discordrat | hxxps://pixeldrain[.]com/u/ov7MWx8h

Analysis

max time kernel
156s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-03-2024 16:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://pixeldrain.com/u/ov7MWx8h

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIxNjc0OTI2MDYyODgyMDE1OA.G8734r.OQz-OXe_uZmEAeWMnccQe4M_M012iMadcEWrcg
server_id
1216749260628820158

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Downloads MZ/PE file

Executes dropped EXE 6 IoCs

pid	Process
1068	Client-built.exe
1476	Client-built.exe
856	Client-built.exe
3972	Client-built.exe
2720	Client-built.exe
2444	Client-built.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 963565.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
3608	msedge.exe
3608	msedge.exe
2312	msedge.exe
2312	msedge.exe
3548	identity_helper.exe
3548	identity_helper.exe
5048	msedge.exe
5048	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	1476	Client-built.exe
Token: SeDebugPrivilege	1068	Client-built.exe
Token: SeDebugPrivilege	856	Client-built.exe
Token: SeDebugPrivilege	3972	Client-built.exe
Token: SeDebugPrivilege	2720	Client-built.exe
Token: SeDebugPrivilege	2444	Client-built.exe
Token: SeDebugPrivilege	2924	taskmgr.exe
Token: SeSystemProfilePrivilege	2924	taskmgr.exe
Token: SeCreateGlobalPrivilege	2924	taskmgr.exe
Token: 33	2924	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2924	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe
2924	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 3008	2312	msedge.exe	85
PID 2312 wrote to memory of 3008	2312	msedge.exe	85
PID 2312 wrote to memory of 1936	2312	msedge.exe	86
PID 2312 wrote to memory of 1936	2312	msedge.exe	86
PID 2312 wrote to memory of 1936	2312	msedge.exe	86
PID 2312 wrote to memory of 1936	2312	msedge.exe	86
PID 2312 wrote to memory of 1936	2312	msedge.exe	86
PID 2312 wrote to memory of 1936	2312	msedge.exe	86
PID 2312 wrote to memory of 1936	2312	msedge.exe	86
PID 2312 wrote to memory of 1936	2312	msedge.exe	86
PID 2312 wrote to memory of 1936	2312	msedge.exe	86
PID 2312 wrote to memory of 1936	2312	msedge.exe	86
PID 2312 wrote to memory of 1936	2312	msedge.exe	86
PID 2312 wrote to memory of 1936	2312	msedge.exe	86
PID 2312 wrote to memory of 1936	2312	msedge.exe	86
PID 2312 wrote to memory of 1936	2312	msedge.exe	86
PID 2312 wrote to memory of 1936	2312	msedge.exe	86
PID 2312 wrote to memory of 1936	2312	msedge.exe	86
PID 2312 wrote to memory of 1936	2312	msedge.exe	86
PID 2312 wrote to memory of 1936	2312	msedge.exe	86
PID 2312 wrote to memory of 1936	2312	msedge.exe	86
PID 2312 wrote to memory of 1936	2312	msedge.exe	86
PID 2312 wrote to memory of 1936	2312	msedge.exe	86
PID 2312 wrote to memory of 1936	2312	msedge.exe	86
PID 2312 wrote to memory of 1936	2312	msedge.exe	86
PID 2312 wrote to memory of 1936	2312	msedge.exe	86
PID 2312 wrote to memory of 1936	2312	msedge.exe	86
PID 2312 wrote to memory of 1936	2312	msedge.exe	86
PID 2312 wrote to memory of 1936	2312	msedge.exe	86
PID 2312 wrote to memory of 1936	2312	msedge.exe	86
PID 2312 wrote to memory of 1936	2312	msedge.exe	86
PID 2312 wrote to memory of 1936	2312	msedge.exe	86
PID 2312 wrote to memory of 1936	2312	msedge.exe	86
PID 2312 wrote to memory of 1936	2312	msedge.exe	86
PID 2312 wrote to memory of 1936	2312	msedge.exe	86
PID 2312 wrote to memory of 1936	2312	msedge.exe	86
PID 2312 wrote to memory of 1936	2312	msedge.exe	86
PID 2312 wrote to memory of 1936	2312	msedge.exe	86
PID 2312 wrote to memory of 1936	2312	msedge.exe	86
PID 2312 wrote to memory of 1936	2312	msedge.exe	86
PID 2312 wrote to memory of 1936	2312	msedge.exe	86
PID 2312 wrote to memory of 1936	2312	msedge.exe	86
PID 2312 wrote to memory of 3608	2312	msedge.exe	87
PID 2312 wrote to memory of 3608	2312	msedge.exe	87
PID 2312 wrote to memory of 384	2312	msedge.exe	88
PID 2312 wrote to memory of 384	2312	msedge.exe	88
PID 2312 wrote to memory of 384	2312	msedge.exe	88
PID 2312 wrote to memory of 384	2312	msedge.exe	88
PID 2312 wrote to memory of 384	2312	msedge.exe	88
PID 2312 wrote to memory of 384	2312	msedge.exe	88
PID 2312 wrote to memory of 384	2312	msedge.exe	88
PID 2312 wrote to memory of 384	2312	msedge.exe	88
PID 2312 wrote to memory of 384	2312	msedge.exe	88
PID 2312 wrote to memory of 384	2312	msedge.exe	88
PID 2312 wrote to memory of 384	2312	msedge.exe	88
PID 2312 wrote to memory of 384	2312	msedge.exe	88
PID 2312 wrote to memory of 384	2312	msedge.exe	88
PID 2312 wrote to memory of 384	2312	msedge.exe	88
PID 2312 wrote to memory of 384	2312	msedge.exe	88
PID 2312 wrote to memory of 384	2312	msedge.exe	88
PID 2312 wrote to memory of 384	2312	msedge.exe	88
PID 2312 wrote to memory of 384	2312	msedge.exe	88
PID 2312 wrote to memory of 384	2312	msedge.exe	88
PID 2312 wrote to memory of 384	2312	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pixeldrain.com/u/ov7MWx8h
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc96ae46f8,0x7ffc96ae4708,0x7ffc96ae4718
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,7113212161832433302,9658541532542869146,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,7113212161832433302,9658541532542869146,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,7113212161832433302,9658541532542869146,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7113212161832433302,9658541532542869146,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7113212161832433302,9658541532542869146,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,7113212161832433302,9658541532542869146,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,7113212161832433302,9658541532542869146,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7113212161832433302,9658541532542869146,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7113212161832433302,9658541532542869146,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7113212161832433302,9658541532542869146,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7113212161832433302,9658541532542869146,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2112,7113212161832433302,9658541532542869146,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7113212161832433302,9658541532542869146,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2112,7113212161832433302,9658541532542869146,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7113212161832433302,9658541532542869146,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2112,7113212161832433302,9658541532542869146,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6428 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5048
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1068
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1476
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,7113212161832433302,9658541532542869146,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6484 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4056

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1676

C:\Users\Admin\Downloads\Client-built.exe
"C:\Users\Admin\Downloads\Client-built.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3972

C:\Users\Admin\Downloads\Client-built.exe
"C:\Users\Admin\Downloads\Client-built.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2720

C:\Users\Admin\Downloads\Client-built.exe
"C:\Users\Admin\Downloads\Client-built.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2444

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4d6e17218d9a99976d1a14c6f6944c96

SHA1
9e54a19d6c61d99ac8759c5f07b2f0d5faab447f

SHA256
32e343d2794af8bc6f2f7c905b5df11d53db4ad8922b92ad5e7cc9c856509d93

SHA512
3fa166b3e2d1236298d8dda7071a6fcf2bde283f181b8b0a07c0bb8ba756d6f55fa8a847ca5286d4dbabc6dace67e842a118866320ac01bd5f93cccd3a032e47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
881ada65b2e85dc60f792283e2dff46f

SHA1
0e0078ce92d8891b3c64471e968171abcadbf1fd

SHA256
d22ec76225f7972543476ffff5ea2a665e642dc5c44f86f1c7a368b021443c4c

SHA512
83cab26c8caadb97147244379aab6f4d3a26421eb9e7750c7bc10d56d4c1c64f51a91b3bd4859860d9bffb841d0bb5e85cd9a60c6d08940c65961f8ceb44f3c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
de2ee82ca4d9451f420792aab7b8df21

SHA1
df9d0ec84fd2684ab355340c166553b15da02344

SHA256
db68e4f1036d4f71eb8d3d9fe2d60b8138486fe2b8faf8ab8d498e75fb06c365

SHA512
202f01b1ef440bcd97ac42b7f3f1ad0e4d983df5ea8eaf2afe35c11863bcb77664bf62e42ab95f7c62d12d98714dc741ff1d156044d64f10abea56ff2254fa93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2ec5ba8d64ba9e8c5e0fd1bdfacc6793

SHA1
baf21e7cbf9e60fb0bd71ae12ecb07f6fdeb7675

SHA256
96bed6ef2d72e6e3eb020e0e93b1879676cfb1c7110671cd6643730903f6e332

SHA512
056cf4674ee17c52d84540ebdeb00b1e8950e45b880bc30e411c3e4af450292b7b3d345e2686c54c64de6cc8c8132e3f39098d1ce481ade5d4ef96e5e398270e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5cba0328eb923085f3e3d179856dc6a9

SHA1
9918ddd7dca735c2050a4bf83045c89243e72bb5

SHA256
aaaf77b150384972feefe8f436da0cb2c220582d0c056727d7c89e6e16dd4753

SHA512
b8d59d4f3f7c27428d44474230eae081477957101af410d4e155f5b0c4d114719523f0357b2a784596713ad2c36c757aa92f845090f1a341f24fb7b237ff3b54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
c2ef1d773c3f6f230cedf469f7e34059

SHA1
e410764405adcfead3338c8d0b29371fd1a3f292

SHA256
185450d538a894e4dcf55b428f506f3d7baa86664fbbc67afd6c255b65178521

SHA512
2ef93803da4d630916bed75d678382fd1c72bff1700a1a72e2612431c6d5e11410ced4eaf522b388028aeadb08e8a77513e16594e6ab081f6d6203e4caa7d549

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
f0d9216ba326a44abea65d8ba6d09152

SHA1
c03752ebcdf0036e7a8c8f9adb70301ec444630c

SHA256
24134ed12a139819aefe9da2d933c41e79fa0060f086354703678d740918f604

SHA512
5dee6384cf2e88febe9da0bc92983249306bf7e7abaae84602fa860031674c12dbaf3fd8d02d16b016e41f9defe11e5f7104e596e4b414056181294e99a9e438

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
9bfd460ce4451ff0e076a73f6903ce5f

SHA1
1cb07dff1e79b332a2a31f31ea14e3c53a891c7f

SHA256
2e8dfdf187edfae6e695e1c312f99e4f00e4373386ae2754b1606b9b9eb2fc6c

SHA512
c9c02bd608351f0f0453981bc88452ba9177d1f169bc5437cba65d069b228ec6756e732648080cb5c3a558190a1e26a11611ac845016ded97add0f22500006af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
1f75faf5f3ad8c47677154a6bacaf4f7

SHA1
72e5b34e7ee3c5763f3f851b86391f8a9838ccd5

SHA256
d5c9a691d5bf11d2e6b27e717869e958167173664a46983a5fafebb7eb535a62

SHA512
cf57cc9c7bff6a616476961355c84ef5b41f8f19a9c9e1afa9d720940f77c00c78d0f8d5833bc50feb3b77414a7d5e90b62f1d32694845356e326f1bc406c92f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
669554af53691b90d8e42867bdac1e20

SHA1
bb0991f7dc4b86d95ec189f300ae62c7384fcc27

SHA256
a2e88e4e8f333e4b0a1f19077248069100c67e5b374c10fb8c940cb3bf085af3

SHA512
42f626fb7668440648b7b84eaa678509105b4e621b823dca205b22e24d5b4953234e9f4d4562f522b0179f2cfd86f247a7c0fb13bee700e4466aec8fcab16ac4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
6c4c88f6cd42751c1aeb66d8eb801317

SHA1
dfe836ec95d442fea7dc0335b25deb025dccce93

SHA256
2a3386b41036b6e26c3b58d645126f4630755bdaf4ebd2520252240c6c6645d6

SHA512
dcddf8bb7b8100b4649acc3acf44c03ed974fc9181132c02be86240f5f48fd6b1a2eadebfe20a015774cfa6d3fa8c76b03794f599124f5d29027f3647b176a06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
f69a29199624298b168eeb35ac4695ea

SHA1
e97607df2132c1943e51426938b70ef5c349b387

SHA256
cd4fd6687a207ec81eb3b80705201d75240c0933982bffa2e8fa3d40a64ecd03

SHA512
6f8cf319a22d4489423e5f6e2f75fc14b6b1fdbfd2e892e0e3674c7b88f2527f79ecc7fe36e864576904c5f1361b12450fb5c8ded8464e2a27b2bcbef3f35465

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
a186057cbd154387bbbdc36fd7ee4916

SHA1
da7f2397b38d0a7fe5304676942491c2d0800dac

SHA256
6670e67555f75b6d32f33e3a983ad9352d03141ebe0917e30b134f19dcfb7b3e

SHA512
5ef34047aa70bee0683f5100ed848f7f9ee4fa3e214a672b4c6065343f01e055dd44ca9e93d6d70b0e662377ee85fc6e7da2acccd240bd3e15b16e09389ee35c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
918601bea4328639b2dcf32608659fc2

SHA1
6feff5755ce68b8de43a4b92beb14164cdb77b47

SHA256
2610ddc0de8d00d57bf693973c9f712ca7c9227ab6b50af7a76b142c14f49021

SHA512
716cc994d9fbb26b36971e67de8bb41dde14a19ae20ce11f44ddf5ffaedbe6497c414992e2608be6147fd51c71c78b69a3e038124569d4491f1ee7e594658537

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe579de6.TMP

Filesize
204B

MD5
b73a6d092cb239a8f76aeab182de724a

SHA1
03bea888842ff048fb1647169c507c2d16468421

SHA256
b7da7873029a96f5c6488bb874a840bd090ddedaed4696f28be0707e9250f59b

SHA512
236f9855ae06e6c31339ea3e0ec29c67c5058bc12006e4cd2f3cde8a2bba6eb6e9a8d9947f214a539a8eede8b7a2c28225b718b52666b15b2dd3e188748deeda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c0b3c287-1d45-4981-a8ea-a8307647fd45.tmp

Filesize
182B

MD5
9eb9d67f919ae153884991ffc5223fdb

SHA1
8ebbb1a763b529cc9bf2839b13f0564f10d10046

SHA256
08e4c57ce93d9bce050befa4e516d8aca239010d22692f90ea30a39ba91a1d40

SHA512
9aad23e77ff458c7b49381fec4e0c650172314e46cdae969744d948f67eabb8ee25e2d04f6d81d43bc97f2d704fabc43b4b63ece97a14f09fde78c59132a003b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2aee28669791721f2f4aad7d9e89d705

SHA1
033a75e5b2023aa84b0744c347dc1e8c85c67e74

SHA256
e3ed374f21faba9e936f12dc5c48d245c44959d2a567cce4ff078031bd0c6205

SHA512
36dac521022b01152669e362c45b7614d0cf4422de39c6fa97fa2f580c2a29ac9794265d2c0480f276a83ff7d9d1f7ba75db07ce862f0d7002741dffdb1a021f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
50e0d3ebee454c46ea869b8bc4c357d6

SHA1
6b7da00ccb616b5745a5269e0ee7372a32bdd68c

SHA256
4b215281938278be92977e3a1d40bd9079263f1c464a2e5f36e9244ea4b5d069

SHA512
c6615588bcdd4d76dc6bc184a35d354782c3a1b115f598e9f4e7a08a0e814e5139a9633a6cff8d56406bbb77a31694150a62a277fd0d150ddd5ccafeb30f6085

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 963565.crdownload

Filesize
78KB

MD5
545299d764769e113478f9c56b51515d

SHA1
000727958d4d3cc5a2f699501f46824ae7522136

SHA256
557e4785d3383f28b001f944aa19783384346640efa6eb67e5f3b77b94b21569

SHA512
11a7ccaea059d85bd8fdd37cd967a0420e22811299411c1acb896e6f9bad9303dd74475d02021a375bcde97d3fa71d1ae0be5095d316f50cd240642ba325ea87

Download Submit
memory/856-158-0x00007FFC844F0000-0x00007FFC84FB1000-memory.dmp

Filesize
10.8MB

Download
memory/856-160-0x00000219D5AA0000-0x00000219D5AB0000-memory.dmp

Filesize
64KB

Download
memory/856-187-0x00000219D5AA0000-0x00000219D5AB0000-memory.dmp

Filesize
64KB

Download
memory/856-184-0x00007FFC844F0000-0x00007FFC84FB1000-memory.dmp

Filesize
10.8MB

Download
memory/1068-117-0x00000194CDD60000-0x00000194CDD70000-memory.dmp

Filesize
64KB

Download
memory/1068-116-0x00007FFC844F0000-0x00007FFC84FB1000-memory.dmp

Filesize
10.8MB

Download
memory/1068-113-0x00000194CC160000-0x00000194CC178000-memory.dmp

Filesize
96KB

Download
memory/1068-114-0x00000194E6870000-0x00000194E6A32000-memory.dmp

Filesize
1.8MB

Download
memory/1068-163-0x00000194CDD60000-0x00000194CDD70000-memory.dmp

Filesize
64KB

Download
memory/1068-120-0x00000194E7CF0000-0x00000194E8218000-memory.dmp

Filesize
5.2MB

Download
memory/1068-159-0x00007FFC844F0000-0x00007FFC84FB1000-memory.dmp

Filesize
10.8MB

Download
memory/1476-164-0x000001BB4A510000-0x000001BB4A520000-memory.dmp

Filesize
64KB

Download
memory/1476-119-0x00007FFC844F0000-0x00007FFC84FB1000-memory.dmp

Filesize
10.8MB

Download
memory/1476-118-0x000001BB4A510000-0x000001BB4A520000-memory.dmp

Filesize
64KB

Download
memory/1476-165-0x00007FFC844F0000-0x00007FFC84FB1000-memory.dmp

Filesize
10.8MB

Download
memory/2444-254-0x00007FFC844F0000-0x00007FFC84FB1000-memory.dmp

Filesize
10.8MB

Download
memory/2444-290-0x00007FFC844F0000-0x00007FFC84FB1000-memory.dmp

Filesize
10.8MB

Download
memory/2720-193-0x00007FFC844F0000-0x00007FFC84FB1000-memory.dmp

Filesize
10.8MB

Download
memory/2720-240-0x00007FFC844F0000-0x00007FFC84FB1000-memory.dmp

Filesize
10.8MB

Download
memory/2924-277-0x0000026846AF0000-0x0000026846AF1000-memory.dmp

Filesize
4KB

Download
memory/2924-276-0x0000026846AF0000-0x0000026846AF1000-memory.dmp

Filesize
4KB

Download
memory/2924-275-0x0000026846AF0000-0x0000026846AF1000-memory.dmp

Filesize
4KB

Download
memory/2924-281-0x0000026846AF0000-0x0000026846AF1000-memory.dmp

Filesize
4KB

Download
memory/2924-282-0x0000026846AF0000-0x0000026846AF1000-memory.dmp

Filesize
4KB

Download
memory/2924-283-0x0000026846AF0000-0x0000026846AF1000-memory.dmp

Filesize
4KB

Download
memory/2924-284-0x0000026846AF0000-0x0000026846AF1000-memory.dmp

Filesize
4KB

Download
memory/2924-285-0x0000026846AF0000-0x0000026846AF1000-memory.dmp

Filesize
4KB

Download
memory/2924-286-0x0000026846AF0000-0x0000026846AF1000-memory.dmp

Filesize
4KB

Download
memory/2924-287-0x0000026846AF0000-0x0000026846AF1000-memory.dmp

Filesize
4KB

Download
memory/3972-186-0x00007FFC844F0000-0x00007FFC84FB1000-memory.dmp

Filesize
10.8MB

Download
memory/3972-230-0x00007FFC844F0000-0x00007FFC84FB1000-memory.dmp

Filesize
10.8MB

Download