hxxps://cdn[.]discordapp[.]com/attachments/1227682857678536756/1233551067984298125/Built[.]exe?ex=662d8174&is=662c2ff4&hm=21f9fcb53aa4eb823fc5fe2340b1734d88f055064a5b4a67af990c94bd6b2e1f&

Analysis

max time kernel
33s
max time network
36s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 22:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1227682857678536756/1233551067984298125/Built.exe?ex=662d8174&is=662c2ff4&hm=21f9fcb53aa4eb823fc5fe2340b1734d88f055064a5b4a67af990c94bd6b2e1f&

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4860	msedge.exe
4860	msedge.exe
1344	msedge.exe
1344	msedge.exe
4224	identity_helper.exe
4224	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 1352	1344	msedge.exe	85
PID 1344 wrote to memory of 1352	1344	msedge.exe	85
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4860	1344	msedge.exe	87
PID 1344 wrote to memory of 4860	1344	msedge.exe	87
PID 1344 wrote to memory of 1780	1344	msedge.exe	88
PID 1344 wrote to memory of 1780	1344	msedge.exe	88
PID 1344 wrote to memory of 1780	1344	msedge.exe	88
PID 1344 wrote to memory of 1780	1344	msedge.exe	88
PID 1344 wrote to memory of 1780	1344	msedge.exe	88
PID 1344 wrote to memory of 1780	1344	msedge.exe	88
PID 1344 wrote to memory of 1780	1344	msedge.exe	88
PID 1344 wrote to memory of 1780	1344	msedge.exe	88
PID 1344 wrote to memory of 1780	1344	msedge.exe	88
PID 1344 wrote to memory of 1780	1344	msedge.exe	88
PID 1344 wrote to memory of 1780	1344	msedge.exe	88
PID 1344 wrote to memory of 1780	1344	msedge.exe	88
PID 1344 wrote to memory of 1780	1344	msedge.exe	88
PID 1344 wrote to memory of 1780	1344	msedge.exe	88
PID 1344 wrote to memory of 1780	1344	msedge.exe	88
PID 1344 wrote to memory of 1780	1344	msedge.exe	88
PID 1344 wrote to memory of 1780	1344	msedge.exe	88
PID 1344 wrote to memory of 1780	1344	msedge.exe	88
PID 1344 wrote to memory of 1780	1344	msedge.exe	88
PID 1344 wrote to memory of 1780	1344	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1227682857678536756/1233551067984298125/Built.exe?ex=662d8174&is=662c2ff4&hm=21f9fcb53aa4eb823fc5fe2340b1734d88f055064a5b4a67af990c94bd6b2e1f&
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa5fd46f8,0x7ffaa5fd4708,0x7ffaa5fd4718
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,84826774387972277,16238167276213572140,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,84826774387972277,16238167276213572140,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2484 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,84826774387972277,16238167276213572140,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,84826774387972277,16238167276213572140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,84826774387972277,16238167276213572140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,84826774387972277,16238167276213572140,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4820 /prefetch:8
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,84826774387972277,16238167276213572140,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4820 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,84826774387972277,16238167276213572140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,84826774387972277,16238167276213572140,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,84826774387972277,16238167276213572140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,84826774387972277,16238167276213572140,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,84826774387972277,16238167276213572140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,84826774387972277,16238167276213572140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:2144

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3900

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2a70f1bd4da893a67660d6432970788d

SHA1
ddf4047e0d468f56ea0c0d8ff078a86a0bb62873

SHA256
c550af5ba51f68ac4d18747edc5dea1a655dd212d84bad1e6168ba7a97745561

SHA512
26b9a365e77df032fc5c461d85d1ba313eafead38827190608c6537ec12b2dfdbed4e1705bfd1e61899034791ad6fa88ea7490c3a48cdaec4d04cd0577b11343

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fbe1ce4d182aaffb80de94263be1dd35

SHA1
bc6c9827aa35a136a7d79be9e606ff359e2ac3ea

SHA256
0021f72dbca789f179762b0e17c28fe0b93a12539b08294800e47469905aeb51

SHA512
3fb0a3b38e7d4a30f5560594b1d14e6e58419e274255fb68dfe0ca897aa181f9ce8cb2048403f851fd36a17b0e34d272d03927769d41a500b2fe64806354902f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bb41260a756b7e3442a065616e30a2a7

SHA1
9cbccd87d3422662453711ecebbd679101c6cfdf

SHA256
c8e2231c8370443132a780859a56c0c0fcad2a1b77ed8d76c94723cc4b5576de

SHA512
993b225d291176b068788899a6d13f90d2c7d79eecfcb7759e07f5b4d367c1173aa724d42feb3bb2b28a2d2cc22d717c2aed4004655695351802c8c1abe6296d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1f4ea06e4ff675f18193950fa7d30ca1

SHA1
4832f6b0f3c5e7fa5a6c3794580427a7ccbb83b9

SHA256
a6964df12bb20678c9281dd50218984b68372b16fd01f1a358048fd8482aedc0

SHA512
61cb3b03eb478ebd1c8da66c6cff310820c3db0329a8e17277400295d7311f5ee1c0d19787608a22ec33accb9f7703e4af09f0f216c8cf9b29b70ecc690232d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
bf45bc230de18fbb382f667283a53419

SHA1
99415e0b71591b56ce8be11e1165aa2ce9ac6825

SHA256
72307dc868c1f2a701859bda719412eee0c3165cc65e9ee836fb100aaaf1040b

SHA512
55fb369c71f00494907887195f7b6af11b909a9c99ad1c2cc2289bdd4713abbce5f0b071d06d7f15d4610f83e439d6fc262766ad1b737f006956632dd8bdea9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
1a9129ef53396b05bb62984fd1168dbc

SHA1
842893b1e9bec9d14f2b460c5770cdc3ee6de6d4

SHA256
dc4902adecaee3fb61e77fe0d814f278c4c2dfd8407973334d18e40bdbe21b20

SHA512
501dae0e98695a2ab4c513a0d3d720ef09d8d8c60ee446e69a51fa3138c3544cdd0afc750225819a0e065d716b310c4def703ff21c621fa95e00bef8155c2415

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit