hxxps://discord[.]gg/mF2HbVTR

Analysis

max time kernel
17s
max time network
17s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/05/2024, 21:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://discord.gg/mF2HbVTR

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
10	discord.com
11	discord.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-711569230-3659488422-571408806-1000\{D1DC0AE3-D383-411C-8EA3-29D46F999160}	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4624	msedge.exe
4624	msedge.exe
4696	msedge.exe
4696	msedge.exe
3336	msedge.exe
3336	msedge.exe
632	identity_helper.exe
632	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 2364	4696	msedge.exe	81
PID 4696 wrote to memory of 2364	4696	msedge.exe	81
PID 4696 wrote to memory of 4720	4696	msedge.exe	82
PID 4696 wrote to memory of 4720	4696	msedge.exe	82
PID 4696 wrote to memory of 4720	4696	msedge.exe	82
PID 4696 wrote to memory of 4720	4696	msedge.exe	82
PID 4696 wrote to memory of 4720	4696	msedge.exe	82
PID 4696 wrote to memory of 4720	4696	msedge.exe	82
PID 4696 wrote to memory of 4720	4696	msedge.exe	82
PID 4696 wrote to memory of 4720	4696	msedge.exe	82
PID 4696 wrote to memory of 4720	4696	msedge.exe	82
PID 4696 wrote to memory of 4720	4696	msedge.exe	82
PID 4696 wrote to memory of 4720	4696	msedge.exe	82
PID 4696 wrote to memory of 4720	4696	msedge.exe	82
PID 4696 wrote to memory of 4720	4696	msedge.exe	82
PID 4696 wrote to memory of 4720	4696	msedge.exe	82
PID 4696 wrote to memory of 4720	4696	msedge.exe	82
PID 4696 wrote to memory of 4720	4696	msedge.exe	82
PID 4696 wrote to memory of 4720	4696	msedge.exe	82
PID 4696 wrote to memory of 4720	4696	msedge.exe	82
PID 4696 wrote to memory of 4720	4696	msedge.exe	82
PID 4696 wrote to memory of 4720	4696	msedge.exe	82
PID 4696 wrote to memory of 4720	4696	msedge.exe	82
PID 4696 wrote to memory of 4720	4696	msedge.exe	82
PID 4696 wrote to memory of 4720	4696	msedge.exe	82
PID 4696 wrote to memory of 4720	4696	msedge.exe	82
PID 4696 wrote to memory of 4720	4696	msedge.exe	82
PID 4696 wrote to memory of 4720	4696	msedge.exe	82
PID 4696 wrote to memory of 4720	4696	msedge.exe	82
PID 4696 wrote to memory of 4720	4696	msedge.exe	82
PID 4696 wrote to memory of 4720	4696	msedge.exe	82
PID 4696 wrote to memory of 4720	4696	msedge.exe	82
PID 4696 wrote to memory of 4720	4696	msedge.exe	82
PID 4696 wrote to memory of 4720	4696	msedge.exe	82
PID 4696 wrote to memory of 4720	4696	msedge.exe	82
PID 4696 wrote to memory of 4720	4696	msedge.exe	82
PID 4696 wrote to memory of 4720	4696	msedge.exe	82
PID 4696 wrote to memory of 4720	4696	msedge.exe	82
PID 4696 wrote to memory of 4720	4696	msedge.exe	82
PID 4696 wrote to memory of 4720	4696	msedge.exe	82
PID 4696 wrote to memory of 4720	4696	msedge.exe	82
PID 4696 wrote to memory of 4720	4696	msedge.exe	82
PID 4696 wrote to memory of 4624	4696	msedge.exe	83
PID 4696 wrote to memory of 4624	4696	msedge.exe	83
PID 4696 wrote to memory of 1400	4696	msedge.exe	84
PID 4696 wrote to memory of 1400	4696	msedge.exe	84
PID 4696 wrote to memory of 1400	4696	msedge.exe	84
PID 4696 wrote to memory of 1400	4696	msedge.exe	84
PID 4696 wrote to memory of 1400	4696	msedge.exe	84
PID 4696 wrote to memory of 1400	4696	msedge.exe	84
PID 4696 wrote to memory of 1400	4696	msedge.exe	84
PID 4696 wrote to memory of 1400	4696	msedge.exe	84
PID 4696 wrote to memory of 1400	4696	msedge.exe	84
PID 4696 wrote to memory of 1400	4696	msedge.exe	84
PID 4696 wrote to memory of 1400	4696	msedge.exe	84
PID 4696 wrote to memory of 1400	4696	msedge.exe	84
PID 4696 wrote to memory of 1400	4696	msedge.exe	84
PID 4696 wrote to memory of 1400	4696	msedge.exe	84
PID 4696 wrote to memory of 1400	4696	msedge.exe	84
PID 4696 wrote to memory of 1400	4696	msedge.exe	84
PID 4696 wrote to memory of 1400	4696	msedge.exe	84
PID 4696 wrote to memory of 1400	4696	msedge.exe	84
PID 4696 wrote to memory of 1400	4696	msedge.exe	84
PID 4696 wrote to memory of 1400	4696	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/mF2HbVTR
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb447946f8,0x7ffb44794708,0x7ffb44794718
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,1778528006406976788,16698599706727803056,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,1778528006406976788,16698599706727803056,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,1778528006406976788,16698599706727803056,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1778528006406976788,16698599706727803056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1778528006406976788,16698599706727803056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1778528006406976788,16698599706727803056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2156,1778528006406976788,16698599706727803056,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2156,1778528006406976788,16698599706727803056,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,1778528006406976788,16698599706727803056,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,1778528006406976788,16698599706727803056,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1778528006406976788,16698599706727803056,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1778528006406976788,16698599706727803056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2940 /prefetch:1
  2⤵
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1778528006406976788,16698599706727803056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3880 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1778528006406976788,16698599706727803056,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1778528006406976788,16698599706727803056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:4352

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
42dfeaabb023a65e603dd8c2c30bb71d

SHA1
45fba281e071c7d2ee458caef548b943241f0f89

SHA256
d8ca10b75e6646f0308c92b73294b77c922a498914a2cbf473f0a6135523d9e8

SHA512
b55716a28daa64a6e513735103210192ddf547fbc808f49a971b097d39908f3b6a703c8a98676cb836993e95047a5782d49861001dda388122301ac99f8e471e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1c7c6336ecc2a695de7e3da50d8f9b4f

SHA1
65118e7b73cf51f5d9ae6a6761fea80911d52374

SHA256
762f0e8246fed025849cd076947b20f2ecc17fd7ab85a415427fb91dfc669a83

SHA512
f223889d306966fb9fb41a2611265c792ac16429fc0f2741514f1c446af19b2df5799e038855a5a11490bfb347b8c29c2b128e92573f3edc74d24ffb31314ee5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
22969d88fea7c83b8651f950c650f1cd

SHA1
023536992cf4d65c92deeab0f4fb17c009748ce3

SHA256
797c0b58fd48647ef20c12c4fc9adec5033ea67a693828922566144006450213

SHA512
d3179fd3a96cff54d64b20ad3c9462d45473b4227f160f743c139177cea56e7f2623f6b4a7301718cd1a16d0a6c4cd4541b87f9799b1e8e5a067ff729ac4a123

Download Submit