9ee379ee8c7fd876158596597ebdb41a24d6cdbe1e28342c237b70f714c8edfa

Analysis

max time kernel
1681s
max time network
1686s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-10-2024 23:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

discord-bot-client-master/extension/popup.html
Size

164B
MD5

f773e0e5a09a22c412ce26fb6e396e6c
SHA1

ea83b9562f899318ec68e7ea5870251842fbf2da
SHA256

768707ff640ff810471b54dc014b58042b3a3983d235edbda462cf4487eea6a7
SHA512

35615bfa9dc5a5a86aa08931ee8b05a067979f5aedc690e8c76473a172ff95503d3fb8fed378da7ebe7197885470662881546857df752f3f885799163953b5e4

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1512	msedge.exe
1512	msedge.exe
2028	msedge.exe
2028	msedge.exe
384	identity_helper.exe
384	identity_helper.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2768	2028	msedge.exe	84
PID 2028 wrote to memory of 2768	2028	msedge.exe	84
PID 2028 wrote to memory of 3060	2028	msedge.exe	85
PID 2028 wrote to memory of 3060	2028	msedge.exe	85
PID 2028 wrote to memory of 3060	2028	msedge.exe	85
PID 2028 wrote to memory of 3060	2028	msedge.exe	85
PID 2028 wrote to memory of 3060	2028	msedge.exe	85
PID 2028 wrote to memory of 3060	2028	msedge.exe	85
PID 2028 wrote to memory of 3060	2028	msedge.exe	85
PID 2028 wrote to memory of 3060	2028	msedge.exe	85
PID 2028 wrote to memory of 3060	2028	msedge.exe	85
PID 2028 wrote to memory of 3060	2028	msedge.exe	85
PID 2028 wrote to memory of 3060	2028	msedge.exe	85
PID 2028 wrote to memory of 3060	2028	msedge.exe	85
PID 2028 wrote to memory of 3060	2028	msedge.exe	85
PID 2028 wrote to memory of 3060	2028	msedge.exe	85
PID 2028 wrote to memory of 3060	2028	msedge.exe	85
PID 2028 wrote to memory of 3060	2028	msedge.exe	85
PID 2028 wrote to memory of 3060	2028	msedge.exe	85
PID 2028 wrote to memory of 3060	2028	msedge.exe	85
PID 2028 wrote to memory of 3060	2028	msedge.exe	85
PID 2028 wrote to memory of 3060	2028	msedge.exe	85
PID 2028 wrote to memory of 3060	2028	msedge.exe	85
PID 2028 wrote to memory of 3060	2028	msedge.exe	85
PID 2028 wrote to memory of 3060	2028	msedge.exe	85
PID 2028 wrote to memory of 3060	2028	msedge.exe	85
PID 2028 wrote to memory of 3060	2028	msedge.exe	85
PID 2028 wrote to memory of 3060	2028	msedge.exe	85
PID 2028 wrote to memory of 3060	2028	msedge.exe	85
PID 2028 wrote to memory of 3060	2028	msedge.exe	85
PID 2028 wrote to memory of 3060	2028	msedge.exe	85
PID 2028 wrote to memory of 3060	2028	msedge.exe	85
PID 2028 wrote to memory of 3060	2028	msedge.exe	85
PID 2028 wrote to memory of 3060	2028	msedge.exe	85
PID 2028 wrote to memory of 3060	2028	msedge.exe	85
PID 2028 wrote to memory of 3060	2028	msedge.exe	85
PID 2028 wrote to memory of 3060	2028	msedge.exe	85
PID 2028 wrote to memory of 3060	2028	msedge.exe	85
PID 2028 wrote to memory of 3060	2028	msedge.exe	85
PID 2028 wrote to memory of 3060	2028	msedge.exe	85
PID 2028 wrote to memory of 3060	2028	msedge.exe	85
PID 2028 wrote to memory of 3060	2028	msedge.exe	85
PID 2028 wrote to memory of 1512	2028	msedge.exe	86
PID 2028 wrote to memory of 1512	2028	msedge.exe	86
PID 2028 wrote to memory of 2324	2028	msedge.exe	87
PID 2028 wrote to memory of 2324	2028	msedge.exe	87
PID 2028 wrote to memory of 2324	2028	msedge.exe	87
PID 2028 wrote to memory of 2324	2028	msedge.exe	87
PID 2028 wrote to memory of 2324	2028	msedge.exe	87
PID 2028 wrote to memory of 2324	2028	msedge.exe	87
PID 2028 wrote to memory of 2324	2028	msedge.exe	87
PID 2028 wrote to memory of 2324	2028	msedge.exe	87
PID 2028 wrote to memory of 2324	2028	msedge.exe	87
PID 2028 wrote to memory of 2324	2028	msedge.exe	87
PID 2028 wrote to memory of 2324	2028	msedge.exe	87
PID 2028 wrote to memory of 2324	2028	msedge.exe	87
PID 2028 wrote to memory of 2324	2028	msedge.exe	87
PID 2028 wrote to memory of 2324	2028	msedge.exe	87
PID 2028 wrote to memory of 2324	2028	msedge.exe	87
PID 2028 wrote to memory of 2324	2028	msedge.exe	87
PID 2028 wrote to memory of 2324	2028	msedge.exe	87
PID 2028 wrote to memory of 2324	2028	msedge.exe	87
PID 2028 wrote to memory of 2324	2028	msedge.exe	87
PID 2028 wrote to memory of 2324	2028	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\discord-bot-client-master\extension\popup.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd314146f8,0x7ffd31414708,0x7ffd31414718
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,162740253942382669,4346528099936215862,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,162740253942382669,4346528099936215862,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,162740253942382669,4346528099936215862,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,162740253942382669,4346528099936215862,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,162740253942382669,4346528099936215862,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,162740253942382669,4346528099936215862,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,162740253942382669,4346528099936215862,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,162740253942382669,4346528099936215862,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,162740253942382669,4346528099936215862,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,162740253942382669,4346528099936215862,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2224 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,162740253942382669,4346528099936215862,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,162740253942382669,4346528099936215862,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1124 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
22b390c7cc9586fd5fca829daa34f277

SHA1
f6aaff0f9164825d81ca6aaf32af979afbbd6cfa

SHA256
2c48f571dc054fae32edc8a5f2de22306f0510c0f1b6957a499b226d721ae695

SHA512
d74f8577744ea9d8f3323ae90746bab89ee5645ea1f149023a4cb08260f340bda9c7e895ebf22d46c05b1e093b73401268d1d0eb318066425c9e08674d379984

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fe7f695e7202be9a3fa36dd667b4f99c

SHA1
11cc5c64cfcb99585461882c97fd8cac95157f6d

SHA256
17922f54baa5ad2524efdde9b3b9f6ac65caeb807580673e74e56053e63c1afa

SHA512
43159ff8b3f2c842c921a201d976a345fc743cdeb63b0badfa849de1006640a254b554ff54c03b4e28263e761f9ec7b3e9a175ebe91380448c962f04a15260f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fcb3577cb297d4a4af9a06f815307067

SHA1
740a7780e3c7bf174b3f62964b1e0c1dc12347ad

SHA256
23ac0101858e3536c9f948e31fe0c5640f37a7fcdf46a7c3c8867957635b923a

SHA512
ee2f719d723ee81101f4cf5acc7b42837b3a6889f06c2ff5d8349a80f364c2ade4b6d4d76e35c820c1ccff4322d54cf26d8f720da52134929b79e13019b87408

Download Submit