discordrat | hxxps://cdn[.]discordapp[.]com/attachments/1221895306933833802/1221914989120458845/Client-built[.]rar?ex=66145003&is=6601db03&hm=24212dc7c96b732376241577ae870f3f6f7b9f236eae7b76935274d9191d84ad&

Analysis

max time kernel
373s
max time network
379s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
25-03-2024 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1221895306933833802/1221914989120458845/Client-built.rar?ex=66145003&is=6601db03&hm=24212dc7c96b732376241577ae870f3f6f7b9f236eae7b76935274d9191d84ad&

Score

10^/10

discordrat evasion persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIyMTkxMzUyNTI5MTg0MzY4NQ.GEtd5_.rb7YDE3upMpw8BvRznWpPabhFHSx5LUwoSbtkA
server_id
1221895306120265778

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Disables Task Manager via registry modification
evasion

Executes dropped EXE 1 IoCs

pid	Process
2572	Client-built.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs

Web Service

T1102

flow	ioc
114	discord.com
136	discord.com
164	discord.com
172	discord.com
173	discord.com
113	discord.com
138	discord.com
160	discord.com
161	discord.com
137	discord.com
139	discord.com
159	discord.com
163	discord.com
120	discord.com

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-817259280-2658881748-983986378-1000\{F41D7275-9A47-4D89-BB3B-1B52481DD57F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
2916	msedge.exe
2916	msedge.exe
3656	msedge.exe
3656	msedge.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
2308	taskmgr.exe
2308	taskmgr.exe
2308	taskmgr.exe
2308	taskmgr.exe
2308	taskmgr.exe
2308	taskmgr.exe
432	taskmgr.exe
432	taskmgr.exe
432	taskmgr.exe
432	taskmgr.exe
432	taskmgr.exe
432	taskmgr.exe
432	taskmgr.exe
432	taskmgr.exe
432	taskmgr.exe
432	taskmgr.exe
432	taskmgr.exe
432	taskmgr.exe
432	taskmgr.exe
432	taskmgr.exe
432	taskmgr.exe
432	taskmgr.exe
432	taskmgr.exe
432	taskmgr.exe
432	taskmgr.exe
432	taskmgr.exe
432	taskmgr.exe
432	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeRestorePrivilege	3680	7zG.exe
Token: 35	3680	7zG.exe
Token: SeSecurityPrivilege	3680	7zG.exe
Token: SeSecurityPrivilege	3680	7zG.exe
Token: SeDebugPrivilege	2572	Client-built.exe
Token: SeDebugPrivilege	5100	taskmgr.exe
Token: SeSystemProfilePrivilege	5100	taskmgr.exe
Token: SeCreateGlobalPrivilege	5100	taskmgr.exe
Token: 33	5100	taskmgr.exe
Token: SeIncBasePriorityPrivilege	5100	taskmgr.exe
Token: SeDebugPrivilege	2308	taskmgr.exe
Token: SeSystemProfilePrivilege	2308	taskmgr.exe
Token: SeCreateGlobalPrivilege	2308	taskmgr.exe
Token: 33	2308	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2308	taskmgr.exe
Token: SeDebugPrivilege	432	taskmgr.exe
Token: SeSystemProfilePrivilege	432	taskmgr.exe
Token: SeCreateGlobalPrivilege	432	taskmgr.exe
Token: 33	432	taskmgr.exe
Token: SeIncBasePriorityPrivilege	432	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3680	7zG.exe
2572	Client-built.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
2308	taskmgr.exe
2308	taskmgr.exe
2308	taskmgr.exe
2308	taskmgr.exe
2308	taskmgr.exe
2308	taskmgr.exe
2308	taskmgr.exe
2308	taskmgr.exe
2308	taskmgr.exe
2308	taskmgr.exe
2308	taskmgr.exe
2308	taskmgr.exe
2308	taskmgr.exe
2308	taskmgr.exe
2308	taskmgr.exe
2308	taskmgr.exe
2308	taskmgr.exe
2308	taskmgr.exe
2308	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
5100	taskmgr.exe
2308	taskmgr.exe
2308	taskmgr.exe
2308	taskmgr.exe
2308	taskmgr.exe
2308	taskmgr.exe
2308	taskmgr.exe
2308	taskmgr.exe
2308	taskmgr.exe
2308	taskmgr.exe
2308	taskmgr.exe
2308	taskmgr.exe
2308	taskmgr.exe
2308	taskmgr.exe
2308	taskmgr.exe
2308	taskmgr.exe
2308	taskmgr.exe
2308	taskmgr.exe
2308	taskmgr.exe
2308	taskmgr.exe
2308	taskmgr.exe
2308	taskmgr.exe
2308	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2812	2916	msedge.exe	116
PID 2916 wrote to memory of 2812	2916	msedge.exe	116
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3552	2916	msedge.exe	117
PID 2916 wrote to memory of 3676	2916	msedge.exe	118
PID 2916 wrote to memory of 3676	2916	msedge.exe	118
PID 2916 wrote to memory of 756	2916	msedge.exe	119
PID 2916 wrote to memory of 756	2916	msedge.exe	119
PID 2916 wrote to memory of 756	2916	msedge.exe	119
PID 2916 wrote to memory of 756	2916	msedge.exe	119
PID 2916 wrote to memory of 756	2916	msedge.exe	119
PID 2916 wrote to memory of 756	2916	msedge.exe	119
PID 2916 wrote to memory of 756	2916	msedge.exe	119
PID 2916 wrote to memory of 756	2916	msedge.exe	119
PID 2916 wrote to memory of 756	2916	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1221895306933833802/1221914989120458845/Client-built.rar?ex=66145003&is=6601db03&hm=24212dc7c96b732376241577ae870f3f6f7b9f236eae7b76935274d9191d84ad&
1⤵
PID:2772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=4564 --field-trial-handle=2264,i,1475924722205134884,16549311107360026087,262144 --variations-seed-version /prefetch:1
1⤵
PID:2780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=5972 --field-trial-handle=2264,i,1475924722205134884,16549311107360026087,262144 --variations-seed-version /prefetch:1
1⤵
PID:4876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=6000 --field-trial-handle=2264,i,1475924722205134884,16549311107360026087,262144 --variations-seed-version /prefetch:8
1⤵
PID:4908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --no-appcompat-clear --mojo-platform-channel-handle=5932 --field-trial-handle=2264,i,1475924722205134884,16549311107360026087,262144 --variations-seed-version /prefetch:8
1⤵
PID:2316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --mojo-platform-channel-handle=6248 --field-trial-handle=2264,i,1475924722205134884,16549311107360026087,262144 --variations-seed-version /prefetch:1
1⤵
PID:3440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6528 --field-trial-handle=2264,i,1475924722205134884,16549311107360026087,262144 --variations-seed-version /prefetch:8
1⤵
PID:2840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=6732 --field-trial-handle=2264,i,1475924722205134884,16549311107360026087,262144 --variations-seed-version /prefetch:8
1⤵
PID:3780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --mojo-platform-channel-handle=3868 --field-trial-handle=2264,i,1475924722205134884,16549311107360026087,262144 --variations-seed-version /prefetch:1
1⤵
PID:4904

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2916

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Client-built\" -spe -an -ai#7zMap16499:86:7zEvent23458
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6496 --field-trial-handle=2264,i,1475924722205134884,16549311107360026087,262144 --variations-seed-version /prefetch:8
1⤵
PID:1768

C:\Users\Admin\Downloads\Client-built\Client-built.exe
"C:\Users\Admin\Downloads\Client-built\Client-built.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2572
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C wininit
  2⤵
  PID:4620
- - C:\Windows\system32\wininit.exe
    wininit
    3⤵
    PID:5008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.129 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.92 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b0,0x7ffab98e5fd8,0x7ffab98e5fe4,0x7ffab98e5ff0
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2656 --field-trial-handle=2660,i,1557710908336684161,16532508875530012860,262144 --variations-seed-version /prefetch:2
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3380 --field-trial-handle=2660,i,1557710908336684161,16532508875530012860,262144 --variations-seed-version /prefetch:3
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3504 --field-trial-handle=2660,i,1557710908336684161,16532508875530012860,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.92\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.92\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4360 --field-trial-handle=2660,i,1557710908336684161,16532508875530012860,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.92\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.92\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4360 --field-trial-handle=2660,i,1557710908336684161,16532508875530012860,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4616 --field-trial-handle=2660,i,1557710908336684161,16532508875530012860,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --mojo-platform-channel-handle=4900 --field-trial-handle=2660,i,1557710908336684161,16532508875530012860,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5044 --field-trial-handle=2660,i,1557710908336684161,16532508875530012860,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5308 --field-trial-handle=2660,i,1557710908336684161,16532508875530012860,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5460 --field-trial-handle=2660,i,1557710908336684161,16532508875530012860,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5616 --field-trial-handle=2660,i,1557710908336684161,16532508875530012860,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4660 --field-trial-handle=2660,i,1557710908336684161,16532508875530012860,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4720 --field-trial-handle=2660,i,1557710908336684161,16532508875530012860,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5496 --field-trial-handle=2660,i,1557710908336684161,16532508875530012860,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2156 --field-trial-handle=2660,i,1557710908336684161,16532508875530012860,262144 --variations-seed-version /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1388 --field-trial-handle=2660,i,1557710908336684161,16532508875530012860,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:2036

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5100

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2308

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:2740

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:432

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:1520

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\New Text Document.txt
1⤵
PID:4332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
d2fb266b97caff2086bf0fa74eddb6b2

SHA1
2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

SHA256
b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

SHA512
c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
944B

MD5
6bd369f7c74a28194c991ed1404da30f

SHA1
0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

SHA256
878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

SHA512
8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
a6fcd5c66a2117404546c0723e9deb07

SHA1
0d282bd9120e29f8605b5000ab240da08e64c321

SHA256
2dcc050f0bea23655c1449b4a6d5808d9b9a6b7011530650668b781a3ec3f499

SHA512
9272b491fa12536fcad0549bbe4557fcb9ea670819108abbde7aeae50c59fa2fde495aa41b0f0d580c06292b82087bb02520701267346b2481793dd684356eff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old

Filesize
334B

MD5
4358fbaa705eead9559f1bf3e4720be0

SHA1
c1b4f1f686364c89a8bde6054f3370a76b584a34

SHA256
7a02e4e12f071cb9888c12c5036806012d9fc6c031d442b03854842796be2682

SHA512
f46be773c0edb0ff775787b98e6868d3c6f222e1e7f6429950e5244e99248b73599973f72daa8dbb53f0d53a3e628f268b3e8ac0a906a3b88e92e4629864d952

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
594acb50c6e866abb3ab19411a214a76

SHA1
bcf66e99d4676951351037d8a3f6de4e014ede61

SHA256
45ccf07e4554fc68c3a66b09199e8dc34dceef9758c56fbebd1e12c64e95e6bf

SHA512
d4c15ded120ff0e1c8cdeaf42225dd8d2b7c9857c35b2153238e8740564a2e9773962003e502e589b071e4f73f85b79907965c345dcbdb536440bc66f8939455

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
b165045b86fa341c3841fd3d50b4f634

SHA1
270909a3d86bbba85569d9444480b9cada419ad6

SHA256
656eb97ab4848ed5bd067243242483e320fb03160b267dcc983f9755bbf03e76

SHA512
79316a46654218649cc9db3c2369e51baac7f4b4cbbdcd8442e716d48a7bf29944a1134663c35214fafb70be3df04044cae082529efe28cb64896a61c4fb1c61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
70KB

MD5
e3f5ce397701190a5561a6351302faa8

SHA1
093fd753212583898940d0051a2ae0e2033dde56

SHA256
860a645f087c41926e3f678d5714542266a6a732ad7447189dc8ddc4002c8714

SHA512
52dc91f7ac5085247ec1b410795f0fca0430f7712b8497666583aba42c44a8be89de4581afa09cad31d297504d83d13eadf357b26d24de7b5d6f23d6b1bd51e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
61KB

MD5
683e1643ac2ad44852e37e3860f459bc

SHA1
cf98ada699615313e2ff885e00356c38c6724c96

SHA256
26dc0e4e44d505f1d68329951e82f0453e8b4b036c8c46bc6e6bead3e346ad5a

SHA512
ae59dc8a421fa0b72981d1e64e83f73ae421ef9f4dac2e713aa9779222d071962ea92a14d8beffb3583a5d8af06b603750d445b52d8164ce73a6803a2b29e764

Download Submit
C:\Users\Admin\Downloads\Client-built\Client-built.exe

Filesize
78KB

MD5
6c0def2fa807c96b64833f6f9372cacd

SHA1
3a02b8bb4426a979d1946fe601700a8afb920e05

SHA256
493cee2ab73ae407d1f4b68ebefc960d5b8a4941de451f3dfb6de820d35c8b7c

SHA512
893826eba777279ae09344a50d532f38047d42419f7dae1badf9a0ef3996feef163d5091bb1b17641929cf859853dd0b5ef0ef9d8f9a1f68a3245c5affe62697

Download Submit
memory/2572-91-0x00007FFABF7D0000-0x00007FFAC0291000-memory.dmp

Filesize
10.8MB

Download
memory/2572-12-0x0000014478030000-0x0000014478558000-memory.dmp

Filesize
5.2MB

Download
memory/2572-4-0x000001445C3A0000-0x000001445C3B8000-memory.dmp

Filesize
96KB

Download
memory/2572-5-0x0000014476BB0000-0x0000014476D72000-memory.dmp

Filesize
1.8MB

Download
memory/2572-6-0x00007FFABF7D0000-0x00007FFAC0291000-memory.dmp

Filesize
10.8MB

Download
memory/2572-92-0x000001445C7C0000-0x000001445C7D0000-memory.dmp

Filesize
64KB

Download
memory/2572-7-0x000001445C7C0000-0x000001445C7D0000-memory.dmp

Filesize
64KB

Download
memory/5100-154-0x0000028C57EF0000-0x0000028C57EF1000-memory.dmp

Filesize
4KB

Download
memory/5100-157-0x0000028C57EF0000-0x0000028C57EF1000-memory.dmp

Filesize
4KB

Download
memory/5100-158-0x0000028C57EF0000-0x0000028C57EF1000-memory.dmp

Filesize
4KB

Download
memory/5100-159-0x0000028C57EF0000-0x0000028C57EF1000-memory.dmp

Filesize
4KB

Download
memory/5100-160-0x0000028C57EF0000-0x0000028C57EF1000-memory.dmp

Filesize
4KB

Download
memory/5100-156-0x0000028C57EF0000-0x0000028C57EF1000-memory.dmp

Filesize
4KB

Download
memory/5100-155-0x0000028C57EF0000-0x0000028C57EF1000-memory.dmp

Filesize
4KB

Download
memory/5100-150-0x0000028C57EF0000-0x0000028C57EF1000-memory.dmp

Filesize
4KB

Download
memory/5100-149-0x0000028C57EF0000-0x0000028C57EF1000-memory.dmp

Filesize
4KB

Download
memory/5100-148-0x0000028C57EF0000-0x0000028C57EF1000-memory.dmp

Filesize
4KB

Download