hxxps://cdn[.]discordapp[.]com/attachments/1248986352343846982/1274313063713210368/image[.]png?ex=66c1cc05&is=66c07a85&hm=0efabae1be7e068a4ec32c494301bc9b854fd6b00ab362a2aa008cebcf2f6f70&

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17-08-2024 10:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1248986352343846982/1274313063713210368/image.png?ex=66c1cc05&is=66c07a85&hm=0efabae1be7e068a4ec32c494301bc9b854fd6b00ab362a2aa008cebcf2f6f70&

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1724	msedge.exe
1724	msedge.exe
4716	msedge.exe
4716	msedge.exe
4044	identity_helper.exe
4044	identity_helper.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 2756	4716	msedge.exe	84
PID 4716 wrote to memory of 2756	4716	msedge.exe	84
PID 4716 wrote to memory of 2004	4716	msedge.exe	85
PID 4716 wrote to memory of 2004	4716	msedge.exe	85
PID 4716 wrote to memory of 2004	4716	msedge.exe	85
PID 4716 wrote to memory of 2004	4716	msedge.exe	85
PID 4716 wrote to memory of 2004	4716	msedge.exe	85
PID 4716 wrote to memory of 2004	4716	msedge.exe	85
PID 4716 wrote to memory of 2004	4716	msedge.exe	85
PID 4716 wrote to memory of 2004	4716	msedge.exe	85
PID 4716 wrote to memory of 2004	4716	msedge.exe	85
PID 4716 wrote to memory of 2004	4716	msedge.exe	85
PID 4716 wrote to memory of 2004	4716	msedge.exe	85
PID 4716 wrote to memory of 2004	4716	msedge.exe	85
PID 4716 wrote to memory of 2004	4716	msedge.exe	85
PID 4716 wrote to memory of 2004	4716	msedge.exe	85
PID 4716 wrote to memory of 2004	4716	msedge.exe	85
PID 4716 wrote to memory of 2004	4716	msedge.exe	85
PID 4716 wrote to memory of 2004	4716	msedge.exe	85
PID 4716 wrote to memory of 2004	4716	msedge.exe	85
PID 4716 wrote to memory of 2004	4716	msedge.exe	85
PID 4716 wrote to memory of 2004	4716	msedge.exe	85
PID 4716 wrote to memory of 2004	4716	msedge.exe	85
PID 4716 wrote to memory of 2004	4716	msedge.exe	85
PID 4716 wrote to memory of 2004	4716	msedge.exe	85
PID 4716 wrote to memory of 2004	4716	msedge.exe	85
PID 4716 wrote to memory of 2004	4716	msedge.exe	85
PID 4716 wrote to memory of 2004	4716	msedge.exe	85
PID 4716 wrote to memory of 2004	4716	msedge.exe	85
PID 4716 wrote to memory of 2004	4716	msedge.exe	85
PID 4716 wrote to memory of 2004	4716	msedge.exe	85
PID 4716 wrote to memory of 2004	4716	msedge.exe	85
PID 4716 wrote to memory of 2004	4716	msedge.exe	85
PID 4716 wrote to memory of 2004	4716	msedge.exe	85
PID 4716 wrote to memory of 2004	4716	msedge.exe	85
PID 4716 wrote to memory of 2004	4716	msedge.exe	85
PID 4716 wrote to memory of 2004	4716	msedge.exe	85
PID 4716 wrote to memory of 2004	4716	msedge.exe	85
PID 4716 wrote to memory of 2004	4716	msedge.exe	85
PID 4716 wrote to memory of 2004	4716	msedge.exe	85
PID 4716 wrote to memory of 2004	4716	msedge.exe	85
PID 4716 wrote to memory of 2004	4716	msedge.exe	85
PID 4716 wrote to memory of 1724	4716	msedge.exe	86
PID 4716 wrote to memory of 1724	4716	msedge.exe	86
PID 4716 wrote to memory of 3156	4716	msedge.exe	87
PID 4716 wrote to memory of 3156	4716	msedge.exe	87
PID 4716 wrote to memory of 3156	4716	msedge.exe	87
PID 4716 wrote to memory of 3156	4716	msedge.exe	87
PID 4716 wrote to memory of 3156	4716	msedge.exe	87
PID 4716 wrote to memory of 3156	4716	msedge.exe	87
PID 4716 wrote to memory of 3156	4716	msedge.exe	87
PID 4716 wrote to memory of 3156	4716	msedge.exe	87
PID 4716 wrote to memory of 3156	4716	msedge.exe	87
PID 4716 wrote to memory of 3156	4716	msedge.exe	87
PID 4716 wrote to memory of 3156	4716	msedge.exe	87
PID 4716 wrote to memory of 3156	4716	msedge.exe	87
PID 4716 wrote to memory of 3156	4716	msedge.exe	87
PID 4716 wrote to memory of 3156	4716	msedge.exe	87
PID 4716 wrote to memory of 3156	4716	msedge.exe	87
PID 4716 wrote to memory of 3156	4716	msedge.exe	87
PID 4716 wrote to memory of 3156	4716	msedge.exe	87
PID 4716 wrote to memory of 3156	4716	msedge.exe	87
PID 4716 wrote to memory of 3156	4716	msedge.exe	87
PID 4716 wrote to memory of 3156	4716	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1248986352343846982/1274313063713210368/image.png?ex=66c1cc05&is=66c07a85&hm=0efabae1be7e068a4ec32c494301bc9b854fd6b00ab362a2aa008cebcf2f6f70&
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcc07546f8,0x7ffcc0754708,0x7ffcc0754718
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,11848729413397009323,17636270034763171,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,11848729413397009323,17636270034763171,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,11848729413397009323,17636270034763171,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11848729413397009323,17636270034763171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11848729413397009323,17636270034763171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,11848729413397009323,17636270034763171,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,11848729413397009323,17636270034763171,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11848729413397009323,17636270034763171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11848729413397009323,17636270034763171,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11848729413397009323,17636270034763171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11848729413397009323,17636270034763171,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,11848729413397009323,17636270034763171,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5660 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
476B

MD5
34d344312fc1982af9ed5d0e71064b41

SHA1
a58c83e42a33aa9a2309cac17c52d937f356097a

SHA256
d201ecbb2a18629f09b3741a059e1d3726221a7c196d25ba3153d33592a7fbed

SHA512
bf2b0af3bccc1303ecb6d8a843413893ae1aeda6043bec6937c8769e09f3bac7a756bd48151c03dcc5a39520c18def7991467d29e77942781f3ffb1c5a7c4b44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fd763785a85cd6ccb2f811128a06551f

SHA1
4a1c117b738a8113174b5ca78edd62a154039fac

SHA256
1ba1f138c673041ccf016f91592d41645780d6887a34f4cdd0e99c69da52716b

SHA512
d60f5522b50dc85bab63f0deb7cd1b2177b24bd4b6320b5e833ba612747bd3cc5231de0aa2ba96b9057f82fc2ea10e269e5f83b9e7b855a9d9a193d27f8ad4b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
afb598fc5ff1d9996c4128496093df15

SHA1
d1a3e57e7a9e6977c281d726bc77098029836b41

SHA256
6a93c1b4bc84157d667099f5a0d5994371e3f50d03d6070e63cd80521ba46aed

SHA512
cec5fa81e6e6ffdea5aea4cd731c7d586877fefc771435b2e94ae279a96978a4cf7d8b43f201b5e87649c239159384c06cf7bd63c2c987e25f7a83907a481904

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a6281b3350b331ad9ca1a4d8e44723ab

SHA1
46f0fd8db530d3009cb4320b49f705faa3ca9716

SHA256
5c2c95a69f787f1f24533179c497db68f884da3c81e52625ca7bbb1eeaad2006

SHA512
03f04247ca43433bd50c6bceb3933d37523f0ad20772fce582216bf41144c736ace2f855f7434a1f0e3f847baa3d77615d8749b0e1f50e1e993bfdd43bdc1365

Download Submit