hxxps://discord[.]gg/nSCsGJa6X5

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/08/2024, 17:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://discord.gg/nSCsGJa6X5

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	discord.com
11	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4182098368-2521458979-3782681353-1000\{4AC47023-2018-493B-8F17-10C515BE6A7B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1472	msedge.exe
1472	msedge.exe
4172	msedge.exe
4172	msedge.exe
2368	msedge.exe
2368	msedge.exe
4496	identity_helper.exe
4496	identity_helper.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2280	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2280	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4172 wrote to memory of 4116	4172	msedge.exe	83
PID 4172 wrote to memory of 4116	4172	msedge.exe	83
PID 4172 wrote to memory of 4068	4172	msedge.exe	85
PID 4172 wrote to memory of 4068	4172	msedge.exe	85
PID 4172 wrote to memory of 4068	4172	msedge.exe	85
PID 4172 wrote to memory of 4068	4172	msedge.exe	85
PID 4172 wrote to memory of 4068	4172	msedge.exe	85
PID 4172 wrote to memory of 4068	4172	msedge.exe	85
PID 4172 wrote to memory of 4068	4172	msedge.exe	85
PID 4172 wrote to memory of 4068	4172	msedge.exe	85
PID 4172 wrote to memory of 4068	4172	msedge.exe	85
PID 4172 wrote to memory of 4068	4172	msedge.exe	85
PID 4172 wrote to memory of 4068	4172	msedge.exe	85
PID 4172 wrote to memory of 4068	4172	msedge.exe	85
PID 4172 wrote to memory of 4068	4172	msedge.exe	85
PID 4172 wrote to memory of 4068	4172	msedge.exe	85
PID 4172 wrote to memory of 4068	4172	msedge.exe	85
PID 4172 wrote to memory of 4068	4172	msedge.exe	85
PID 4172 wrote to memory of 4068	4172	msedge.exe	85
PID 4172 wrote to memory of 4068	4172	msedge.exe	85
PID 4172 wrote to memory of 4068	4172	msedge.exe	85
PID 4172 wrote to memory of 4068	4172	msedge.exe	85
PID 4172 wrote to memory of 4068	4172	msedge.exe	85
PID 4172 wrote to memory of 4068	4172	msedge.exe	85
PID 4172 wrote to memory of 4068	4172	msedge.exe	85
PID 4172 wrote to memory of 4068	4172	msedge.exe	85
PID 4172 wrote to memory of 4068	4172	msedge.exe	85
PID 4172 wrote to memory of 4068	4172	msedge.exe	85
PID 4172 wrote to memory of 4068	4172	msedge.exe	85
PID 4172 wrote to memory of 4068	4172	msedge.exe	85
PID 4172 wrote to memory of 4068	4172	msedge.exe	85
PID 4172 wrote to memory of 4068	4172	msedge.exe	85
PID 4172 wrote to memory of 4068	4172	msedge.exe	85
PID 4172 wrote to memory of 4068	4172	msedge.exe	85
PID 4172 wrote to memory of 4068	4172	msedge.exe	85
PID 4172 wrote to memory of 4068	4172	msedge.exe	85
PID 4172 wrote to memory of 4068	4172	msedge.exe	85
PID 4172 wrote to memory of 4068	4172	msedge.exe	85
PID 4172 wrote to memory of 4068	4172	msedge.exe	85
PID 4172 wrote to memory of 4068	4172	msedge.exe	85
PID 4172 wrote to memory of 4068	4172	msedge.exe	85
PID 4172 wrote to memory of 4068	4172	msedge.exe	85
PID 4172 wrote to memory of 1472	4172	msedge.exe	86
PID 4172 wrote to memory of 1472	4172	msedge.exe	86
PID 4172 wrote to memory of 5060	4172	msedge.exe	87
PID 4172 wrote to memory of 5060	4172	msedge.exe	87
PID 4172 wrote to memory of 5060	4172	msedge.exe	87
PID 4172 wrote to memory of 5060	4172	msedge.exe	87
PID 4172 wrote to memory of 5060	4172	msedge.exe	87
PID 4172 wrote to memory of 5060	4172	msedge.exe	87
PID 4172 wrote to memory of 5060	4172	msedge.exe	87
PID 4172 wrote to memory of 5060	4172	msedge.exe	87
PID 4172 wrote to memory of 5060	4172	msedge.exe	87
PID 4172 wrote to memory of 5060	4172	msedge.exe	87
PID 4172 wrote to memory of 5060	4172	msedge.exe	87
PID 4172 wrote to memory of 5060	4172	msedge.exe	87
PID 4172 wrote to memory of 5060	4172	msedge.exe	87
PID 4172 wrote to memory of 5060	4172	msedge.exe	87
PID 4172 wrote to memory of 5060	4172	msedge.exe	87
PID 4172 wrote to memory of 5060	4172	msedge.exe	87
PID 4172 wrote to memory of 5060	4172	msedge.exe	87
PID 4172 wrote to memory of 5060	4172	msedge.exe	87
PID 4172 wrote to memory of 5060	4172	msedge.exe	87
PID 4172 wrote to memory of 5060	4172	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/nSCsGJa6X5
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc603146f8,0x7ffc60314708,0x7ffc60314718
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,15518786113537727403,2730710467408237226,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,15518786113537727403,2730710467408237226,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,15518786113537727403,2730710467408237226,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,15518786113537727403,2730710467408237226,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,15518786113537727403,2730710467408237226,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,15518786113537727403,2730710467408237226,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2080,15518786113537727403,2730710467408237226,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2080,15518786113537727403,2730710467408237226,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4136 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,15518786113537727403,2730710467408237226,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,15518786113537727403,2730710467408237226,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,15518786113537727403,2730710467408237226,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,15518786113537727403,2730710467408237226,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,15518786113537727403,2730710467408237226,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,15518786113537727403,2730710467408237226,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,15518786113537727403,2730710467408237226,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,15518786113537727403,2730710467408237226,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,15518786113537727403,2730710467408237226,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,15518786113537727403,2730710467408237226,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,15518786113537727403,2730710467408237226,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,15518786113537727403,2730710467408237226,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6272 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,15518786113537727403,2730710467408237226,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,15518786113537727403,2730710467408237226,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,15518786113537727403,2730710467408237226,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,15518786113537727403,2730710467408237226,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,15518786113537727403,2730710467408237226,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,15518786113537727403,2730710467408237226,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3388 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2340

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:720

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f8 0x4e8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
600B

MD5
06479ffad7be0152eb1d7f52f8d8fcb8

SHA1
9ba1f5b27070edb23760463325cd2f09ef4d5c5d

SHA256
7671b3e1d22438244230e92a50e0e21ec9a7fa0dc9faaa8108e6cb69ded0dd1e

SHA512
4b458921d1953bffa279e38dec53cd3b50b899fa259dc4c8fd558634f0a6c54630114bc4d8b7d6b0bf4a9982b2121d0107488f50adf59a315346ef05c7a4ff94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
c2af8af61c6b4b1b4d80fc65625aba65

SHA1
4077661eafbcdd57a763e53a44657a9b458028df

SHA256
2dfd650cdf6cd3dede0811954506d6dfe3405a1e1b6c06083aa9fad3ee11b598

SHA512
fbcc5568e8658e265e4b2f4848429ec7e05b3298f5b92cb001e20739fd82fdd07409982fd196dd0803ad30ce6b98903c2ab92984d8b63fd5d26aba6d20c6a580

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
908B

MD5
ef0d2ed7d4bbcff074f6faf5c3d9ac68

SHA1
5b77d6ec1766c481916df399706a23637f6e0f76

SHA256
5cb67b08744d615351d8010f62bca45b8d1d9e3be0f4790115141839f0de17f3

SHA512
4396401464a6fac7fdeeca552d2d3b47a6ebcb570e19be56c03ad82d15e013f3f76ff84619da43a04599b85272ea8b467ffd290f28adc9114ed84df67d2b2663

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
838B

MD5
301dec1d28f8a2340a0d7a0bb500b042

SHA1
d75eb14f7f4b316ca37abdb15b38c0312670bcb6

SHA256
dd848d1808dc69cfc69fb466d84d9cde2b9b2dc275773c048713ad0cdb2050b4

SHA512
81b77291eedf938cf3fd855cce14f4958b345ba18e1d1909c89ce34a919e230e4cb1e3644889dc02edc622ba68eb50803b18f33932ea67546d39c38c7671de5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5a09296e03679f342ae77ec8c1c015cc

SHA1
333158a24fc2d013e40e7674f347e6e7aa6da5a2

SHA256
d104655b8bd7f2af2a611a7269a6e60d4e3c7c86078f804bba9f280f93e6ce09

SHA512
bedc75b01dcf24810a6444b59ecdbc1bd236790184248da9aec003c6c63ceaf75cc38923be0e35bc1cf1eba9a2f3e5b959199e7801cefe4b58ff9176ff48777c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6c2c89d7f8b7f039bdd542d4bcca655c

SHA1
f6980d15d752b6587f9d7096c47605dda1097f81

SHA256
c9a91abfc8911a971a783b1d45b23c632e91f6f63c1c62259debf0423138fc11

SHA512
15ecdf82a9509989ef9c015c0c5fca3a2d4c715156b9b6a355b770780d54ee363fce67e8b7abeb2ffe7e75f7c995a9faf4a28dbed9e1f3168a360af316a58601

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9cd730d566975b554c280eb43ddd9461

SHA1
9c9fd74000fa33f438f3036e6b0c3ca213e64c0c

SHA256
e0114eba43bbff944c24045798b4f369706b8e0a5f84a9065ee46130ec3da8d9

SHA512
3c52314a8feaaafa58cdbf454e69ff31832be5f257908be2ff4f1c80cfb335fb965c09690eb41619c1c52477f206a9d8b54ad1c24ecd9c8919652f3a343f3ab5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
59df2490c468edf88ba4a711dbd0f298

SHA1
bd2a60225b8b5a19c1ce28a0176e0f48771534e9

SHA256
406fdefaf5018345a2f11af7822b83f4b940f614788d7b21d828448d3b6d724f

SHA512
f010b67f8aca2fab0fe6c832a6c67b7f34c89c572066446c740ffb59b13cf7c4d16a7a33013b8df96871cdb57eaefd6b393795b1e411e3bcec46c25a74f1bbcb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
200f095c09bbc62180f6f24ea936e35c

SHA1
bc4a7cb8702b8363eb1c1f3c044e4f94987f50e5

SHA256
123a9187f8574adceaa9ee74db0d62af1bd7578c4795d0e019af5ae4e998479b

SHA512
611391d3618e7f77ea85f84524c44c0ee5395ed2d5265d42c9c770360fe08e3a25785bca95b064a6627f59c21254e8f9bc500c8f4798b954723890068f3f7f47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7df0f3c1f0adafda4ed82931bf937578

SHA1
76356041e9dd389b1ab325a10b85592afb299790

SHA256
267e0695157d07ad1e19b5f4752f4779e46c58968f15a188d6b3afb08719116b

SHA512
6db910d23b96ac891912062ef0df22ffb4943168381f7fdde99ed42b784a8ccbe455570fb43bd40945de571bb23dd7930babbc08ba25f55c8d8166eaf530f02a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
18f2be7309278715a55f64090ca3981e

SHA1
31146c939525e3492c72248e221395a934f14d52

SHA256
88c061bde68d21e4413536dac29dfa2dab19e50e7ec03ede56542a3ccee7e757

SHA512
43392a3f941e27c8430b1f601085d61c8671705ee695d787219bf3eb57093710eaebcd7e3b9843dbc6ebe9a8d0656ab1528f5e1a79082a9ef204732b39969c14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
98b687a2a8268e21daba8dcfaece6d5b

SHA1
8ce27d3495296303cf2c078c2e6c3bc48790fa53

SHA256
1ea9c0b1f63b0358302d4e8b51be4cdf2d8335ba4412862713d5d9c3bfff74a9

SHA512
73023fb21f3b559cac1277247ac3a782148207b1776ae802b9be53948f38bbde646194c9eaa28dc8f735db44993784782793623b723e627ef843dde1a4e26afb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57becc.TMP

Filesize
370B

MD5
5eef9551e228657125f2e7d62e878b62

SHA1
575cd80076cfcd0e39bb796ef161b8d86341aebf

SHA256
789ff1886dcfbe491f827bb22c75baef55eb32b95c26bf044eb4cb872a67339b

SHA512
1eb42a568b127a0ba686758eea9fe85bc3797c2fddeda684d29aae000b8cceb043e302be4b9f44ee88814e940de94f7ff28af51afd17727a1bd7d27d6b9e5619

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b9066290-51cb-44aa-8f4a-35bac5a6c596.tmp

Filesize
6KB

MD5
c66ceb80ea610069b39090377c821e6e

SHA1
32ace55f2164fc622996e07ff6f6d6f18ebad7af

SHA256
c4d74ce778981150d6bbd833d2d748fdfacf9a81d0c2e0050e408255c2e92c88

SHA512
aadb29b48bdfb20e7ca920e85142a994c4f1ee4f8939195f8141a25d23e531dfd4be9a23a47102bdb439bb1aba3577751270e32892156b9033d84bec79bbfd7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
adf21170b14ca3ffb888ccb4f2ba3d19

SHA1
315d86ed9ad481497cd1363cdbc4298ec090a67b

SHA256
4d02e1f06b7ff52cad6dbc3e663eabbc43dadb7340a711eb29fc47ed4c99e3fa

SHA512
143aef9c9f6e803b469dc6680c32d1f0e0cfab8bed7c379883eaf68b188720b240811fa7195cb4213fe1871bcbbbb076247232b66346b523e94f54cf7f776146

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
7274b25caa565d8091349512ac267233

SHA1
e24c0f60eaab177c49713e78634c6f45bd00a662

SHA256
7e6c799147680669f37385e663787e140c6a47a589726b3a47611ff6d8ce10ed

SHA512
806f105ecb26a9ea611b3763c073b31bbcff4f941bc20139c90012ee8c90b61a6e63d397c6c29e12e32cb941e45139c05f3238d7edadc9bf7f4225502a3be371

Download Submit