hxxps://cdn[.]discordapp[.]com/attachments/1267410065145593918/1 267412602447990826/setup[.]zip?ex=66a8b177&is=66a75ff7&hm= 25889dd9dddcffc74a9bfa5301612c6e4360f1a057c5e7506ad1fb4 a2463f0c4&

Analysis

max time kernel
1791s
max time network
1685s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2024, 16:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1267410065145593918/1 267412602447990826/setup.zip?ex=66a8b177&is=66a75ff7&hm= 25889dd9dddcffc74a9bfa5301612c6e4360f1a057c5e7506ad1fb4 a2463f0c4&

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1776	msedge.exe
1776	msedge.exe
3256	msedge.exe
3256	msedge.exe
4676	identity_helper.exe
4676	identity_helper.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3256 wrote to memory of 1704	3256	msedge.exe	82
PID 3256 wrote to memory of 1704	3256	msedge.exe	82
PID 3256 wrote to memory of 768	3256	msedge.exe	83
PID 3256 wrote to memory of 768	3256	msedge.exe	83
PID 3256 wrote to memory of 768	3256	msedge.exe	83
PID 3256 wrote to memory of 768	3256	msedge.exe	83
PID 3256 wrote to memory of 768	3256	msedge.exe	83
PID 3256 wrote to memory of 768	3256	msedge.exe	83
PID 3256 wrote to memory of 768	3256	msedge.exe	83
PID 3256 wrote to memory of 768	3256	msedge.exe	83
PID 3256 wrote to memory of 768	3256	msedge.exe	83
PID 3256 wrote to memory of 768	3256	msedge.exe	83
PID 3256 wrote to memory of 768	3256	msedge.exe	83
PID 3256 wrote to memory of 768	3256	msedge.exe	83
PID 3256 wrote to memory of 768	3256	msedge.exe	83
PID 3256 wrote to memory of 768	3256	msedge.exe	83
PID 3256 wrote to memory of 768	3256	msedge.exe	83
PID 3256 wrote to memory of 768	3256	msedge.exe	83
PID 3256 wrote to memory of 768	3256	msedge.exe	83
PID 3256 wrote to memory of 768	3256	msedge.exe	83
PID 3256 wrote to memory of 768	3256	msedge.exe	83
PID 3256 wrote to memory of 768	3256	msedge.exe	83
PID 3256 wrote to memory of 768	3256	msedge.exe	83
PID 3256 wrote to memory of 768	3256	msedge.exe	83
PID 3256 wrote to memory of 768	3256	msedge.exe	83
PID 3256 wrote to memory of 768	3256	msedge.exe	83
PID 3256 wrote to memory of 768	3256	msedge.exe	83
PID 3256 wrote to memory of 768	3256	msedge.exe	83
PID 3256 wrote to memory of 768	3256	msedge.exe	83
PID 3256 wrote to memory of 768	3256	msedge.exe	83
PID 3256 wrote to memory of 768	3256	msedge.exe	83
PID 3256 wrote to memory of 768	3256	msedge.exe	83
PID 3256 wrote to memory of 768	3256	msedge.exe	83
PID 3256 wrote to memory of 768	3256	msedge.exe	83
PID 3256 wrote to memory of 768	3256	msedge.exe	83
PID 3256 wrote to memory of 768	3256	msedge.exe	83
PID 3256 wrote to memory of 768	3256	msedge.exe	83
PID 3256 wrote to memory of 768	3256	msedge.exe	83
PID 3256 wrote to memory of 768	3256	msedge.exe	83
PID 3256 wrote to memory of 768	3256	msedge.exe	83
PID 3256 wrote to memory of 768	3256	msedge.exe	83
PID 3256 wrote to memory of 768	3256	msedge.exe	83
PID 3256 wrote to memory of 1776	3256	msedge.exe	84
PID 3256 wrote to memory of 1776	3256	msedge.exe	84
PID 3256 wrote to memory of 4068	3256	msedge.exe	85
PID 3256 wrote to memory of 4068	3256	msedge.exe	85
PID 3256 wrote to memory of 4068	3256	msedge.exe	85
PID 3256 wrote to memory of 4068	3256	msedge.exe	85
PID 3256 wrote to memory of 4068	3256	msedge.exe	85
PID 3256 wrote to memory of 4068	3256	msedge.exe	85
PID 3256 wrote to memory of 4068	3256	msedge.exe	85
PID 3256 wrote to memory of 4068	3256	msedge.exe	85
PID 3256 wrote to memory of 4068	3256	msedge.exe	85
PID 3256 wrote to memory of 4068	3256	msedge.exe	85
PID 3256 wrote to memory of 4068	3256	msedge.exe	85
PID 3256 wrote to memory of 4068	3256	msedge.exe	85
PID 3256 wrote to memory of 4068	3256	msedge.exe	85
PID 3256 wrote to memory of 4068	3256	msedge.exe	85
PID 3256 wrote to memory of 4068	3256	msedge.exe	85
PID 3256 wrote to memory of 4068	3256	msedge.exe	85
PID 3256 wrote to memory of 4068	3256	msedge.exe	85
PID 3256 wrote to memory of 4068	3256	msedge.exe	85
PID 3256 wrote to memory of 4068	3256	msedge.exe	85
PID 3256 wrote to memory of 4068	3256	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1267410065145593918/1 267412602447990826/setup.zip?ex=66a8b177&is=66a75ff7&hm= 25889dd9dddcffc74a9bfa5301612c6e4360f1a057c5e7506ad1fb4 a2463f0c4&
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe5fbc46f8,0x7ffe5fbc4708,0x7ffe5fbc4718
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,887502018433725622,376753681049218021,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,887502018433725622,376753681049218021,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,887502018433725622,376753681049218021,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,887502018433725622,376753681049218021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,887502018433725622,376753681049218021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,887502018433725622,376753681049218021,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,887502018433725622,376753681049218021,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,887502018433725622,376753681049218021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,887502018433725622,376753681049218021,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,887502018433725622,376753681049218021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,887502018433725622,376753681049218021,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,887502018433725622,376753681049218021,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3080 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1536

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
474B

MD5
bb902c3b0100a583b6765dcf6cac208a

SHA1
c83c39d295cf7ae11abf994e18bf754e630869a4

SHA256
6740a51bc1bb085d8d456fc04fb01e5ce7a61dc074d8db27519b6e044fdcbd7b

SHA512
2a4a84112e0b4da61a90a5087be1b43f875f75c61cb94dc1efc4920757dbacc00aed207cbbea110808107390bc44b38ba29bba721e9566589d3595990b6b8d95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
474B

MD5
e7ea3dab2c53ca944d2614723b5347d7

SHA1
3cef9de5edc675754baf91a41f77c0a7bedb8abd

SHA256
eec0e1b09c0c66b98e1ef699023ce3a2b7fe3170f07c1149d79f2d3a84e6aab1

SHA512
27b6105e9e3c450fb6b8debbcee3fbf702ba360b721cbe79a055ee214e4ec7941cbb4f29d8c1114ef80724841d354bc0f0cad7e8c2e135601a66b90d92b38e87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4d0e7790cd44381d7cf0bbd0593e6d82

SHA1
209ce15833f5c6314935ade318956d23ecd735ca

SHA256
6737af883038bed334d4ac37bc11ca88d702874b68d5217805e72beb7bb1b929

SHA512
4ad5f3fa72c2bcc188242a7054a27844dc32f0d083da01ad1cb662db05a5f90c77a0c30f98cb2b0ada4301e8998e2393622fcad95588fb612ce53dc5a9ad8b55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
68729b1800d918f65a2181e9d076a1e8

SHA1
6a617aa902c76ddb3d61dd367d0e6d21f5891659

SHA256
fd41cf0d6d3480ad3041dd68cc9df87dddbbabdbb0bc3217a5f661f8c3aaae3b

SHA512
614db6baec66196f703f149baff005e5eb6d873790d0403a3ed93d56060a972c6f84e45c8bf9ebae09981c696d0873318ebaded1c6c0e187572717e57922e114

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3c79630f0503351d694065467597a2f4

SHA1
94459d40a0307df5d7e575e3abf7f364f1fa5286

SHA256
0649a2d9950c592e9d45b522993721a3279cbeae5331320c20e9c6a774f6d5d7

SHA512
5b9be95f5fff3a2dbf244e0bbf7b1f3d9e7b4cdb701e47691a140b0991c591f7464a20fcb0dd681eca01c21c4bbd465bf26d3fbe1f6878b2ad40326aa5ee4220

Download Submit