e66aa15e8cd1227dc654ef8f70b4cf0e6e7981c9fe410134b2e0912305e7f81d

Resubmissions

03/02/2024, 04:35

240203-e7tgmshcg88

03/02/2024, 04:28

240203-e36leabfcr6

03/02/2024, 04:15

240203-et7gcaghd73

Analysis

max time kernel
34s
max time network
149s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BloxFruits.jpg
Size 9KB
Sample240203-e36leabfcr
SHA256 e66aa15e8cd1227dc654ef8f70b4cf0e6e7981c9fe410134b2e0912305e7f81d
MD5 985421e822bf38d8d08076dfb841f64f
SHA1 d9c695a9a7685e17dc7dc2736c1dc2ade51c1fa5
SHA512 00fe19ee8dd19856b30d6f5da774c1c8ffcfd5f09a6f30f26aabb2aebc1c366317c205a2285a40d3a83d335d2756f7d671f626723c6a8d47428447f512d6cc58
SSDEEP 192:wYo8O47AWLvyv56EWbALNkL7dgBMoBr/v8e1QDbOP9qnu+4RkY+hKWF:wF8dAWLvYCOMoFE+QsAnmkYq
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
25	discord.com
26	discord.com
27	discord.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
648	reg.exe
1616	reg.exe
2336	reg.exe
3056	reg.exe
2944	reg.exe
2136	reg.exe
1096	reg.exe
2260	reg.exe
2172	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2348	chrome.exe
2348	chrome.exe

Suspicious use of AdjustPrivilegeToken 52 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
2128	rundll32.exe
2128	rundll32.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2372	2348	chrome.exe	29
PID 2348 wrote to memory of 2372	2348	chrome.exe	29
PID 2348 wrote to memory of 2372	2348	chrome.exe	29
PID 2348 wrote to memory of 1828	2348	chrome.exe	31
PID 2348 wrote to memory of 1828	2348	chrome.exe	31
PID 2348 wrote to memory of 1828	2348	chrome.exe	31
PID 2348 wrote to memory of 1828	2348	chrome.exe	31
PID 2348 wrote to memory of 1828	2348	chrome.exe	31
PID 2348 wrote to memory of 1828	2348	chrome.exe	31
PID 2348 wrote to memory of 1828	2348	chrome.exe	31
PID 2348 wrote to memory of 1828	2348	chrome.exe	31
PID 2348 wrote to memory of 1828	2348	chrome.exe	31
PID 2348 wrote to memory of 1828	2348	chrome.exe	31
PID 2348 wrote to memory of 1828	2348	chrome.exe	31
PID 2348 wrote to memory of 1828	2348	chrome.exe	31
PID 2348 wrote to memory of 1828	2348	chrome.exe	31
PID 2348 wrote to memory of 1828	2348	chrome.exe	31
PID 2348 wrote to memory of 1828	2348	chrome.exe	31
PID 2348 wrote to memory of 1828	2348	chrome.exe	31
PID 2348 wrote to memory of 1828	2348	chrome.exe	31
PID 2348 wrote to memory of 1828	2348	chrome.exe	31
PID 2348 wrote to memory of 1828	2348	chrome.exe	31
PID 2348 wrote to memory of 1828	2348	chrome.exe	31
PID 2348 wrote to memory of 1828	2348	chrome.exe	31
PID 2348 wrote to memory of 1828	2348	chrome.exe	31
PID 2348 wrote to memory of 1828	2348	chrome.exe	31
PID 2348 wrote to memory of 1828	2348	chrome.exe	31
PID 2348 wrote to memory of 1828	2348	chrome.exe	31
PID 2348 wrote to memory of 1828	2348	chrome.exe	31
PID 2348 wrote to memory of 1828	2348	chrome.exe	31
PID 2348 wrote to memory of 1828	2348	chrome.exe	31
PID 2348 wrote to memory of 1828	2348	chrome.exe	31
PID 2348 wrote to memory of 1828	2348	chrome.exe	31
PID 2348 wrote to memory of 1828	2348	chrome.exe	31
PID 2348 wrote to memory of 1828	2348	chrome.exe	31
PID 2348 wrote to memory of 1828	2348	chrome.exe	31
PID 2348 wrote to memory of 1828	2348	chrome.exe	31
PID 2348 wrote to memory of 1828	2348	chrome.exe	31
PID 2348 wrote to memory of 1828	2348	chrome.exe	31
PID 2348 wrote to memory of 1828	2348	chrome.exe	31
PID 2348 wrote to memory of 1828	2348	chrome.exe	31
PID 2348 wrote to memory of 1828	2348	chrome.exe	31
PID 2348 wrote to memory of 2740	2348	chrome.exe	32
PID 2348 wrote to memory of 2740	2348	chrome.exe	32
PID 2348 wrote to memory of 2740	2348	chrome.exe	32
PID 2348 wrote to memory of 2632	2348	chrome.exe	33
PID 2348 wrote to memory of 2632	2348	chrome.exe	33
PID 2348 wrote to memory of 2632	2348	chrome.exe	33
PID 2348 wrote to memory of 2632	2348	chrome.exe	33
PID 2348 wrote to memory of 2632	2348	chrome.exe	33
PID 2348 wrote to memory of 2632	2348	chrome.exe	33
PID 2348 wrote to memory of 2632	2348	chrome.exe	33
PID 2348 wrote to memory of 2632	2348	chrome.exe	33
PID 2348 wrote to memory of 2632	2348	chrome.exe	33
PID 2348 wrote to memory of 2632	2348	chrome.exe	33
PID 2348 wrote to memory of 2632	2348	chrome.exe	33
PID 2348 wrote to memory of 2632	2348	chrome.exe	33
PID 2348 wrote to memory of 2632	2348	chrome.exe	33
PID 2348 wrote to memory of 2632	2348	chrome.exe	33
PID 2348 wrote to memory of 2632	2348	chrome.exe	33
PID 2348 wrote to memory of 2632	2348	chrome.exe	33
PID 2348 wrote to memory of 2632	2348	chrome.exe	33
PID 2348 wrote to memory of 2632	2348	chrome.exe	33
PID 2348 wrote to memory of 2632	2348	chrome.exe	33

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\BloxFruits.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:2128

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7139758,0x7fef7139768,0x7fef7139778
  2⤵
  PID:2372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1124 --field-trial-handle=1292,i,284341523384549957,3397066865376217620,131072 /prefetch:2
  2⤵
  PID:1828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1500 --field-trial-handle=1292,i,284341523384549957,3397066865376217620,131072 /prefetch:8
  2⤵
  PID:2740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1608 --field-trial-handle=1292,i,284341523384549957,3397066865376217620,131072 /prefetch:8
  2⤵
  PID:2632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2320 --field-trial-handle=1292,i,284341523384549957,3397066865376217620,131072 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2312 --field-trial-handle=1292,i,284341523384549957,3397066865376217620,131072 /prefetch:1
  2⤵
  PID:2888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1344 --field-trial-handle=1292,i,284341523384549957,3397066865376217620,131072 /prefetch:2
  2⤵
  PID:2608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3012 --field-trial-handle=1292,i,284341523384549957,3397066865376217620,131072 /prefetch:1
  2⤵
  PID:584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3412 --field-trial-handle=1292,i,284341523384549957,3397066865376217620,131072 /prefetch:8
  2⤵
  PID:488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3420 --field-trial-handle=1292,i,284341523384549957,3397066865376217620,131072 /prefetch:8
  2⤵
  PID:892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3520 --field-trial-handle=1292,i,284341523384549957,3397066865376217620,131072 /prefetch:8
  2⤵
  PID:404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3700 --field-trial-handle=1292,i,284341523384549957,3397066865376217620,131072 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3764 --field-trial-handle=1292,i,284341523384549957,3397066865376217620,131072 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3720 --field-trial-handle=1292,i,284341523384549957,3397066865376217620,131072 /prefetch:8
  2⤵
  PID:1696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 --field-trial-handle=1292,i,284341523384549957,3397066865376217620,131072 /prefetch:8
  2⤵
  PID:1656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1412 --field-trial-handle=1292,i,284341523384549957,3397066865376217620,131072 /prefetch:8
  2⤵
  PID:2936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2700 --field-trial-handle=1292,i,284341523384549957,3397066865376217620,131072 /prefetch:8
  2⤵
  PID:2524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3496 --field-trial-handle=1292,i,284341523384549957,3397066865376217620,131072 /prefetch:8
  2⤵
  PID:2884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2352 --field-trial-handle=1292,i,284341523384549957,3397066865376217620,131072 /prefetch:8
  2⤵
  PID:240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2740 --field-trial-handle=1292,i,284341523384549957,3397066865376217620,131072 /prefetch:8
  2⤵
  PID:1636
- C:\Users\Admin\Downloads\DiscordSetup.exe
  "C:\Users\Admin\Downloads\DiscordSetup.exe"
  2⤵
  PID:1900
- - C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
    "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
    3⤵
    PID:1488
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9032\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9032\Discord.exe" --squirrel-install 1.0.9032
      4⤵
      PID:2404
    - - C:\Users\Admin\AppData\Local\Discord\Update.exe
        
        C:\Users\Admin\AppData\Local\Discord\Update.exe --createShortcut Discord.exe --setupIcon C:\Users\Admin\AppData\Local\Discord\app.ico
        5⤵
        
        PID:1844
    - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9032\Discord.exe
        
        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9032\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=1472 --field-trial-handle=1304,i,11045235777302946564,8277856958394584527,131072 --disable-features=HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
        5⤵
        
        PID:1600
    - - C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9032\Discord.exe\" --url -- \"%1\"" /f
        5⤵
        Modifies registry key
        
        PID:2944
    - - C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9032\Discord.exe\",-1" /f
        5⤵
        Modifies registry key
        
        PID:2136
    - - C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f
        5⤵
        Modifies registry key
        
        PID:1096
    - - C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f
        5⤵
        Modifies registry key
        
        PID:648
    - - C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord /d "\"C:\Users\Admin\AppData\Local\Discord\Update.exe\" --processStart Discord.exe" /f
        5⤵
        Modifies registry key
        
        PID:1616
    - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9032\Discord.exe
        
        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9032\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1148 --field-trial-handle=1304,i,11045235777302946564,8277856958394584527,131072 --disable-features=HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
        5⤵
        
        PID:2924
    - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9032\Discord.exe
        
        C:\Users\Admin\AppData\Local\Discord\app-1.0.9032\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9032 --annotation=plat=Win32 --annotation=prod=Electron --annotation=ver=22.3.26 --initial-client-data=0x374,0x378,0x37c,0x370,0x380,0x8f75d78,0x8f75d88,0x8f75d94
        5⤵
        
        PID:1052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3172 --field-trial-handle=1292,i,284341523384549957,3397066865376217620,131072 /prefetch:8
  2⤵
  PID:1984

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2044

C:\Users\Admin\AppData\Local\Discord\Update.exe
"C:\Users\Admin\AppData\Local\Discord\Update.exe" --processStart Discord.exe
1⤵
PID:2224
- C:\Users\Admin\AppData\Local\Discord\app-1.0.9032\Discord.exe
  "C:\Users\Admin\AppData\Local\Discord\app-1.0.9032\Discord.exe"
  2⤵
  PID:2684
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9032\Discord.exe
    C:\Users\Admin\AppData\Local\Discord\app-1.0.9032\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9032 --annotation=plat=Win32 --annotation=prod=Electron --annotation=ver=22.3.26 --initial-client-data=0x358,0x35c,0x360,0x354,0x364,0x8f75d78,0x8f75d88,0x8f75d94
    3⤵
    PID:276
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9032\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9032\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1124 --field-trial-handle=1272,i,13268431802630097706,17723823721104921972,131072 --disable-features=HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    PID:1668
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9032\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9032\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes --secure-schemes=disclip --bypasscsp-schemes --cors-schemes --fetch-schemes=disclip --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=1396 --field-trial-handle=1272,i,13268431802630097706,17723823721104921972,131072 --disable-features=HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
    3⤵
    PID:3000
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f
    3⤵
    - Modifies registry key
    PID:2260
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9032\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9032\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes --secure-schemes=disclip --bypasscsp-schemes --cors-schemes --fetch-schemes=disclip --service-worker-schemes --streaming-schemes --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9032\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=1912 --field-trial-handle=1272,i,13268431802630097706,17723823721104921972,131072 --disable-features=HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
    3⤵
    PID:1748
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f
    3⤵
    - Modifies registry key
    PID:2172
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9032\Discord.exe\",-1" /f
    3⤵
    - Modifies registry key
    PID:2336
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9032\Discord.exe\" --url -- \"%1\"" /f
    3⤵
    - Modifies registry key
    PID:3056
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9032\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9032\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1124 --field-trial-handle=1272,i,13268431802630097706,17723823721104921972,131072 --disable-features=HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

070E0202839D9D67350CD2613E78E416

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416
Size 1KB
SHA256 d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
MD5 55540a230bdab55187a841cfe1aa1545
SHA1 363e4734f757bdeb89868efe94907774a327695e
SHA512 c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54
MD5 SHA1 SHA512

Submit Download

070E0202839D9D67350CD2613E78E416

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416
Size 230B
SHA256 bd90a134979c5a4ab4464a6633cd78c43c3177ef98b832221be8347be15344d3
MD5 bd267cd22c770258683734af4ad12246
SHA1 d77d45449a7f8ba70546bce909e0f910dd5529c0
SHA512 484c98d1f80905668ab709dd8d34ef2f1a76d67a93441fa4ca115b1cd1faab6e7c9bb8fcb1459c635b03cd9c04da56902d0c8a809f5cfac8f60f54f2d6ea76fb
MD5 SHA1 SHA512

Submit Download