discordrat | e7baf53a006e76c7fa1474e5708c2b051ffee09c3f597451ff9f5f4dcfc7115f

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2024, 16:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client-built.exe
Size

78KB
MD5

4235b076fd119ff2f92bcf726a818f9b
SHA1

2638f0c7eca56d7d6230df4accd76f7012fe8cee
SHA256

e7baf53a006e76c7fa1474e5708c2b051ffee09c3f597451ff9f5f4dcfc7115f
SHA512

21b5d280670e07b07bacd645948895fad8082605504ac43798df056a47d8f00e5198eb24a95a95ffa33690c0279674a11efb3d8e120aa481ba21f853a126d12b
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+LPIC:5Zv5PDwbjNrmAE+jIC

Score

10^/10

discordrat discovery persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMwMDQ0ODI3MDg2NjMxNzM3NQ.GU55ko.RPYAaa6_omciDXjceY0Fe1Ry8mFNT0SpjTvtro
server_id
1294674416755802123

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat
Downloads MZ/PE file

Legitimate hosting services abused for malware hosting/C2 1 TTPs 9 IoCs

Web Service

T1102

flow	ioc
35	discord.com
36	discord.com
46	discord.com
125	raw.githubusercontent.com
128	discord.com
129	discord.com
126	raw.githubusercontent.com
127	discord.com
130	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
2664	msedge.exe
2664	msedge.exe
4428	msedge.exe
4428	msedge.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
1388	identity_helper.exe
1388	identity_helper.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2028	Client-built.exe
Token: SeDebugPrivilege	3296	taskmgr.exe
Token: SeSystemProfilePrivilege	3296	taskmgr.exe
Token: SeCreateGlobalPrivilege	3296	taskmgr.exe
Token: 33	3296	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3296	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4428 wrote to memory of 700	4428	msedge.exe	91
PID 4428 wrote to memory of 700	4428	msedge.exe	91
PID 4428 wrote to memory of 3076	4428	msedge.exe	92
PID 4428 wrote to memory of 3076	4428	msedge.exe	92
PID 4428 wrote to memory of 3076	4428	msedge.exe	92
PID 4428 wrote to memory of 3076	4428	msedge.exe	92
PID 4428 wrote to memory of 3076	4428	msedge.exe	92
PID 4428 wrote to memory of 3076	4428	msedge.exe	92
PID 4428 wrote to memory of 3076	4428	msedge.exe	92
PID 4428 wrote to memory of 3076	4428	msedge.exe	92
PID 4428 wrote to memory of 3076	4428	msedge.exe	92
PID 4428 wrote to memory of 3076	4428	msedge.exe	92
PID 4428 wrote to memory of 3076	4428	msedge.exe	92
PID 4428 wrote to memory of 3076	4428	msedge.exe	92
PID 4428 wrote to memory of 3076	4428	msedge.exe	92
PID 4428 wrote to memory of 3076	4428	msedge.exe	92
PID 4428 wrote to memory of 3076	4428	msedge.exe	92
PID 4428 wrote to memory of 3076	4428	msedge.exe	92
PID 4428 wrote to memory of 3076	4428	msedge.exe	92
PID 4428 wrote to memory of 3076	4428	msedge.exe	92
PID 4428 wrote to memory of 3076	4428	msedge.exe	92
PID 4428 wrote to memory of 3076	4428	msedge.exe	92
PID 4428 wrote to memory of 3076	4428	msedge.exe	92
PID 4428 wrote to memory of 3076	4428	msedge.exe	92
PID 4428 wrote to memory of 3076	4428	msedge.exe	92
PID 4428 wrote to memory of 3076	4428	msedge.exe	92
PID 4428 wrote to memory of 3076	4428	msedge.exe	92
PID 4428 wrote to memory of 3076	4428	msedge.exe	92
PID 4428 wrote to memory of 3076	4428	msedge.exe	92
PID 4428 wrote to memory of 3076	4428	msedge.exe	92
PID 4428 wrote to memory of 3076	4428	msedge.exe	92
PID 4428 wrote to memory of 3076	4428	msedge.exe	92
PID 4428 wrote to memory of 3076	4428	msedge.exe	92
PID 4428 wrote to memory of 3076	4428	msedge.exe	92
PID 4428 wrote to memory of 3076	4428	msedge.exe	92
PID 4428 wrote to memory of 3076	4428	msedge.exe	92
PID 4428 wrote to memory of 3076	4428	msedge.exe	92
PID 4428 wrote to memory of 3076	4428	msedge.exe	92
PID 4428 wrote to memory of 3076	4428	msedge.exe	92
PID 4428 wrote to memory of 3076	4428	msedge.exe	92
PID 4428 wrote to memory of 3076	4428	msedge.exe	92
PID 4428 wrote to memory of 3076	4428	msedge.exe	92
PID 4428 wrote to memory of 2664	4428	msedge.exe	93
PID 4428 wrote to memory of 2664	4428	msedge.exe	93
PID 4428 wrote to memory of 2920	4428	msedge.exe	94
PID 4428 wrote to memory of 2920	4428	msedge.exe	94
PID 4428 wrote to memory of 2920	4428	msedge.exe	94
PID 4428 wrote to memory of 2920	4428	msedge.exe	94
PID 4428 wrote to memory of 2920	4428	msedge.exe	94
PID 4428 wrote to memory of 2920	4428	msedge.exe	94
PID 4428 wrote to memory of 2920	4428	msedge.exe	94
PID 4428 wrote to memory of 2920	4428	msedge.exe	94
PID 4428 wrote to memory of 2920	4428	msedge.exe	94
PID 4428 wrote to memory of 2920	4428	msedge.exe	94
PID 4428 wrote to memory of 2920	4428	msedge.exe	94
PID 4428 wrote to memory of 2920	4428	msedge.exe	94
PID 4428 wrote to memory of 2920	4428	msedge.exe	94
PID 4428 wrote to memory of 2920	4428	msedge.exe	94
PID 4428 wrote to memory of 2920	4428	msedge.exe	94
PID 4428 wrote to memory of 2920	4428	msedge.exe	94
PID 4428 wrote to memory of 2920	4428	msedge.exe	94
PID 4428 wrote to memory of 2920	4428	msedge.exe	94
PID 4428 wrote to memory of 2920	4428	msedge.exe	94
PID 4428 wrote to memory of 2920	4428	msedge.exe	94

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb62eb46f8,0x7ffb62eb4708,0x7ffb62eb4718
  2⤵
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,5404124457198629705,3571492851873304669,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,5404124457198629705,3571492851873304669,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,5404124457198629705,3571492851873304669,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:8
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,5404124457198629705,3571492851873304669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,5404124457198629705,3571492851873304669,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,5404124457198629705,3571492851873304669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,5404124457198629705,3571492851873304669,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,5404124457198629705,3571492851873304669,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4668 /prefetch:8
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,5404124457198629705,3571492851873304669,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4668 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,5404124457198629705,3571492851873304669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,5404124457198629705,3571492851873304669,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,5404124457198629705,3571492851873304669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,5404124457198629705,3571492851873304669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:5368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,5404124457198629705,3571492851873304669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,5404124457198629705,3571492851873304669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,5404124457198629705,3571492851873304669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1964 /prefetch:1
  2⤵
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,5404124457198629705,3571492851873304669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2308 /prefetch:1
  2⤵
  PID:6036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1432

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7cb450b1315c63b1d5d89d98ba22da5

SHA1
694005cd9e1a4c54e0b83d0598a8a0c089df1556

SHA256
38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

SHA512
df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37f660dd4b6ddf23bc37f5c823d1c33a

SHA1
1c35538aa307a3e09d15519df6ace99674ae428b

SHA256
4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

SHA512
807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
79e86ee14c299becfc22e8a78c05f0b8

SHA1
1fdb0abcff4dc87efe47ea0dd85a2c93dbc516ef

SHA256
9de20624059445fc333efccb7ce95f06a88407b1d015289c6343f5e1a95b1cc4

SHA512
29866b36e7d4a8ab5c7dc3bbcde8ef0921b26679c9d689bc7457e809b3da26b859610705f8f8ebb431ee6da5725da8e58421a29bec2949ae5784332d59cd854b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d39d3ef24f437b08b1318dbd7834391f

SHA1
f9de1d296c28826c26916a87d745c9fd277fd495

SHA256
ea1575a01e721c013e1b38c6ef37fdf768a85dece74b66f79d3d259afeeb6af3

SHA512
96fac970d17d8b72b25a3adebfd427adfcab9bea169f372b7bcad29ed783d1a3cb17dde577b9567a78fb822211e7aaf8c435caf832603cb93e2bae79aa6d2373

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
000329678b440c797ca8651aa850b2aa

SHA1
ad7d20986b17fd86ed4e44ce2f4051290d9551ed

SHA256
230cf4f2ccdd10a73bca239542cff7143e6322524f6e7f86e1bd881bd5df1a10

SHA512
bb725e3d827204ac5cb0872da1d8e4512accae06a4d29519ac5cdd40fdc696e29b494037d29618a3ae21de7934d37048f3c821a9ddf51a41ee613de6fb22f151

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c7ad562aaef7d3dee32dccec75cba80c

SHA1
000c255e4c93a7cdf975dacd201f8a581f72c8db

SHA256
89a7367bb6b101473d87e3971f9b2f7a51de26a6654c87a6779ca9da94b43bb5

SHA512
0a6c53b1de80c7d942f0fe67b8c784ca4e41fed3818a7c56f6fdab394861ed3f9ab5764559d7b2ca97c0a3a653b181786ded3af363a2c0ce2498f78fda1ba027

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
918b8b046d38c8448f266645b3d1a042

SHA1
22028f3d02923329229cdf075855131ec18359f0

SHA256
c6a4cb10364148232720d52990071db23971c492c1325824ae9b77913b458735

SHA512
568778096c745ef0a9e03fc91b1f083367e964aecaf080c465becbf54be48da71633c4c378855aedb5812b4731b9e1e3ab65b6dba4565c194aea002ba402e8e8

Download Submit
memory/2028-47-0x00000242D55A0000-0x00000242D5AC8000-memory.dmp

Filesize
5.2MB

Download
memory/2028-0-0x00007FFB68253000-0x00007FFB68255000-memory.dmp

Filesize
8KB

Download
memory/2028-311-0x00000242BC470000-0x00000242BC47E000-memory.dmp

Filesize
56KB

Download
memory/2028-1-0x00000242BA770000-0x00000242BA788000-memory.dmp

Filesize
96KB

Download
memory/2028-2-0x00000242D4DA0000-0x00000242D4F62000-memory.dmp

Filesize
1.8MB

Download
memory/2028-3-0x00007FFB68250000-0x00007FFB68D11000-memory.dmp

Filesize
10.8MB

Download
memory/2028-57-0x00007FFB68250000-0x00007FFB68D11000-memory.dmp

Filesize
10.8MB

Download
memory/2028-56-0x00007FFB68253000-0x00007FFB68255000-memory.dmp

Filesize
8KB

Download
memory/3296-38-0x000001EC24A20000-0x000001EC24A21000-memory.dmp

Filesize
4KB

Download
memory/3296-35-0x000001EC24A20000-0x000001EC24A21000-memory.dmp

Filesize
4KB

Download
memory/3296-29-0x000001EC24A20000-0x000001EC24A21000-memory.dmp

Filesize
4KB

Download
memory/3296-36-0x000001EC24A20000-0x000001EC24A21000-memory.dmp

Filesize
4KB

Download
memory/3296-37-0x000001EC24A20000-0x000001EC24A21000-memory.dmp

Filesize
4KB

Download
memory/3296-28-0x000001EC24A20000-0x000001EC24A21000-memory.dmp

Filesize
4KB

Download
memory/3296-30-0x000001EC24A20000-0x000001EC24A21000-memory.dmp

Filesize
4KB

Download
memory/3296-39-0x000001EC24A20000-0x000001EC24A21000-memory.dmp

Filesize
4KB

Download
memory/3296-40-0x000001EC24A20000-0x000001EC24A21000-memory.dmp

Filesize
4KB

Download
memory/3296-34-0x000001EC24A20000-0x000001EC24A21000-memory.dmp

Filesize
4KB

Download