17a1eeab8fe406c5d9516535f9021e

SHA512
4e43d546d0f2a0689779643dd20aa83b63dc213395efd8048998895d88121d56a456d402997e77d28289eb024147cd8fbdccb87824b19cd3f5ac757761978020

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
9KB

MD5
b5a9408b109e9f9f5b1cad2c9cd854ec

SHA1
5c37470cfadf0181d3be8c1b32a71f656d7f92a3

SHA256
d1408fe9171949804d0c737e34ef5391785084a36cfab56b77e7c458e41fc2d2

SHA512
d0b04317d53edf2f5d46985eef6d87cbfb49a38e5ff94a5f81dc10625efbaf5c83b925b375867bf9de1f48fc83fccce060c81685cd38f8e87e5cf206d9d9da7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
8fda395715239e9f3b4b2b58ec571816

SHA1
9668834a4c446c8235810c1c5f40c660affdcc82

SHA256
044406faab73a1ae653d5979fa0c193ec7229c57c45c4e42d7f3d0ee592761e6

SHA512
ce16f2928ee219773c60453043918116d2671e3100b8a038f671f31d9d43afba8f42af2a0f85d952b26fe557d6da0dcefed15d4ad0d8d0cb14112f0ef1d2dcbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
13KB

MD5
1f68b2ea8c4a27f0e9c2fb5bd6bad1c0

SHA1
6ad56e3aa9189566999a4c001503c5f1f168903a

SHA256
574e27893685cadec667ed41138012eaaeabc9222409b61fa320a4276bb7f4a3

SHA512
398949e771927e69d022d510855c387d3bf4dfc5ae5498f8c3a728426c0db99cba0f74d665d43014995918a2e08650c7e1cd12a95fff17deb684a3b39c2790ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
eb89135d474ccc4b6551d2e5b5c0f7ee

SHA1
02489a04d72c38a2c8e6769ea44442e0173c5c72

SHA256
3d4840d7f3d1c83d241fec51d1789e72edc6ebaaa8c7fea999ab11cc46cef9c9

SHA512
b5c66873002c0453ef045c754e61a25ee190facaf663608e6b3ce61ce50f82ca28565d6635c32adcb2c00a6f275003677e9d81d18d3c3179e23dcad3a50c2ca3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
4KB

MD5
baf3a848774d0f212fcaf1313834e590

SHA1
96d61a304f4b740a9b73af23928810aea4f972a0

SHA256
52b422664b606b921416f0934803d8c1d2f889d0a564a6422de878772d1b7772

SHA512
7baecb0e5993539f2a97202366a69d18cdc1f500e8f51e51a4878435dfc90bfe92e686a7f69d20fe08474d1f20b83ef54a76f2191a0e6ecf40f5a73dec8f16f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57bb9f.TMP
Filesize
1KB

MD5
65f08bd9de2720da431ee86cc5ce48f5

SHA1
653541bf8eded0283def560d1639de154599ffb2

SHA256
9e5a2fee9ea5abc62fd7b87c5a8551bab8cd2ad855e4d54dd81bf7bf57338752

SHA512
163aea17d4aa265a1e33f00b05e2d4582b9af9d2abe361cf1a54f1a1d709440328803a397f3fdc41626940d76c4a735c213a9e9066a79a8c18ca131e77265455

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
d158a9dd5e07535b0d50ecea5a32d19f

SHA1
994991bb8d965e9da1c08cbec4771e8a465b96f9

SHA256
f74322ec44bc64e4ced7bae1c0c841724515642d0a33b8f714b6fcb9016935aa

SHA512
4ede9c5dfd3e9def581163d88d345770358c112bb397b059956d408b5e6d8ba4378f86028e6769ffbc926156a3b0ffd8eaa3ed9cf7ee205e7aa2d79ff17c29cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
7ed095894bc33a26898bd2b2cd1c78da

SHA1
8cde35bb905dc6a44905ae4fabb7e7394ba5d2b1

SHA256
675fd859be623c683636d12befce8a54ab7d0afaf997ed95438cea44487eb239

SHA512
08af3ed37053a43725d77aad518d2bdfa79eaf2d099fb4c93c05550908047e670a7e0b337dacf05d252c967a3273a75f8665ee6268664e67cb5ec69c994771bc

Download Submit
\??\pipe\LOCAL\crashpad_220_RYQIIVJUZXUFRTTD
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/4200-508-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/4200-509-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download