Overview

overview

6

Static

static

1

URLScan

urlscan

https://discord.gg/Q...

windows10-1703-x64

6

https://discord.gg/Q...

windows11-21h2-x64

6

Analysis

  • max time kernel
    150s
  • max time network
    139s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    26-04-2024 09:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://discord.gg/QadNbSCe

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Drops file in Windows directory 7 IoCs
  • Checks SCSI registry key(s) 3 TTPs 7 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 64 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\LaunchWinApp.exe
    "C:\Windows\system32\LaunchWinApp.exe" "https://discord.gg/QadNbSCe"
    1⤵
      PID:320
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3804
    • C:\Windows\system32\browser_broker.exe
      C:\Windows\system32\browser_broker.exe -Embedding
      1⤵
      • Modifies Internet Explorer settings
      PID:2656
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1420
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2480
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:1900
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:4328
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:340
    • C:\Windows\system32\dwm.exe
      "dwm.exe"
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:4344
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -s EventSystem
      1⤵
        PID:3956
      • \??\c:\windows\system32\sihost.exe
        sihost.exe
        1⤵
          PID:2152
        • \??\c:\windows\system32\sihost.exe
          sihost.exe
          1⤵
            PID:4912
          • \??\c:\windows\system32\sihost.exe
            sihost.exe
            1⤵
              PID:3568
            • \??\c:\windows\system32\sihost.exe
              sihost.exe
              1⤵
                PID:2140
              • \??\c:\windows\system32\sihost.exe
                sihost.exe
                1⤵
                  PID:1932
                • \??\c:\windows\system32\sihost.exe
                  sihost.exe
                  1⤵
                    PID:1820

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\UDZ5CAOA\favicon[1].ico
                    Filesize

                    23KB

                    MD5

                    ec2c34cadd4b5f4594415127380a85e6

                    SHA1

                    e7e129270da0153510ef04a148d08702b980b679

                    SHA256

                    128e20b3b15c65dd470cb9d0dc8fe10e2ff9f72fac99ee621b01a391ef6b81c7

                    SHA512

                    c1997779ff5d0f74a7fbb359606dab83439c143fbdb52025495bdc3a7cb87188085eaf12cc434cbf63b3f8da5417c8a03f2e64f751c0a63508e4412ea4e7425c

                    Download Submit

                  • memory/1900-84-0x0000026FACAB0000-0x0000026FACAB2000-memory.dmp

                    Filesize

                    8KB

                    Download

                  • memory/1900-87-0x0000026FACAD0000-0x0000026FACAD2000-memory.dmp

                    Filesize

                    8KB

                    Download

                  • memory/1900-91-0x0000026FACAF0000-0x0000026FACAF2000-memory.dmp

                    Filesize

                    8KB

                    Download

                  • memory/1900-144-0x0000026FB0560000-0x0000026FB0660000-memory.dmp

                    Filesize

                    1024KB

                    Download

                  • memory/1900-150-0x0000026FAF0C0000-0x0000026FAF1C0000-memory.dmp

                    Filesize

                    1024KB

                    Download

                  • memory/3804-0-0x000001C5D7620000-0x000001C5D7630000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/3804-16-0x000001C5D7E40000-0x000001C5D7E50000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/3804-35-0x000001C5D7780000-0x000001C5D7782000-memory.dmp

                    Filesize

                    8KB

                    Download

                  • memory/3804-176-0x000001C5DE470000-0x000001C5DE471000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/3804-177-0x000001C5DE480000-0x000001C5DE481000-memory.dmp

                    Filesize

                    4KB

                    Download