hxxp://discord[.]com

Resubmissions

19-12-2024 16:08

241219-tlpnwsvnew 7

17-12-2024 17:08

17-12-2024 16:44

17-12-2024 16:44

17-12-2024 16:43

17-12-2024 16:23

Analysis

max time kernel
1680s
max time network
1685s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
17-12-2024 16:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://discord.com

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: 6633dd5dcff475e6fb744426_&@2x.png
phishing

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	discord.com
9	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5568	msedge.exe
5568	msedge.exe
5468	msedge.exe
5468	msedge.exe
4816	msedge.exe
4816	msedge.exe
1932	identity_helper.exe
1932	identity_helper.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5468	msedge.exe
5468	msedge.exe
5468	msedge.exe
5468	msedge.exe
5468	msedge.exe
5468	msedge.exe
5468	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3948	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3948	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5468	msedge.exe
5468	msedge.exe
5468	msedge.exe
5468	msedge.exe
5468	msedge.exe
5468	msedge.exe
5468	msedge.exe
5468	msedge.exe
5468	msedge.exe
5468	msedge.exe
5468	msedge.exe
5468	msedge.exe
5468	msedge.exe
5468	msedge.exe
5468	msedge.exe
5468	msedge.exe
5468	msedge.exe
5468	msedge.exe
5468	msedge.exe
5468	msedge.exe
5468	msedge.exe
5468	msedge.exe
5468	msedge.exe
5468	msedge.exe
5468	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
5468	msedge.exe
5468	msedge.exe
5468	msedge.exe
5468	msedge.exe
5468	msedge.exe
5468	msedge.exe
5468	msedge.exe
5468	msedge.exe
5468	msedge.exe
5468	msedge.exe
5468	msedge.exe
5468	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5468 wrote to memory of 2872	5468	msedge.exe	78
PID 5468 wrote to memory of 2872	5468	msedge.exe	78
PID 5468 wrote to memory of 3336	5468	msedge.exe	79
PID 5468 wrote to memory of 3336	5468	msedge.exe	79
PID 5468 wrote to memory of 3336	5468	msedge.exe	79
PID 5468 wrote to memory of 3336	5468	msedge.exe	79
PID 5468 wrote to memory of 3336	5468	msedge.exe	79
PID 5468 wrote to memory of 3336	5468	msedge.exe	79
PID 5468 wrote to memory of 3336	5468	msedge.exe	79
PID 5468 wrote to memory of 3336	5468	msedge.exe	79
PID 5468 wrote to memory of 3336	5468	msedge.exe	79
PID 5468 wrote to memory of 3336	5468	msedge.exe	79
PID 5468 wrote to memory of 3336	5468	msedge.exe	79
PID 5468 wrote to memory of 3336	5468	msedge.exe	79
PID 5468 wrote to memory of 3336	5468	msedge.exe	79
PID 5468 wrote to memory of 3336	5468	msedge.exe	79
PID 5468 wrote to memory of 3336	5468	msedge.exe	79
PID 5468 wrote to memory of 3336	5468	msedge.exe	79
PID 5468 wrote to memory of 3336	5468	msedge.exe	79
PID 5468 wrote to memory of 3336	5468	msedge.exe	79
PID 5468 wrote to memory of 3336	5468	msedge.exe	79
PID 5468 wrote to memory of 3336	5468	msedge.exe	79
PID 5468 wrote to memory of 3336	5468	msedge.exe	79
PID 5468 wrote to memory of 3336	5468	msedge.exe	79
PID 5468 wrote to memory of 3336	5468	msedge.exe	79
PID 5468 wrote to memory of 3336	5468	msedge.exe	79
PID 5468 wrote to memory of 3336	5468	msedge.exe	79
PID 5468 wrote to memory of 3336	5468	msedge.exe	79
PID 5468 wrote to memory of 3336	5468	msedge.exe	79
PID 5468 wrote to memory of 3336	5468	msedge.exe	79
PID 5468 wrote to memory of 3336	5468	msedge.exe	79
PID 5468 wrote to memory of 3336	5468	msedge.exe	79
PID 5468 wrote to memory of 3336	5468	msedge.exe	79
PID 5468 wrote to memory of 3336	5468	msedge.exe	79
PID 5468 wrote to memory of 3336	5468	msedge.exe	79
PID 5468 wrote to memory of 3336	5468	msedge.exe	79
PID 5468 wrote to memory of 3336	5468	msedge.exe	79
PID 5468 wrote to memory of 3336	5468	msedge.exe	79
PID 5468 wrote to memory of 3336	5468	msedge.exe	79
PID 5468 wrote to memory of 3336	5468	msedge.exe	79
PID 5468 wrote to memory of 3336	5468	msedge.exe	79
PID 5468 wrote to memory of 3336	5468	msedge.exe	79
PID 5468 wrote to memory of 5568	5468	msedge.exe	80
PID 5468 wrote to memory of 5568	5468	msedge.exe	80
PID 5468 wrote to memory of 5648	5468	msedge.exe	81
PID 5468 wrote to memory of 5648	5468	msedge.exe	81
PID 5468 wrote to memory of 5648	5468	msedge.exe	81
PID 5468 wrote to memory of 5648	5468	msedge.exe	81
PID 5468 wrote to memory of 5648	5468	msedge.exe	81
PID 5468 wrote to memory of 5648	5468	msedge.exe	81
PID 5468 wrote to memory of 5648	5468	msedge.exe	81
PID 5468 wrote to memory of 5648	5468	msedge.exe	81
PID 5468 wrote to memory of 5648	5468	msedge.exe	81
PID 5468 wrote to memory of 5648	5468	msedge.exe	81
PID 5468 wrote to memory of 5648	5468	msedge.exe	81
PID 5468 wrote to memory of 5648	5468	msedge.exe	81
PID 5468 wrote to memory of 5648	5468	msedge.exe	81
PID 5468 wrote to memory of 5648	5468	msedge.exe	81
PID 5468 wrote to memory of 5648	5468	msedge.exe	81
PID 5468 wrote to memory of 5648	5468	msedge.exe	81
PID 5468 wrote to memory of 5648	5468	msedge.exe	81
PID 5468 wrote to memory of 5648	5468	msedge.exe	81
PID 5468 wrote to memory of 5648	5468	msedge.exe	81
PID 5468 wrote to memory of 5648	5468	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://discord.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff63993cb8,0x7fff63993cc8,0x7fff63993cd8
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,10835640136694201050,5442123118344205282,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,10835640136694201050,5442123118344205282,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,10835640136694201050,5442123118344205282,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10835640136694201050,5442123118344205282,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10835640136694201050,5442123118344205282,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10835640136694201050,5442123118344205282,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1916,10835640136694201050,5442123118344205282,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5092 /prefetch:8
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,10835640136694201050,5442123118344205282,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,10835640136694201050,5442123118344205282,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10835640136694201050,5442123118344205282,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10835640136694201050,5442123118344205282,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10835640136694201050,5442123118344205282,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10835640136694201050,5442123118344205282,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,10835640136694201050,5442123118344205282,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2512 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1020

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004CC 0x00000000000004C0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3d68c7edc2a288ee58e6629398bb9f7c

SHA1
6c1909dea9321c55cae38b8f16bd9d67822e2e51

SHA256
dfd733ed3cf4fb59f2041f82fdf676973783ffa75b9acca095609c7d4f73587b

SHA512
0eda66a07ec4cdb46b0f27d6c8cc157415d803af610b7430adac19547e121f380b9c6a2840f90fe49eaea9b48fa16079d93833c2bcf4b85e3c401d90d464ad2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c03d23a8155753f5a936bd7195e475bc

SHA1
cdf47f410a3ec000e84be83a3216b54331679d63

SHA256
6f5f7996d9b0e131dc2fec84859b7a8597c11a67dd41bdb5a5ef21a46e1ae0ca

SHA512
6ea9a631b454d7e795ec6161e08dbe388699012dbbc9c8cfdf73175a0ecd51204d45cf28a6f1706c8d5f1780666d95e46e4bc27752da9a9d289304f1d97c2f41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
304185d4a52bb62d6d070ca63716bc8c

SHA1
8cf8dc3806290506021ddcdab714a28e34f81dcf

SHA256
f9aca06d0a6d06f7353a35168c99ba8c483f0024f61e158bba2f9f8c54d91564

SHA512
b0c52058e137eeed5d714c46859f4e0f9ea29db5c008f323f414dd913d162b1db70e9019bc85861e6da93c3ea3ed7fd12053f9d845397e1a8d8e2aba07451439

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
f0df9fb35ae27b5163062fc6aba9521d

SHA1
0d07eba5838762877ec9aee809aa7ddecec8916c

SHA256
c34e710c7838368b9d60580a53a6844edbd910ac9f02c8cf88c3f95787e7389a

SHA512
1ccfd48b4ec57b3f377e388f227f403c5e11fd2798d4fb8ac0ea5068ca1d47f2ad802571991d0be95323129807876ac433152c86429263af3854e6a2c0d4fd21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e397b54b98677d49de417225fbf89878

SHA1
a67d764f818009066cbf9def9169f9db96e23d46

SHA256
085bf0f9b108033521f68828b87064da0fe804d0179ae5787523b669f2b83c78

SHA512
a7409f63e2ede5ca9d040aca87336d089b5de784d0b95a9900a4da4b4f588f58967fb2d667753b2bdae17e4c6a48d2bf37e21a378e74e644b8d06a0bdd0a5ad8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d8c21abfd7884243d9bf9eee5c289470

SHA1
8b88910001e01686377c348132db20f509dbca66

SHA256
d3d5759a5aa95e53517e152bc23f3d9b8d07da2b9541ade0a9242a3f29fee964

SHA512
0231f6d169f40628b1f8a8918e33685741699f679693a971e08c56278a372d7fdeca0bd9a0ee1c7a6823d03606e9647bf7ad08c0a727459d6e0bc16369e96443

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5ff54e4bc0c20f9bbecb293238392102

SHA1
3a8483578d6e21b4953cb88db136c349c18d6d7b

SHA256
9b52391e6b5ec7c1c8d9f3e1ddc77af2163ac182d21953958b0aaeee02446bee

SHA512
b2967029f081661d758e317b30f1f2df4189d8b58db01655ae0115eb1aa8bab7cc223f57c81d417ca87c08b4c6fdab76b18652a569e57861b13aad0b7f8e8d2a

Download Submit