hxxps://discord[.]com/developers/application

Resubmissions

28/07/2024, 21:31

240728-1dcspawapr 7

28/07/2024, 07:18

28/07/2024, 07:17

28/07/2024, 06:57

27/07/2024, 21:33

Analysis

max time kernel
1779s
max time network
1691s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
28/07/2024, 07:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://discord.com/developers/application

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
8	discord.com
12	discord.com
13	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2256	msedge.exe
2256	msedge.exe
1040	msedge.exe
1040	msedge.exe
3016	identity_helper.exe
3016	identity_helper.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1040 wrote to memory of 552	1040	msedge.exe	84
PID 1040 wrote to memory of 552	1040	msedge.exe	84
PID 1040 wrote to memory of 3720	1040	msedge.exe	85
PID 1040 wrote to memory of 3720	1040	msedge.exe	85
PID 1040 wrote to memory of 3720	1040	msedge.exe	85
PID 1040 wrote to memory of 3720	1040	msedge.exe	85
PID 1040 wrote to memory of 3720	1040	msedge.exe	85
PID 1040 wrote to memory of 3720	1040	msedge.exe	85
PID 1040 wrote to memory of 3720	1040	msedge.exe	85
PID 1040 wrote to memory of 3720	1040	msedge.exe	85
PID 1040 wrote to memory of 3720	1040	msedge.exe	85
PID 1040 wrote to memory of 3720	1040	msedge.exe	85
PID 1040 wrote to memory of 3720	1040	msedge.exe	85
PID 1040 wrote to memory of 3720	1040	msedge.exe	85
PID 1040 wrote to memory of 3720	1040	msedge.exe	85
PID 1040 wrote to memory of 3720	1040	msedge.exe	85
PID 1040 wrote to memory of 3720	1040	msedge.exe	85
PID 1040 wrote to memory of 3720	1040	msedge.exe	85
PID 1040 wrote to memory of 3720	1040	msedge.exe	85
PID 1040 wrote to memory of 3720	1040	msedge.exe	85
PID 1040 wrote to memory of 3720	1040	msedge.exe	85
PID 1040 wrote to memory of 3720	1040	msedge.exe	85
PID 1040 wrote to memory of 3720	1040	msedge.exe	85
PID 1040 wrote to memory of 3720	1040	msedge.exe	85
PID 1040 wrote to memory of 3720	1040	msedge.exe	85
PID 1040 wrote to memory of 3720	1040	msedge.exe	85
PID 1040 wrote to memory of 3720	1040	msedge.exe	85
PID 1040 wrote to memory of 3720	1040	msedge.exe	85
PID 1040 wrote to memory of 3720	1040	msedge.exe	85
PID 1040 wrote to memory of 3720	1040	msedge.exe	85
PID 1040 wrote to memory of 3720	1040	msedge.exe	85
PID 1040 wrote to memory of 3720	1040	msedge.exe	85
PID 1040 wrote to memory of 3720	1040	msedge.exe	85
PID 1040 wrote to memory of 3720	1040	msedge.exe	85
PID 1040 wrote to memory of 3720	1040	msedge.exe	85
PID 1040 wrote to memory of 3720	1040	msedge.exe	85
PID 1040 wrote to memory of 3720	1040	msedge.exe	85
PID 1040 wrote to memory of 3720	1040	msedge.exe	85
PID 1040 wrote to memory of 3720	1040	msedge.exe	85
PID 1040 wrote to memory of 3720	1040	msedge.exe	85
PID 1040 wrote to memory of 3720	1040	msedge.exe	85
PID 1040 wrote to memory of 3720	1040	msedge.exe	85
PID 1040 wrote to memory of 2256	1040	msedge.exe	86
PID 1040 wrote to memory of 2256	1040	msedge.exe	86
PID 1040 wrote to memory of 312	1040	msedge.exe	87
PID 1040 wrote to memory of 312	1040	msedge.exe	87
PID 1040 wrote to memory of 312	1040	msedge.exe	87
PID 1040 wrote to memory of 312	1040	msedge.exe	87
PID 1040 wrote to memory of 312	1040	msedge.exe	87
PID 1040 wrote to memory of 312	1040	msedge.exe	87
PID 1040 wrote to memory of 312	1040	msedge.exe	87
PID 1040 wrote to memory of 312	1040	msedge.exe	87
PID 1040 wrote to memory of 312	1040	msedge.exe	87
PID 1040 wrote to memory of 312	1040	msedge.exe	87
PID 1040 wrote to memory of 312	1040	msedge.exe	87
PID 1040 wrote to memory of 312	1040	msedge.exe	87
PID 1040 wrote to memory of 312	1040	msedge.exe	87
PID 1040 wrote to memory of 312	1040	msedge.exe	87
PID 1040 wrote to memory of 312	1040	msedge.exe	87
PID 1040 wrote to memory of 312	1040	msedge.exe	87
PID 1040 wrote to memory of 312	1040	msedge.exe	87
PID 1040 wrote to memory of 312	1040	msedge.exe	87
PID 1040 wrote to memory of 312	1040	msedge.exe	87
PID 1040 wrote to memory of 312	1040	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/developers/application
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe320846f8,0x7ffe32084708,0x7ffe32084718
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,11802413799362603398,14321781803389699253,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,11802413799362603398,14321781803389699253,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,11802413799362603398,14321781803389699253,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
  2⤵
  PID:312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,11802413799362603398,14321781803389699253,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,11802413799362603398,14321781803389699253,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,11802413799362603398,14321781803389699253,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,11802413799362603398,14321781803389699253,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:676
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,11802413799362603398,14321781803389699253,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,11802413799362603398,14321781803389699253,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,11802413799362603398,14321781803389699253,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,11802413799362603398,14321781803389699253,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,11802413799362603398,14321781803389699253,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2724 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2824

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6c86c838cf1dc704d2be375f04e1e6c6

SHA1
ad2911a13a3addc86cc46d4329b2b1621cbe7e35

SHA256
dff0886331bb45ec7711af92ab10be76291fde729dff23ca3270c86fb6e606bb

SHA512
a120248263919c687f09615fed56c7cac825c8c93c104488632cebc1abfa338c39ebdc191e5f0c45ff30f054f08d4c02d12b013de6322490197606ce0c0b4f37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27f3335bf37563e4537db3624ee378da

SHA1
57543abc3d97c2a2b251b446820894f4b0111aeb

SHA256
494425284ba12ee2fb07890e268be7890b258e1b1e5ecfa4a4dbc3411ab93b1a

SHA512
2bef861f9d2d916272f6014110fdee84afced515710c9d69b3c310f6bf41728d1b2d41fee3c86441ff96c08c7d474f9326e992b9164b9a3f13627f7d24d0c485

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
0d4debbf31edb52059d761de61f36b24

SHA1
14badecff28f32578b6ef25e65cd8f59846d3009

SHA256
1c0b44281cf18a4f9640907b76ccf53fa504e0a7cb6ec7cb3f9124b9a23d7721

SHA512
310bf84497109e30ef088defad7911f8eef8d2aa930829b78baf2db24a909d735c46c37258a5f72ccfe37b14c9730de83fd4faa185b18fa698b50f37b27b180d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
910B

MD5
4a2f9d00bd470e3af54bd5ab4987af60

SHA1
7ec033a7f10a2714d76e83db9bc1ebbc253ae00f

SHA256
e0ffab4031fa1a86dc542fc6f38c0140dca5559a0eefd4aff269efff6f3750a8

SHA512
69943dc13b41322655bbfed0d4f4f83177dc8a6a78b497c9ff0bb1c762e2a89996bce8ca14ca8f95fb38c638ac7f56e4a81cae3447304f39e90c31eb13cdaa1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
910B

MD5
cc57a2bec44716d1ad8e6bc25e8edc0c

SHA1
cd9d8395fa30f2cf842b30601f32f1332abba70d

SHA256
d687a1428e8c4b210a7c79edf5a272af1d7a426510701028f83fdabec71eee17

SHA512
2ec33d1fffa73de2be061b6314e4724fbc0f9522ba1ab32cb8c39e0210bfa377ac749f3616194b3626a40c55480d7f6635f4616312aa404e4ffbeec6d4b4e5dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d698d7ebb66436f17c796019bab8429f

SHA1
05bb2036ffc68ad08317f3d81d96cffad7694624

SHA256
a41275b350ed8372a43a03b24499699bd8b73e41e56633a68309545471a0bee9

SHA512
b6e8f8b29b3b41608af0a730cecea1b1f981e74006ec7a1144d6977505cc5cb7e0a601c13d7934e19869f1e187b93f56b99bff9a21d71f4fa3d4b6aec3715782

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4a5b212d4129f6556b23ce7f910be98c

SHA1
9cd00efdff21a6337295c6357537c70117118308

SHA256
b9154595a1ac8c4ac391c322c2ffffe2c36e83b3256443556b3e50de5fb8ed9b

SHA512
5c3a310627dfb89a7a3ac2005ff61bb66337b0bef6f3b631d3133505f7bc334961adc651ddc274b4e26c0199b4d1901bc28362a889188abfa34bb9558de9c298

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
93b2644a5579c1ea7f1e9975e1c22e58

SHA1
a69aa7eeea37b6a4edcd61d8e3871c926939c131

SHA256
97a9d9fec0b33a2daa3bc099ecbabaddad3c3ba0847f92f1ab7487ba13897006

SHA512
4eef153d835508dfa3024f8fa062dcc50d2b2c8ed9e947cae85c8e6a979f5dea7501e60b7d4953920f4aca74dc85334c8fd0cdff53dc4c2a9ed994f315b7be80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
af5fdda7e48bc74f2a18e7dccbf2b11e

SHA1
51bcb1ffb85542c4b687df6f567c8dd1462fb1b1

SHA256
bdb5a5baf5e02d4de5b428358bf7f458c9020e1fc015891ecbc97d1e57697bc8

SHA512
a9aaf0a1af4f807a2ab3806d8d7ab14d0dea370f38ca68656b5c7caf37590ee9e5d8fa720ce2f87fcc8d6633c32dc5bc1930eeb856e01ef61f1e59c727ef34ff

Download Submit