hxxps://cdn[.]discordapp[.]com/attachments/1275558774777708666/1282084957203857419/CookiesCreator[.]exe?ex=66de1229&is=66dcc0a9&hm=f3966704c3d3793b5320d4a4f655e9305d47327f6738215cbd056044f92881b7&

Analysis

max time kernel
0s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07-09-2024 21:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1275558774777708666/1282084957203857419/CookiesCreator.exe?ex=66de1229&is=66dcc0a9&hm=f3966704c3d3793b5320d4a4f655e9305d47327f6738215cbd056044f92881b7&

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 2748	4468	msedge.exe	83
PID 4468 wrote to memory of 2748	4468	msedge.exe	83
PID 4468 wrote to memory of 512	4468	msedge.exe	86
PID 4468 wrote to memory of 512	4468	msedge.exe	86
PID 4468 wrote to memory of 512	4468	msedge.exe	86
PID 4468 wrote to memory of 512	4468	msedge.exe	86
PID 4468 wrote to memory of 512	4468	msedge.exe	86
PID 4468 wrote to memory of 512	4468	msedge.exe	86
PID 4468 wrote to memory of 512	4468	msedge.exe	86
PID 4468 wrote to memory of 512	4468	msedge.exe	86
PID 4468 wrote to memory of 512	4468	msedge.exe	86
PID 4468 wrote to memory of 512	4468	msedge.exe	86
PID 4468 wrote to memory of 512	4468	msedge.exe	86
PID 4468 wrote to memory of 512	4468	msedge.exe	86
PID 4468 wrote to memory of 512	4468	msedge.exe	86
PID 4468 wrote to memory of 512	4468	msedge.exe	86
PID 4468 wrote to memory of 512	4468	msedge.exe	86
PID 4468 wrote to memory of 512	4468	msedge.exe	86
PID 4468 wrote to memory of 512	4468	msedge.exe	86
PID 4468 wrote to memory of 512	4468	msedge.exe	86
PID 4468 wrote to memory of 512	4468	msedge.exe	86
PID 4468 wrote to memory of 512	4468	msedge.exe	86
PID 4468 wrote to memory of 512	4468	msedge.exe	86
PID 4468 wrote to memory of 512	4468	msedge.exe	86
PID 4468 wrote to memory of 512	4468	msedge.exe	86
PID 4468 wrote to memory of 512	4468	msedge.exe	86
PID 4468 wrote to memory of 512	4468	msedge.exe	86
PID 4468 wrote to memory of 512	4468	msedge.exe	86
PID 4468 wrote to memory of 512	4468	msedge.exe	86
PID 4468 wrote to memory of 512	4468	msedge.exe	86
PID 4468 wrote to memory of 512	4468	msedge.exe	86
PID 4468 wrote to memory of 512	4468	msedge.exe	86
PID 4468 wrote to memory of 512	4468	msedge.exe	86
PID 4468 wrote to memory of 512	4468	msedge.exe	86
PID 4468 wrote to memory of 512	4468	msedge.exe	86
PID 4468 wrote to memory of 512	4468	msedge.exe	86
PID 4468 wrote to memory of 512	4468	msedge.exe	86
PID 4468 wrote to memory of 512	4468	msedge.exe	86
PID 4468 wrote to memory of 512	4468	msedge.exe	86
PID 4468 wrote to memory of 512	4468	msedge.exe	86
PID 4468 wrote to memory of 512	4468	msedge.exe	86
PID 4468 wrote to memory of 512	4468	msedge.exe	86
PID 4468 wrote to memory of 4092	4468	msedge.exe	87
PID 4468 wrote to memory of 4092	4468	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1275558774777708666/1282084957203857419/CookiesCreator.exe?ex=66de1229&is=66dcc0a9&hm=f3966704c3d3793b5320d4a4f655e9305d47327f6738215cbd056044f92881b7&
1⤵
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffa4b2446f8,0x7ffa4b244708,0x7ffa4b244718
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,5628233755892755291,9059459174113867332,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,5628233755892755291,9059459174113867332,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,5628233755892755291,9059459174113867332,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,5628233755892755291,9059459174113867332,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,5628233755892755291,9059459174113867332,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,5628233755892755291,9059459174113867332,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,5628233755892755291,9059459174113867332,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,5628233755892755291,9059459174113867332,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,5628233755892755291,9059459174113867332,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2040,5628233755892755291,9059459174113867332,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,5628233755892755291,9059459174113867332,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2040,5628233755892755291,9059459174113867332,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,5628233755892755291,9059459174113867332,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,5628233755892755291,9059459174113867332,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,5628233755892755291,9059459174113867332,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4868 /prefetch:2
  2⤵
  PID:1804

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3480

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
186B

MD5
094ab275342c45551894b7940ae9ad0d

SHA1
2e7ce26fe2eb9be641ae929d0c9cc0dfa26c018e

SHA256
ef1739b833a1048ee1bd55dcbac5b1397396faca1ad771f4d6c2fe58899495a3

SHA512
19d0c688dc1121569247111e45de732b2ab86c71aecdde34b157cfd1b25c53473ed3ade49a97f8cb2ddc4711be78fa26c9330887094e031e9a71bb5c29080b0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4992c51479b7e95bb9d885dcfbeb00d6

SHA1
9521c81d0b15e5e68abbb41459b63595fe6eddcf

SHA256
ad8bbc4b20d084c44f3d38dd6101ca579445ee13c771ac98751974ecf916c4e8

SHA512
530cd4ffb6f51fc448a59fe50307eabffd936a33d3459b15891595af91e616dca054206135646c7235baacc2f2287666bd74022b662af7294ca6cbbe354d6ae4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
42fe437d644bca54c6407601d84655fa

SHA1
b12a854f43866375ec7d8c1fabd041658b30d963

SHA256
0f23d1aec1a418387d32d30e1c20a246d23f6fe3eb87cffbca7e430d584bfba6

SHA512
927153c0cbf93fcd6333647652e02e98591032b944b731bcec55131fe05a63a9b561da98de40414dc0ac8ab5a57528c05e37756d8b14122eb923ed1ec7963248

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c6bb24871abca3ba4288a08542bdf07b

SHA1
711b146ee4dcf3cc86f755a336b1ef3784b8bb95

SHA256
78c1a78b493b27c6ccae2eb23c440b0802af8db29ecf6b70eb4ff7979762d680

SHA512
4b79984d85e3dc0e924834e685965a86eebbacdf4e6345bed8efdc099f80ef59122abb6b136b2c7d91f783abb5fc67cbc6a03371bb7fba2118d910fe4bc167e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
876d595690cb385b3a899ca0d5948011

SHA1
d319fff4b816159bab668099bef4a9e8357495b5

SHA256
ad2a0fb3e0b42f9e740e9c6fa525c6a0a0a1791d109934ecbff0f802b0b28b79

SHA512
e804a87823c3462da5538d8052dae77cfed6c4ec3918b1921a82cc8151b6e5d18cc9228c030e9fa6aa563f8b6cd94aa2132e118c708fc10dcdd0761080ab55cb

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads