hxxps://cdn[.]discordapp[.]com/attachments/1250327096514056245/1250329506699280384/ReboundBootstrapper[.]exe?ex=666a8b98&is=66693a18&hm=02be3359e473eed1e6c82b1de549bfd4fd9202386bf1d01de52feba74f9680c1&

Analysis

max time kernel
39s
max time network
40s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
12/06/2024, 07:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1250327096514056245/1250329506699280384/ReboundBootstrapper.exe?ex=666a8b98&is=66693a18&hm=02be3359e473eed1e6c82b1de549bfd4fd9202386bf1d01de52feba74f9680c1&
Sample240612-h4e2matfre

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1704	msedge.exe
1704	msedge.exe
4800	msedge.exe
4800	msedge.exe
1760	msedge.exe
1760	msedge.exe
4732	identity_helper.exe
4732	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 232	4800	msedge.exe	78
PID 4800 wrote to memory of 232	4800	msedge.exe	78
PID 4800 wrote to memory of 3376	4800	msedge.exe	79
PID 4800 wrote to memory of 3376	4800	msedge.exe	79
PID 4800 wrote to memory of 3376	4800	msedge.exe	79
PID 4800 wrote to memory of 3376	4800	msedge.exe	79
PID 4800 wrote to memory of 3376	4800	msedge.exe	79
PID 4800 wrote to memory of 3376	4800	msedge.exe	79
PID 4800 wrote to memory of 3376	4800	msedge.exe	79
PID 4800 wrote to memory of 3376	4800	msedge.exe	79
PID 4800 wrote to memory of 3376	4800	msedge.exe	79
PID 4800 wrote to memory of 3376	4800	msedge.exe	79
PID 4800 wrote to memory of 3376	4800	msedge.exe	79
PID 4800 wrote to memory of 3376	4800	msedge.exe	79
PID 4800 wrote to memory of 3376	4800	msedge.exe	79
PID 4800 wrote to memory of 3376	4800	msedge.exe	79
PID 4800 wrote to memory of 3376	4800	msedge.exe	79
PID 4800 wrote to memory of 3376	4800	msedge.exe	79
PID 4800 wrote to memory of 3376	4800	msedge.exe	79
PID 4800 wrote to memory of 3376	4800	msedge.exe	79
PID 4800 wrote to memory of 3376	4800	msedge.exe	79
PID 4800 wrote to memory of 3376	4800	msedge.exe	79
PID 4800 wrote to memory of 3376	4800	msedge.exe	79
PID 4800 wrote to memory of 3376	4800	msedge.exe	79
PID 4800 wrote to memory of 3376	4800	msedge.exe	79
PID 4800 wrote to memory of 3376	4800	msedge.exe	79
PID 4800 wrote to memory of 3376	4800	msedge.exe	79
PID 4800 wrote to memory of 3376	4800	msedge.exe	79
PID 4800 wrote to memory of 3376	4800	msedge.exe	79
PID 4800 wrote to memory of 3376	4800	msedge.exe	79
PID 4800 wrote to memory of 3376	4800	msedge.exe	79
PID 4800 wrote to memory of 3376	4800	msedge.exe	79
PID 4800 wrote to memory of 3376	4800	msedge.exe	79
PID 4800 wrote to memory of 3376	4800	msedge.exe	79
PID 4800 wrote to memory of 3376	4800	msedge.exe	79
PID 4800 wrote to memory of 3376	4800	msedge.exe	79
PID 4800 wrote to memory of 3376	4800	msedge.exe	79
PID 4800 wrote to memory of 3376	4800	msedge.exe	79
PID 4800 wrote to memory of 3376	4800	msedge.exe	79
PID 4800 wrote to memory of 3376	4800	msedge.exe	79
PID 4800 wrote to memory of 3376	4800	msedge.exe	79
PID 4800 wrote to memory of 3376	4800	msedge.exe	79
PID 4800 wrote to memory of 1704	4800	msedge.exe	80
PID 4800 wrote to memory of 1704	4800	msedge.exe	80
PID 4800 wrote to memory of 4324	4800	msedge.exe	81
PID 4800 wrote to memory of 4324	4800	msedge.exe	81
PID 4800 wrote to memory of 4324	4800	msedge.exe	81
PID 4800 wrote to memory of 4324	4800	msedge.exe	81
PID 4800 wrote to memory of 4324	4800	msedge.exe	81
PID 4800 wrote to memory of 4324	4800	msedge.exe	81
PID 4800 wrote to memory of 4324	4800	msedge.exe	81
PID 4800 wrote to memory of 4324	4800	msedge.exe	81
PID 4800 wrote to memory of 4324	4800	msedge.exe	81
PID 4800 wrote to memory of 4324	4800	msedge.exe	81
PID 4800 wrote to memory of 4324	4800	msedge.exe	81
PID 4800 wrote to memory of 4324	4800	msedge.exe	81
PID 4800 wrote to memory of 4324	4800	msedge.exe	81
PID 4800 wrote to memory of 4324	4800	msedge.exe	81
PID 4800 wrote to memory of 4324	4800	msedge.exe	81
PID 4800 wrote to memory of 4324	4800	msedge.exe	81
PID 4800 wrote to memory of 4324	4800	msedge.exe	81
PID 4800 wrote to memory of 4324	4800	msedge.exe	81
PID 4800 wrote to memory of 4324	4800	msedge.exe	81
PID 4800 wrote to memory of 4324	4800	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1250327096514056245/1250329506699280384/ReboundBootstrapper.exe?ex=666a8b98&is=66693a18&hm=02be3359e473eed1e6c82b1de549bfd4fd9202386bf1d01de52feba74f9680c1&
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe7d273cb8,0x7ffe7d273cc8,0x7ffe7d273cd8
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,5894014099773342031,9745758487050011392,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,5894014099773342031,9745758487050011392,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,5894014099773342031,9745758487050011392,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,5894014099773342031,9745758487050011392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,5894014099773342031,9745758487050011392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,5894014099773342031,9745758487050011392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,5894014099773342031,9745758487050011392,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4844 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,5894014099773342031,9745758487050011392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,5894014099773342031,9745758487050011392,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,5894014099773342031,9745758487050011392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3828 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,5894014099773342031,9745758487050011392,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4488 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,5894014099773342031,9745758487050011392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,5894014099773342031,9745758487050011392,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:3552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f49e20af78caf0d737f6dbcfc5cc32701a35eb092b3f0ab24cf339604cb049b5
MD5 ade01a8cdbbf61f66497f88012a684d1
SHA1 9ff2e8985d9a101a77c85b37c4ac9d4df2525a1f
SHA512 fa024bd58e63402b06503679a396b8b4b1bc67dc041d473785957f56f7d972317ec8560827c8008989d2754b90e23fc984a85ed7496f05cb4edc2d8000ae622b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 9a24c67c3ec89f5cf8810eba1fdefc7775044c71ed78a8eb51c8d2225ad1bc4c
MD5 d0f84c55517d34a91f12cccf1d3af583
SHA1 52bd01e6ab1037d31106f8bf6e2552617c201cea
SHA512 94764fe7f6d8c182beec398fa8c3a1948d706ab63121b8c9f933eef50172c506a1fd015172b7b6bac898ecbfd33e00a4a0758b1c8f2f4534794c39f076cd6171
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

e82a33cb-3650-40e1-9929-23f1586bb986.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e82a33cb-3650-40e1-9929-23f1586bb986.tmp
Size 5KB
SHA256 0a8f4d56e8cbffab9c8bd870306ce3801ee2b762c24cf0b0905a2492c1f689a7
MD5 30a5f276631016507318c578273b65cd
SHA1 7b2b08f2647841f077206617765758bcf721a056
SHA512 1def09a77f53ddb3152e8ec7e9f46c7bc90e12f652a2a3cc93e39b249d1b602d3b3684d75deaa2b8dbd33342faca8ed9ff00abfb2538013c7c79821ac00443d0
SSDEEP 96:nak36U70kO3wSv0MoiVmdHIqJB0WQyV+VuziX3wI3:nak3dwkO3v0MAIgBLM93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 61998a6ce7e6451e3551a20eadeb9fa04337f63fc83438227d11095c46e6d2b1
MD5 4b43282a51d377b085d3a7ed277566c9
SHA1 943964746c905eaf31e107df33f165a18be1f5ea
SHA512 9d46db708d9998c28df2258bf001f1fcb7d8143d1f6a26a0c2808849efd47ed0e26f354f624c857b8aa5f478bf1e86eba6649586551dfe5289c09c3908c18e46
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGiJ+e2RU6tRULCAZ1RGYO:M9iIxuERzA83h09RZxASGeg78LCAZ1c9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 aa2da822d2caf019d8ac2a6f59497ef4ffbb835177cdae4de97cd0142d489706
MD5 fa999ba790f4bdc0df547738c9ae5ca3
SHA1 83803f5dec5d57edf78c6fab13aff10f236b8f43
SHA512 8035d65e38a751d0727b8e0928a313ad27f09028d085fbd9398d766406e777c9bde78fc75842bbbc0c26398bdc0c2ca9dffd560c31a4b4ec9ead2baab36f0dce
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxA3oJ+e2RU6tRULCAk0RGYO:M9iIxuERzA83h09RZxA3og78LCAk0cYO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6f5944f5f754430539f2961d93b2a249e7c9c9235c9c398a2649f7e33bae11fc
MD5 1cf241af816bd8ba446e3270cc707fb8
SHA1 c740e978a6a5ef45fe878de7947940623bec17af
SHA512 7a144a923ef05639d50e7453c7abf4c1d51ae49b26cad07d29635519e50ffbb1a0e7c9439e6f312e732a03a553bde4bd2baeef9d7a82abb9716111661b6c1c2e
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGiJ+e2RU6tRULCAZORGYO:M9iIxuERzA83h09RZxASGeg78LCAZOc9
MD5 SHA1 SHA512 SSDEEP

Submit Download