Analysis

  • max time kernel
    1800s
  • max time network
    1790s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-06-2024 10:46

General

  • Target

    http://Discord.com/app

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://Discord.com/app
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1364
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f56546f8,0x7ff8f5654708,0x7ff8f5654718
      2⤵
        PID:3644
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,1746090104629970068,14492111201083215699,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
        2⤵
          PID:1172
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,1746090104629970068,14492111201083215699,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1376
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,1746090104629970068,14492111201083215699,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
          2⤵
            PID:2836
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1746090104629970068,14492111201083215699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
            2⤵
              PID:3408
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1746090104629970068,14492111201083215699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
              2⤵
                PID:4064
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1746090104629970068,14492111201083215699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
                2⤵
                  PID:1468
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2060,1746090104629970068,14492111201083215699,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4000 /prefetch:8
                  2⤵
                    PID:3616
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2060,1746090104629970068,14492111201083215699,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3596 /prefetch:8
                    2⤵
                    • Modifies registry class
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3524
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,1746090104629970068,14492111201083215699,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5696 /prefetch:8
                    2⤵
                      PID:1028
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,1746090104629970068,14492111201083215699,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5696 /prefetch:8
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3792
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1746090104629970068,14492111201083215699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
                      2⤵
                        PID:1856
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1746090104629970068,14492111201083215699,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
                        2⤵
                          PID:900
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1746090104629970068,14492111201083215699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
                          2⤵
                            PID:5020
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1746090104629970068,14492111201083215699,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
                            2⤵
                              PID:3504
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,1746090104629970068,14492111201083215699,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5864 /prefetch:2
                              2⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:1756
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:4896
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:3828
                              • C:\Windows\system32\AUDIODG.EXE
                                C:\Windows\system32\AUDIODG.EXE 0x378 0x50c
                                1⤵
                                  PID:1616

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                  Filesize

                                  152B

                                  MD5

                                  4f7152bc5a1a715ef481e37d1c791959

                                  SHA1

                                  c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

                                  SHA256

                                  704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

                                  SHA512

                                  2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                  Filesize

                                  152B

                                  MD5

                                  ea98e583ad99df195d29aa066204ab56

                                  SHA1

                                  f89398664af0179641aa0138b337097b617cb2db

                                  SHA256

                                  a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

                                  SHA512

                                  e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                  Filesize

                                  2KB

                                  MD5

                                  cb6fc337b665a1f8e5345c2e1785f693

                                  SHA1

                                  9525d53c92c2c673b5b666a428ff257d36cb84de

                                  SHA256

                                  c085fa915f8ff1488400b3fdb95c6c19f7cdeb9eff1b958b5d4f9b033ac44e50

                                  SHA512

                                  5415bb488f0af1da442a76026de980b1b5d9f480c7f319e601f440bc2b618726bcb10107f501a4b6f4d54c559a925b9033b0641ae43fce4487a414bb2665eb2b

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                  Filesize

                                  179B

                                  MD5

                                  c88a3bc77002a075b95198522f195432

                                  SHA1

                                  dd6ff073c9b7fa86d1a461013165a7251443e777

                                  SHA256

                                  8f8c6061b94669fcf151b9f8f1c979a33ad38d597be893f375bff44ad1b3556d

                                  SHA512

                                  e3facaf13afeab1a90a5c15f31288611e7af177fed3e4474aefee3560c5e1129579ea74857f5a3845b8f04c117e6c5af45c87df5d0b003e1259d918b7b0dff1f

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  5KB

                                  MD5

                                  36a27198430c220350ee365f2d1c5370

                                  SHA1

                                  9580f9eca5600c399fb8fcea28bb82bb79af3aec

                                  SHA256

                                  cc1b7ce84fdb8e5308374e7a0c32df388e70327b7a8fe3e732f10aa2ae679d2a

                                  SHA512

                                  54c631599e89e807409f7cba89c8ec08ee38c633bade6f91a88798025525f27c5269fcb6ad8c8cb483044ce4dcde4f003a34f4d0f99b8a6921852751ff916229

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  6KB

                                  MD5

                                  09870555574d5f150ff0638b8d1f69a0

                                  SHA1

                                  d8fadab61ca75bb1c7e8d0ff2766d0b51ce4aced

                                  SHA256

                                  145b63bce1d1c596a7e5123dc5c424f03a1feec090e727daa2d308926b9f6dd4

                                  SHA512

                                  3a12dd04443ccf38981fb147bb75d50e7371487f7bc9c04c1baa3f79e36f4855e97e01de9e56a48cde8d06627d2e736bed2122fd68665e26440e994ad244256a

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  370B

                                  MD5

                                  e4e46875a8ea446305405dde2da5bf3e

                                  SHA1

                                  b5fa9f13c1a2ca34e5b43d9e70a2772193508485

                                  SHA256

                                  783001de676b4768e22ecc19ccc16445ab030cab941ae0124d27a2fa12e2d16f

                                  SHA512

                                  72454887dab55cb25d0ed63fc8aa4ea6990af813fd5683a054e0f5104cec4666678aba865449217981d32bb67920df729feb4facbc729b598095fb33d8b61b42

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  370B

                                  MD5

                                  76e6c9d4a3904f8d1ba3ce1ab6d53bc4

                                  SHA1

                                  ada23b07785d20945cccc06c147736192e60f632

                                  SHA256

                                  58cad4a419588db18d4ce0756e328ccaed96ca9fd9708855559f8c29bca868fd

                                  SHA512

                                  6ddf07c20f501aac0596b49f4176585dcb03f874f6dbec3ffa23aaca43e3940d8473fd93466084124329f9edf52ea0e54fd70ca1a73ff3a444396682efc53689

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  370B

                                  MD5

                                  1bb9c1fdaf981396312410285975a122

                                  SHA1

                                  6145c9dfb33864848eb174e85d8bd24c3a5b4f5a

                                  SHA256

                                  fc2ee218ca1bb80f0f34e928c2b47e9214e768a25af99c64db9757c03e57bdb7

                                  SHA512

                                  0149601414601b2107e3a0a5cea95d9cd39e54c3f51a314e7853d7c4430907535866fd2ef0a1b78f4fe7d3ab552a03c21c2bb5b635110a823a7f53b080b43cb9

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  370B

                                  MD5

                                  da57960dcbb89de7cd953a23eb36c66b

                                  SHA1

                                  d20946e67b25acd6a0001fddcf4b7d9581bf13a0

                                  SHA256

                                  53be04db2ec9a7988473168ef1ebdda4decf1391c97dbf4c2270fafeac817577

                                  SHA512

                                  e5877ee3cefb4e48796f70a7e2ac947429970c3541beaa1be57f531381fd70214623c8c35994facffae2bcb350c384e2143fcd3dfb22b6a14d440c47cdb58594

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  370B

                                  MD5

                                  91f7fe04e6f6b9b7084d0f3d28284c68

                                  SHA1

                                  845bad685422516dcf4aaafdbaf24c76a68f7b78

                                  SHA256

                                  499fd90330c63fb06c3f0d1e6f29a781a1a655146aac4ce712f023713cffd06a

                                  SHA512

                                  3a248829707eb6cd2f138634ce9096b88c0da55e8e85cd05ecd39fbe1993944917fa96870cc2c390bc8d35b21925c0fa743c10265f87d7d192c7d8e74b9d6c67

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  370B

                                  MD5

                                  a9d3a6cc59c3235a842fe713eb722dde

                                  SHA1

                                  53f68049c749639bd6b5c02c9408599031ab6942

                                  SHA256

                                  5147f2255aa1d57005cf100687c740accbcdac25bde50efdb55ef153d5f85225

                                  SHA512

                                  1df696c01540e6a14931c501da8bf9ab526f0e65f0144ab5a744541c9adb2068c7f380a02b0eba0ee7a02d90b67928474c23ed817b9bd34638850d5ca6e2b761

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  370B

                                  MD5

                                  684904f951f641de189aa45ee4aeb76d

                                  SHA1

                                  8a5b9b5a4b98a698e8d8d8454fdd58668a0fff13

                                  SHA256

                                  cf268763e102e1945ecee1064c45f6c7416e4f76e5c77645946d083fd59a09fe

                                  SHA512

                                  37a602b70c6763bb8f0823b446e48dab82df25def0edc42b32681d1afb0fcda5f55b962774a35bd789807e6413aafff9f1a084afdb8a64bdec038ea46a45fca7

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe588dd4.TMP

                                  Filesize

                                  370B

                                  MD5

                                  66784f9affce9ab176fe30cc2472dd8e

                                  SHA1

                                  7ce0ad893274a4e32faa9a88a6830fda32054a53

                                  SHA256

                                  3bec7328f37db0b3f29b0067c1db6a88ee130ce22887e2ade2ce7be5e1ab3b3b

                                  SHA512

                                  d2a51d6aa0bdcec1ed47db2fd4ccfb79f4e57d4c591774e8b24a53ae5d1410edd87a84c6a9958b04428ac81536c2c0c28ff5ad94de67ec6b9ab045985fe15b75

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                  Filesize

                                  16B

                                  MD5

                                  6752a1d65b201c13b62ea44016eb221f

                                  SHA1

                                  58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                  SHA256

                                  0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                  SHA512

                                  9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                  Filesize

                                  10KB

                                  MD5

                                  ef30eb3aa3de13fe0e4bb63215c31732

                                  SHA1

                                  e740dc6a967d2962c080368b1ba5e194db96717d

                                  SHA256

                                  e818447a47ffe6d51202141df7b7cc9849678ad6b318a4bf02e6b1f083e2c82b

                                  SHA512

                                  541de018c09ae70c75ed6fa461d751f07f401241fa8a8908bd3c5840b00a1ce6154bd81763d176e8121b6fba759f4003c563587ba88b5106f9db82c9849a8bd2

                                • \??\pipe\LOCAL\crashpad_1364_FQCQTWKXDKOSMFWL

                                  MD5

                                  d41d8cd98f00b204e9800998ecf8427e

                                  SHA1

                                  da39a3ee5e6b4b0d3255bfef95601890afd80709

                                  SHA256

                                  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                  SHA512

                                  cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e