discordrat | 10a806b3b91bce876937c1f705b91153f5fdc91c88fe442dfd0ae6f06e26a9cb

Resubmissions

13-07-2024 02:33

240713-c188easakp 10

13-07-2024 02:29

240713-cyqchsthke 10

13-07-2024 02:23

240713-cvk9ds1glm 10

Analysis

max time kernel
145s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
13-07-2024 02:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5oP2ak.html
Size

508B
MD5

db55c0a45c78e31108711e01515a26d0
SHA1

667d59c73d995076e9e3566ad0acab62b81ebde8
SHA256

10a806b3b91bce876937c1f705b91153f5fdc91c88fe442dfd0ae6f06e26a9cb
SHA512

35e4645768d3534a5f9cd845b5d78718dc19e62aa2edaf53041d6d3408b22e6e8d0071dc27e3eab3b64a8df79a12dee72a7aeef81a24ac83d292bafabf78bbb4

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI2MTUwNzg2MDQwNDI0MDQ3Nw.GPTmkZ.fQqxoTPbMZFYQzKwSwVzPNhm6dVtzE-3yd0BSw
server_id
MTI2MTUwNzg2MDQwNDI0MDQ3Nw.GPTmkZ.fQqxoTPbMZFYQzKwSwVzPNhm6dVtzE-3yd0BSw

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

Client-built.exeClient-built.exe

pid process

3528 Client-built.exe
3000 Client-built.exe

pid	process
3528	Client-built.exe
3000	Client-built.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\Local Settings msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\Local Settings	msedge.exe

NTFS ADS 2 IoCs

Processes:

msedge.exemsedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Client-built.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 584173.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exe

pid	process
3024	msedge.exe
3024	msedge.exe
4972	msedge.exe
4972	msedge.exe
4156	msedge.exe
4156	msedge.exe
4952	identity_helper.exe
4952	identity_helper.exe
2660	msedge.exe
2660	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

Processes:

msedge.exe

pid	process
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Client-built.exeClient-built.exe

description pid process

Token: SeDebugPrivilege 3528 Client-built.exe
Token: SeDebugPrivilege 3000 Client-built.exe

description	pid	process
Token: SeDebugPrivilege	3528	Client-built.exe
Token: SeDebugPrivilege	3000	Client-built.exe

Suspicious use of FindShellTrayWindow 43 IoCs

Processes:

msedge.exe

pid	process
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

Processes:

msedge.exe

pid	process
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4972 wrote to memory of 3300	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3300	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3440	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3440	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3440	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3440	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3440	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3440	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3440	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3440	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3440	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3440	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3440	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3440	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3440	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3440	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3440	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3440	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3440	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3440	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3440	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3440	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3440	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3440	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3440	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3440	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3440	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3440	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3440	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3440	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3440	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3440	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3440	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3440	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3440	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3440	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3440	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3440	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3440	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3440	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3440	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3440	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3024	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3024	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3316	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3316	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3316	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3316	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3316	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3316	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3316	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3316	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3316	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3316	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3316	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3316	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3316	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3316	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3316	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3316	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3316	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3316	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3316	4972	msedge.exe	msedge.exe
PID 4972 wrote to memory of 3316	4972	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5oP2ak.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0x100,0xdc,0x7fffc18c3cb8,0x7fffc18c3cc8,0x7fffc18c3cd8
2⤵
PID:3300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1832,2680506540873702531,746473802722832116,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1848 /prefetch:2
2⤵
PID:3440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1832,2680506540873702531,746473802722832116,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1832,2680506540873702531,746473802722832116,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2560 /prefetch:8
2⤵
PID:3316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,2680506540873702531,746473802722832116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3124 /prefetch:1
2⤵
PID:324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,2680506540873702531,746473802722832116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:1
2⤵
PID:4448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1832,2680506540873702531,746473802722832116,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4020 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,2680506540873702531,746473802722832116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
2⤵
PID:3360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1832,2680506540873702531,746473802722832116,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3272 /prefetch:8
2⤵
PID:2316

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1832,2680506540873702531,746473802722832116,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,2680506540873702531,746473802722832116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:1
2⤵
PID:4648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,2680506540873702531,746473802722832116,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4544 /prefetch:1
2⤵
PID:2728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,2680506540873702531,746473802722832116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
2⤵
PID:1668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,2680506540873702531,746473802722832116,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
2⤵
PID:4540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,2680506540873702531,746473802722832116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
2⤵
PID:3376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,2680506540873702531,746473802722832116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
2⤵
PID:1984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,2680506540873702531,746473802722832116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
2⤵
PID:3344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,2680506540873702531,746473802722832116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
2⤵
PID:2268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1832,2680506540873702531,746473802722832116,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3148 /prefetch:8
2⤵
PID:3116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1832,2680506540873702531,746473802722832116,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6088 /prefetch:8
2⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:2660

C:\Users\Admin\Downloads\Client-built.exe
"C:\Users\Admin\Downloads\Client-built.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1832,2680506540873702531,746473802722832116,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4704 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4820

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3296

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:664

C:\Users\Admin\Downloads\Client-built.exe
"C:\Users\Admin\Downloads\Client-built.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3000

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
f1d33f465a73554cd1c183cbcd0a28a2

SHA1
f5c16fc4edff600cb307f762d950500aa29a1e8b

SHA256
22d8c228cdcfd3e05431d7377748014035a3488ad3a0d4aecc334e724245a1f9

SHA512
7cc94f77f3943143ee86eabbfddcb110ce52c6ff0975842e3a3d06072f51f2c48914ee61f24484a539888ad19a7e6a1becfb029485cd5984bc736434a63cee95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
575466f58c7d9d3224035d23f102d140

SHA1
2fce4082fa83534b3ddc91e42fb242baee4afa1c

SHA256
9da0e657652daa1ef86af7c3db62b0af9cce372a5f765c98c68479922ccf1923

SHA512
06503e718fe967076dd8a061b57debdc663b9616b005f8567099a84fc7184880633079335d622c243918efc3356b40e683708fb0583084abeed7db6168a212ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
288B

MD5
f14a1e316852ae301a5e3905c7a09475

SHA1
3dd6d0462cc9b2d82920a2e9c48443f8ee16ec67

SHA256
0dbe6036a02b9be28bb799a5cf81b16a193ae70059280f42b3e4a89e4444032d

SHA512
7172220d5ad2dd91723224db250d826588325c16157388858edcdc8c48440ae7ebfe60bb533ef2cb285069d8d378f80f061327a81a7e9a6bc32b30e24b45b26e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
387B

MD5
a76d8ae9523bcf5bb2caa451121a0d91

SHA1
4867caa19f280aabdc4f85f6468335d70ad1d996

SHA256
515a528f05f0c708175813df2e149b0960d193bd4dac47a11a7641745c8a063b

SHA512
9dbab2a7c6ce09335a805a319399b95ad818c94153d57818cdf30cd26f825ab4517d15dca8bf4156a0aab5a24a6c06977ddb5f9d27f4be8f601a813dc88b9a57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
a6acb30fb27313fbd475a1117c3804c5

SHA1
98c7baf6037dd15ef4d245cb231015a2332a8625

SHA256
75d71104c5e394ed718049c4e33878fc6762135ce74c06d3db27627ca05c4844

SHA512
571e219e5ca5694f0423de806ae455b834a2f05fb9000d7e5e967d21b2683d02de1e646fa7941d87c93290b1a3c0e3485a602f9922665d2b7f96f1dfdc28688b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
7ca27457ae7a41c5751f43ccd34e2893

SHA1
38def8233041ebe3bad7849b57487f480c519909

SHA256
795377ba4f3d0a93f0edefdc848db3a8a43f392bb81950c215628fca1ce39a07

SHA512
d5a24988736ff058bf16397a6a058fc8ffca9a1eccd485804dca03ae7cc2fbaef9b03cdd16d6a8d9e2a5d1c4d3a0f3acc771fa30225fa83af52383530bfbfac1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
b5ac229c7df8675b6d10c3ea592eca5e

SHA1
45f0af7a7fc96709deb9ca197b61006bcde123e0

SHA256
3a5bccc8d245faf9809b4072241d8534d40c35c7a2c9cdac8692a8a371ef2bcd

SHA512
1c033e371be4f4cdbc19b28aeeea4a4e1920be01b62dc9d26adf0a05f4112c857b6f959b5e55618d998510ba04666dbc41b92a3c24136eb665af128a701715cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
c2a5026f31e2e3a4becebfea1377196a

SHA1
34445109414a7e082e3b0b2e8caff14a9013fd64

SHA256
38573f27d36844c14db033ee51d9909acecd8cad4bc1a7d4f053f58f02e17111

SHA512
09a7ff503d42c9f8aa877474cd72886484e3633142e6dc838fb7993995c44917ffcda8d750edb78aafaa2ec23d419e4a51f4444357f20330a0609b680d14bd0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
26193d2848cf9f8d9ac3ae11df7c6131

SHA1
69e7f90ae154cd11700688d42f9b830831915789

SHA256
ff67b52c6dfdce8faca6644122b25944ec4978c3062a89aeeb81705d63b7589c

SHA512
b2e5a403dcd36e29c9d6247db4e0566cf9dce27a112c3afbacdb6f88b99f2bd060088e7b7cee43f92db065cd91171beea625ac5d69329948ba90bf126c10ad4f

Download Submit
C:\Users\Admin\Downloads\Client-built.exe:Zone.Identifier
Filesize
159B

MD5
6dc5dfcd2c3ac371d1193dc997ec535c

SHA1
f08dd1d7fd0c2d3c660e6b067069b9a5bcafec12

SHA256
2b18ae4672dcc1ab285dc5c424689dd63078dc92f993510cf604654ef2450247

SHA512
4a65f01bec3eaed3b95dfa1188f02e417d72af72a39def9e8f321340f98c0ac5ef0dcc29bc2b4b21263587afde02a2ad73ca377281346b5fb23a70e7d020b82b

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 584173.crdownload
Filesize
78KB

MD5
2a8ff1feb634ac8a8a79006d9e957bf1

SHA1
14a1a2b82eb1a4ed453f0da033ed7151374f17cf

SHA256
71ccd92dd4b98f2fd16fdf839a77058c2687e0f37a9e6d3af6f1c8f03573f3a7

SHA512
17d41869705876fbd464650c76e57b9114000d27385ea13800f0964f2e84b9359173a3f0d2d73803415c7977b75dc04bc37bb819d1b48a662f42951862619603

Download Submit
\??\pipe\LOCAL\crashpad_4972_DSPQFTMQKXKCYTYM
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/3528-140-0x000002B7B1510000-0x000002B7B1A38000-memory.dmp

Filesize
5.2MB

Download
memory/3528-139-0x000002B7B0D10000-0x000002B7B0ED2000-memory.dmp

Filesize
1.8MB

Download
memory/3528-138-0x000002B7966C0000-0x000002B7966D8000-memory.dmp

Filesize
96KB

Download