hxxps://cdn[.]discordapp[.]com/attachments/1187741536738353152/1257021197422690405/Zip[.]zip?ex=6682e3b7&is=66819237&hm=47b7fc4b5dd113614609aa2abee7c5c902eb94413d0ec7434ac3e4c78f02eb7c&

Analysis

max time kernel
44s
max time network
21s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
30/06/2024, 18:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1187741536738353152/1257021197422690405/Zip.zip?ex=6682e3b7&is=66819237&hm=47b7fc4b5dd113614609aa2abee7c5c902eb94413d0ec7434ac3e4c78f02eb7c&

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Zip.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3156	msedge.exe
3156	msedge.exe
1292	msedge.exe
1292	msedge.exe
3988	identity_helper.exe
3988	identity_helper.exe
4644	msedge.exe
4644	msedge.exe
1664	msedge.exe
1664	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe

Suspicious use of FindShellTrayWindow 60 IoCs

pid	Process
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 1548	1292	msedge.exe	77
PID 1292 wrote to memory of 1548	1292	msedge.exe	77
PID 1292 wrote to memory of 3444	1292	msedge.exe	78
PID 1292 wrote to memory of 3444	1292	msedge.exe	78
PID 1292 wrote to memory of 3444	1292	msedge.exe	78
PID 1292 wrote to memory of 3444	1292	msedge.exe	78
PID 1292 wrote to memory of 3444	1292	msedge.exe	78
PID 1292 wrote to memory of 3444	1292	msedge.exe	78
PID 1292 wrote to memory of 3444	1292	msedge.exe	78
PID 1292 wrote to memory of 3444	1292	msedge.exe	78
PID 1292 wrote to memory of 3444	1292	msedge.exe	78
PID 1292 wrote to memory of 3444	1292	msedge.exe	78
PID 1292 wrote to memory of 3444	1292	msedge.exe	78
PID 1292 wrote to memory of 3444	1292	msedge.exe	78
PID 1292 wrote to memory of 3444	1292	msedge.exe	78
PID 1292 wrote to memory of 3444	1292	msedge.exe	78
PID 1292 wrote to memory of 3444	1292	msedge.exe	78
PID 1292 wrote to memory of 3444	1292	msedge.exe	78
PID 1292 wrote to memory of 3444	1292	msedge.exe	78
PID 1292 wrote to memory of 3444	1292	msedge.exe	78
PID 1292 wrote to memory of 3444	1292	msedge.exe	78
PID 1292 wrote to memory of 3444	1292	msedge.exe	78
PID 1292 wrote to memory of 3444	1292	msedge.exe	78
PID 1292 wrote to memory of 3444	1292	msedge.exe	78
PID 1292 wrote to memory of 3444	1292	msedge.exe	78
PID 1292 wrote to memory of 3444	1292	msedge.exe	78
PID 1292 wrote to memory of 3444	1292	msedge.exe	78
PID 1292 wrote to memory of 3444	1292	msedge.exe	78
PID 1292 wrote to memory of 3444	1292	msedge.exe	78
PID 1292 wrote to memory of 3444	1292	msedge.exe	78
PID 1292 wrote to memory of 3444	1292	msedge.exe	78
PID 1292 wrote to memory of 3444	1292	msedge.exe	78
PID 1292 wrote to memory of 3444	1292	msedge.exe	78
PID 1292 wrote to memory of 3444	1292	msedge.exe	78
PID 1292 wrote to memory of 3444	1292	msedge.exe	78
PID 1292 wrote to memory of 3444	1292	msedge.exe	78
PID 1292 wrote to memory of 3444	1292	msedge.exe	78
PID 1292 wrote to memory of 3444	1292	msedge.exe	78
PID 1292 wrote to memory of 3444	1292	msedge.exe	78
PID 1292 wrote to memory of 3444	1292	msedge.exe	78
PID 1292 wrote to memory of 3444	1292	msedge.exe	78
PID 1292 wrote to memory of 3444	1292	msedge.exe	78
PID 1292 wrote to memory of 3156	1292	msedge.exe	79
PID 1292 wrote to memory of 3156	1292	msedge.exe	79
PID 1292 wrote to memory of 4632	1292	msedge.exe	80
PID 1292 wrote to memory of 4632	1292	msedge.exe	80
PID 1292 wrote to memory of 4632	1292	msedge.exe	80
PID 1292 wrote to memory of 4632	1292	msedge.exe	80
PID 1292 wrote to memory of 4632	1292	msedge.exe	80
PID 1292 wrote to memory of 4632	1292	msedge.exe	80
PID 1292 wrote to memory of 4632	1292	msedge.exe	80
PID 1292 wrote to memory of 4632	1292	msedge.exe	80
PID 1292 wrote to memory of 4632	1292	msedge.exe	80
PID 1292 wrote to memory of 4632	1292	msedge.exe	80
PID 1292 wrote to memory of 4632	1292	msedge.exe	80
PID 1292 wrote to memory of 4632	1292	msedge.exe	80
PID 1292 wrote to memory of 4632	1292	msedge.exe	80
PID 1292 wrote to memory of 4632	1292	msedge.exe	80
PID 1292 wrote to memory of 4632	1292	msedge.exe	80
PID 1292 wrote to memory of 4632	1292	msedge.exe	80
PID 1292 wrote to memory of 4632	1292	msedge.exe	80
PID 1292 wrote to memory of 4632	1292	msedge.exe	80
PID 1292 wrote to memory of 4632	1292	msedge.exe	80
PID 1292 wrote to memory of 4632	1292	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1187741536738353152/1257021197422690405/Zip.zip?ex=6682e3b7&is=66819237&hm=47b7fc4b5dd113614609aa2abee7c5c902eb94413d0ec7434ac3e4c78f02eb7c&
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xb8,0x10c,0x7ff80f013cb8,0x7ff80f013cc8,0x7ff80f013cd8
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,9029596427192771854,433114217992624064,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1872 /prefetch:2
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,9029596427192771854,433114217992624064,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,9029596427192771854,433114217992624064,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,9029596427192771854,433114217992624064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,9029596427192771854,433114217992624064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,9029596427192771854,433114217992624064,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,9029596427192771854,433114217992624064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,9029596427192771854,433114217992624064,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,9029596427192771854,433114217992624064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,9029596427192771854,433114217992624064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,9029596427192771854,433114217992624064,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,9029596427192771854,433114217992624064,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,9029596427192771854,433114217992624064,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e4bf11ed97b6b312e938ca216cf30e

SHA1
ff6b0b475e552dc08a2c81c9eb9230821d3c8290

SHA256
296db8c9361efb62e23be1935fd172cfe9fbcd89a424f34f347ec3cc5ca5afad

SHA512
ce1a05df2619af419ed3058dcbd7254c7159d333356d9f1d5e2591c19e17ab0ac9b6d3e625e36246ad187256bee75b7011370220ef127c4f1171879014d0dd76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
23da8c216a7633c78c347cc80603cd99

SHA1
a378873c9d3484e0c57c1cb6c6895f34fee0ea61

SHA256
03dbdb03799f9e37c38f6d9d498ad09f7f0f9901430ff69d95aa26cae87504d3

SHA512
d34ae684e8462e3f2aba2260f2649dee01b4e2138b50283513c8c19c47faf039701854e1a9cbf21d7a20c28a6306f953b58ffb9144ead067f5f73650a759ff17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5304ae5ecabcacda92fd441d3076757f

SHA1
cb560e7fef2a0f27de4373a24a777ef85ebada9b

SHA256
7f1c24c49fe9fe1920d984149b75689bfddf8864648784e68a865cf81117b71b

SHA512
ce3291a30ef72a799d7b356bdfa8503a01b94b34e0070cd7c8b27f98e600a9390d2fc0dd5a96aa9d51ce58b4485604d7ef883f76159e0d43599a9f22946d3a74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7959f499ed08838d6927a8b48bd0350b

SHA1
14bc7924832ea00503f04da87ee23cfb6a5e7721

SHA256
a2670b974d41199cb3f9fa1c04d93ca7a33198626da682ca72c66cba9f2c1a0b

SHA512
b6d42002c03263642b6ae95b877c93df208e5458880836f4f0f33e5ad9368a9ffe7186daa71c3fe23de77d1c7b648dbe6f0048a61d98be4d6a27351d4b056313

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9a81c2c9c1d6be1d6b9182b45d3a88fe

SHA1
403042090659626d6a51e5e3b9fd47a7431d19c6

SHA256
233025188ca7c3293675bd9ca0d841038b402e1485d9eb172ecc11edbd556939

SHA512
d1480cdf9e2ee23533e9e3738ad7004b10c8ae1dfe32ae977928478194e5a40579cbf9e0481f2dd82aa2d811ada74548b3862f2276c2a4654aa9d64ebbd0e14d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d9989ae3fd4387fa3daf5defd86cdfd7

SHA1
0828f1a4b9aed6ba2117414b4a3055131e3aff34

SHA256
656aa86c362edf7c899c335650adc29d495f7c5a08875cab90c1c8505b928fbf

SHA512
bca0a8bd8e024051b7e994061c63a79858aaacebb44d5360a4b87b7f6d04c92a4b127e133677f5cb87d785d8bef598870d01b6cea52bf6474a1bfcc7ccba6a43

Download Submit
C:\Users\Admin\Downloads\Zip.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit