discordrat | 2bd631c6665656673a923c13359b0dc211debc05b2885127e26b0dce808e2dec

Analysis

max time kernel
111s
max time network
113s
platform
windows11-21h2_x64
resource
win11-20250207-en
resource tags

arch:x64arch:x86image:win11-20250207-enlocale:en-usos:windows11-21h2-x64system
submitted
09/02/2025, 10:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Discord rat.exe
Size

79KB
MD5

d13905e018eb965ded2e28ba0ab257b5
SHA1

6d7fe69566fddc69b33d698591c9a2c70d834858
SHA256

2bd631c6665656673a923c13359b0dc211debc05b2885127e26b0dce808e2dec
SHA512

b95bfdebef33ac72b6c21cdf0abb4961222b7efd17267cd7236e731dd0b6105ece28e784a95455f1ffc8a6dd1d580a467b07b3bd8cb2fb19e2111f1a864c97cb
SSDEEP

1536:YCH0jBD2BKkwbPNrfxCXhRoKV6+V+y9viwp:VUjBD2BPwbPNrmAE+MqU

Score

10^/10

discordrat discovery persistence privilege_escalation rat rootkit stealer

Malware Config

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}"	OneDrive.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OneDrive.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wermgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5048	MicrosoftEdgeUpdate.exe
3520	MicrosoftEdgeUpdate.exe
1820	MicrosoftEdgeUpdate.exe

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	wermgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OneDrive.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OneDrive.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	OneDrive.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OneDrive.exe = "11000"	OneDrive.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\Interface\{53de12aa-df96-413d-a25e-c75b6528abf2}\ProxyStubClsid32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\WOW6432Node\Interface\{C2FE84F5-E036-4A07-950C-9BFD3EAB983A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\Interface\{B54E7079-90C9-4C62-A6B8-B2834C33A04A}\ = "IGetSpecialFolderInfoCallback"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\WOW6432Node\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}\ProgID\ = "FileSyncClient.FileSyncClient.1"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\Interface\{ACDB5DB0-C9D5-461C-BAAA-5DCE0B980E40}\TypeLib\Version = "1.0"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\SyncEngineFileInfoProvider.SyncEngineFileInfoProvider	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\Interface\{B05D37A9-03A2-45CF-8850-F660DF0CBF07}	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\WOW6432Node\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B}\TypeLib	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\TypeLib\{909A6CCD-6810-46C4-89DF-05BE7EB61E6C}\1.0\FLAGS\ = "0"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\WOW6432Node\Interface\{a7126d4c-f492-4eb9-8a2a-f673dbdd3334}\TypeLib	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\WOW6432Node\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\WOW6432Node\Interface\{466F31F7-9892-477E-B189-FA5C59DE3603}\TypeLib	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\WOW6432Node\Interface\{EE15BBBB-9E60-4C52-ABCB-7540FF3DF6B3}\ = "IFileSyncClient9"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\Interface\{EA23A664-A558-4548-A8FE-A6B94D37C3CF}\TypeLib	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\WOW6432Node\Interface\{AEEBAD4E-3E0A-415B-9B94-19C499CD7B6A}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\WOW6432Node\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\VersionIndependentProgID\ = "StorageProviderUriSource.StorageProviderUriSource"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\FileSyncClient.AutoPlayHandler\CLSID\ = "{5999E1EE-711E-48D2-9884-851A709F543D}"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\WOW6432Node\CLSID\{5999E1EE-711E-48D2-9884-851A709F543D}\VersionIndependentProgID\ = "FileSyncClient.AutoPlayHandler"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\Interface\{f0440f4e-4884-4a8F-8a45-ba89c00f96f2}\ = "IUnmapLibraryCallback"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\WOW6432Node\Interface\{0776ae27-5ab9-4e18-9063-1836da63117a}\ProxyStubClsid32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\Interface\{049FED7E-C3EA-4B66-9D92-10E8085D60FB}\TypeLib	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\WOW6432Node\Interface\{869BDA08-7ACF-42B8-91AE-4D8D597C0B33}\TypeLib\Version = "1.0"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\WOW6432Node\Interface\{AEEBAD4E-3E0A-415B-9B94-19C499CD7B6A}\TypeLib	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\Interface\{fac14b75-7862-4ceb-be41-f53945a61c17}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\WOW6432Node\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32\ThreadingModel = "Apartment"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\WOW6432Node\Interface\{869BDA08-7ACF-42B8-91AE-4D8D597C0B33}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\CLSID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}\ = "FileSync ThumbnailProvider"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\BannerNotificationHandler.BannerNotificationHandler.1	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\WOW6432Node\Interface\{da82e55e-fa2f-45b3-aec3-e7294106ef52}\TypeLib\ = "{909A6CCD-6810-46C4-89DF-05BE7EB61E6C}"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\Interface\{F062BA81-ADFE-4A92-886A-23FD851D6406}\ProxyStubClsid32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\WOW6432Node\Interface\{AF60000F-661D-472A-9588-F062F6DB7A0E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\Interface\{1b7aed4f-fcaf-4da4-8795-c03e635d8edc}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\WOW6432Node\Interface\{a7126d4c-f492-4eb9-8a2a-f673dbdd3334}\ProxyStubClsid32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\WOW6432Node\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\InprocServer32\ThreadingModel = "Apartment"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\Interface\{466F31F7-9892-477E-B189-FA5C59DE3603}\ProxyStubClsid32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\WOW6432Node\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B}\ProgID	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\SyncEngineStorageProviderHandlerProxy.SyncEngineStorageProviderHandlerProxy\ = "SyncEngineStorageProviderHandlerProxy Class"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\Interface\{8B9F14F4-9559-4A3F-B7D0-312E992B6D98}\ = "IGetSelectiveSyncInformationCallback"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\TypeLib	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\WOW6432Node\CLSID\{5999E1EE-711E-48D2-9884-851A709F543D}\ = "FileSyncClient AutoPlayHandler Class"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\WOW6432Node\Interface\{EE15BBBB-9E60-4C52-ABCB-7540FF3DF6B3}	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\ = "UpToDateUnpinnedOverlayHandler Class"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\WOW6432Node\Interface\{31508CC7-9BC7-494B-9D0F-7B1C7F144182}\TypeLib\ = "{C9F3F6BB-3172-4CD8-9EB7-37C9BE601C87}"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9}\TypeLib\ = "{638805C3-4BA3-4AC8-8AAC-71A0BA2BC284}"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\WOW6432Node\CLSID\{5999E1EE-711E-48D2-9884-851A709F543D}\ProgID\ = "FileSyncClient.AutoPlayHandler.1"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\WOW6432Node\Interface\{0f872661-c863-47a4-863f-c065c182858a}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\Interface\{8D3F8F15-1DE1-4662-BF93-762EABE988B2}\TypeLib\ = "{909A6CCD-6810-46C4-89DF-05BE7EB61E6C}"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\WOW6432Node\Interface\{0f872661-c863-47a4-863f-c065c182858a}	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\Interface\{c1439245-96b4-47fc-b391-679386c5d40f}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\WOW6432Node\Interface\{1B71F23B-E61F-45C9-83BA-235D55F50CF9}\TypeLib\Version = "1.0"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\WOW6432Node\Interface\{2F12C599-7AA5-407A-B898-09E6E4ED2D1E}\TypeLib\Version = "1.0"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\WOW6432Node\Interface\{79A2A54C-3916-41FD-9FAB-F26ED0BBA755}\TypeLib\ = "{909A6CCD-6810-46C4-89DF-05BE7EB61E6C}"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\Interface\{0d4e4444-cb20-4c2b-b8b2-94e5656ecae8}\ProxyStubClsid32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\WOW6432Node\Interface\{9E1CD0DF-72E7-4284-9598-342C0A46F96B}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\Interface\{869BDA08-7ACF-42B8-91AE-4D8D597C0B33}\ = "ISyncEngineBandwidthLimiter"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\AppID\OneDrive.EXE	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\WOW6432Node\Interface\{ACDB5DB0-C9D5-461C-BAAA-5DCE0B980E40}	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\Interface\{02C98E2C-6C9F-49F8-9B57-3A6E1AA09A67}\ = "ISyncInformationLookupCallback"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\WOW6432Node\CLSID\{2e7c0a19-0438-41e9-81e3-3ad3d64f55ba}\ = "BannerNotificationHandler Class"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\Interface\{F0AF7C30-EAE4-4644-961D-54E6E28708D6}\TypeLib	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1113119086-3642147062-910976179-1000_Classes\WOW6432Node\Interface\{a7126d4c-f492-4eb9-8a2a-f673dbdd3334}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDrive.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5208	OneDrive.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5208	OneDrive.exe
5208	OneDrive.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2248	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3824	Discord rat.exe
Token: SeDebugPrivilege	4124	firefox.exe
Token: SeDebugPrivilege	4124	firefox.exe

Suspicious use of FindShellTrayWindow 24 IoCs

pid	Process
4124	firefox.exe
4124	firefox.exe
4124	firefox.exe
4124	firefox.exe
4124	firefox.exe
4124	firefox.exe
4124	firefox.exe
4124	firefox.exe
4124	firefox.exe
4124	firefox.exe
4124	firefox.exe
4124	firefox.exe
4124	firefox.exe
4124	firefox.exe
4124	firefox.exe
4124	firefox.exe
4124	firefox.exe
4124	firefox.exe
4124	firefox.exe
4124	firefox.exe
4124	firefox.exe
5208	OneDrive.exe
5208	OneDrive.exe
5208	OneDrive.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5208	OneDrive.exe
5208	OneDrive.exe
5208	OneDrive.exe

Suspicious use of SetWindowsHookEx 23 IoCs

pid	Process
2248	OpenWith.exe
2248	OpenWith.exe
2248	OpenWith.exe
2248	OpenWith.exe
2248	OpenWith.exe
2248	OpenWith.exe
2248	OpenWith.exe
2248	OpenWith.exe
2248	OpenWith.exe
2248	OpenWith.exe
2248	OpenWith.exe
2248	OpenWith.exe
2248	OpenWith.exe
2248	OpenWith.exe
2248	OpenWith.exe
2248	OpenWith.exe
2248	OpenWith.exe
2248	OpenWith.exe
2248	OpenWith.exe
2248	OpenWith.exe
2248	OpenWith.exe
4124	firefox.exe
5208	OneDrive.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 1072	2248	OpenWith.exe	103
PID 2248 wrote to memory of 1072	2248	OpenWith.exe	103
PID 1072 wrote to memory of 4124	1072	firefox.exe	106
PID 1072 wrote to memory of 4124	1072	firefox.exe	106
PID 1072 wrote to memory of 4124	1072	firefox.exe	106
PID 1072 wrote to memory of 4124	1072	firefox.exe	106
PID 1072 wrote to memory of 4124	1072	firefox.exe	106
PID 1072 wrote to memory of 4124	1072	firefox.exe	106
PID 1072 wrote to memory of 4124	1072	firefox.exe	106
PID 1072 wrote to memory of 4124	1072	firefox.exe	106
PID 1072 wrote to memory of 4124	1072	firefox.exe	106
PID 1072 wrote to memory of 4124	1072	firefox.exe	106
PID 1072 wrote to memory of 4124	1072	firefox.exe	106
PID 4124 wrote to memory of 3464	4124	firefox.exe	108
PID 4124 wrote to memory of 3464	4124	firefox.exe	108
PID 4124 wrote to memory of 3464	4124	firefox.exe	108
PID 4124 wrote to memory of 3464	4124	firefox.exe	108
PID 4124 wrote to memory of 3464	4124	firefox.exe	108
PID 4124 wrote to memory of 3464	4124	firefox.exe	108
PID 4124 wrote to memory of 3464	4124	firefox.exe	108
PID 4124 wrote to memory of 3464	4124	firefox.exe	108
PID 4124 wrote to memory of 3464	4124	firefox.exe	108
PID 4124 wrote to memory of 3464	4124	firefox.exe	108
PID 4124 wrote to memory of 3464	4124	firefox.exe	108
PID 4124 wrote to memory of 3464	4124	firefox.exe	108
PID 4124 wrote to memory of 3464	4124	firefox.exe	108
PID 4124 wrote to memory of 3464	4124	firefox.exe	108
PID 4124 wrote to memory of 3464	4124	firefox.exe	108
PID 4124 wrote to memory of 3464	4124	firefox.exe	108
PID 4124 wrote to memory of 3464	4124	firefox.exe	108
PID 4124 wrote to memory of 3464	4124	firefox.exe	108
PID 4124 wrote to memory of 3464	4124	firefox.exe	108
PID 4124 wrote to memory of 3464	4124	firefox.exe	108
PID 4124 wrote to memory of 3464	4124	firefox.exe	108
PID 4124 wrote to memory of 3464	4124	firefox.exe	108
PID 4124 wrote to memory of 3464	4124	firefox.exe	108
PID 4124 wrote to memory of 3464	4124	firefox.exe	108
PID 4124 wrote to memory of 3464	4124	firefox.exe	108
PID 4124 wrote to memory of 3464	4124	firefox.exe	108
PID 4124 wrote to memory of 3464	4124	firefox.exe	108
PID 4124 wrote to memory of 3464	4124	firefox.exe	108
PID 4124 wrote to memory of 3464	4124	firefox.exe	108
PID 4124 wrote to memory of 3464	4124	firefox.exe	108
PID 4124 wrote to memory of 3464	4124	firefox.exe	108
PID 4124 wrote to memory of 3464	4124	firefox.exe	108
PID 4124 wrote to memory of 3464	4124	firefox.exe	108
PID 4124 wrote to memory of 3464	4124	firefox.exe	108
PID 4124 wrote to memory of 3464	4124	firefox.exe	108
PID 4124 wrote to memory of 3464	4124	firefox.exe	108
PID 4124 wrote to memory of 3464	4124	firefox.exe	108
PID 4124 wrote to memory of 3464	4124	firefox.exe	108
PID 4124 wrote to memory of 3464	4124	firefox.exe	108
PID 4124 wrote to memory of 3464	4124	firefox.exe	108
PID 4124 wrote to memory of 3464	4124	firefox.exe	108
PID 4124 wrote to memory of 3464	4124	firefox.exe	108
PID 4124 wrote to memory of 3464	4124	firefox.exe	108
PID 4124 wrote to memory of 3464	4124	firefox.exe	108
PID 4124 wrote to memory of 3464	4124	firefox.exe	108
PID 4124 wrote to memory of 1596	4124	firefox.exe	109
PID 4124 wrote to memory of 1596	4124	firefox.exe	109
PID 4124 wrote to memory of 1596	4124	firefox.exe	109
PID 4124 wrote to memory of 1596	4124	firefox.exe	109
PID 4124 wrote to memory of 1596	4124	firefox.exe	109
PID 4124 wrote to memory of 1596	4124	firefox.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Discord rat.exe
"C:\Users\Admin\AppData\Local\Temp\Discord rat.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=5440,i,1394014676065102427,603922297840707476,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:14
1⤵
PID:4788

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2160

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MTkxQjhCRUMtM0ZENi00QjFGLTlBRjQtODFGQjBDREM3QzNCfSIgdXNlcmlkPSJ7RTcyNjZBNTgtNDc1OC00QURDLUFBODktOEEzRTI4MTlCNzZFfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7OEJFQUVBQjUtN0ZBNi00MjhFLThEMjEtRDJFQjZENjI2NUM3fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RSt4YkF6Nlk2c1UxMjg5YlM2cWw0VlJMYmtqZkJVR1RNSnNqckhyNDRpST0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjEiIGluc3RhbGxkYXRldGltZT0iMTczODk1NTAyNyIgb29iZV9pbnN0YWxsX3RpbWU9IjEzMzgzNDI3NjIxMTgwMDAwMCI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjIxNzk4NjIiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEwNjgwMzUzNzI5Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:1820

C:\Windows\SysWOW64\wermgr.exe
"C:\Windows\system32\wermgr.exe" "-outproc" "0" "992" "1276" "1176" "1280" "0" "0" "0" "0" "0" "0" "0" "0"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
PID:2916

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MTkxQjhCRUMtM0ZENi00QjFGLTlBRjQtODFGQjBDREM3QzNCfSIgdXNlcmlkPSJ7RTcyNjZBNTgtNDc1OC00QURDLUFBODktOEEzRTI4MTlCNzZFfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9InsyRTUzRTZGNy1DNTA0LTQ4OTctQkE3MC02N0FFNDEzNTRBODh9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iMiIgcGh5c21lbW9yeT0iNCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins1NkVCMThGOC1CMDA4LTRDQkQtQjZEMi04Qzk3RkU3RTkwNjJ9IiB2ZXJzaW9uPSIxMzIuMC4yOTU3LjE0MCIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjEiIGluc3RhbGxkYXRldGltZT0iMTczODk1NDU0OSI-PGV2ZW50IGV2ZW50dHlwZT0iMzIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjQiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEwNjg5MjYwMDgyIi8-PC9hcHA-PC9yZXF1ZXN0Pg
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:5048

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MTkxQjhCRUMtM0ZENi00QjFGLTlBRjQtODFGQjBDREM3QzNCfSIgdXNlcmlkPSJ7RTcyNjZBNTgtNDc1OC00QURDLUFBODktOEEzRTI4MTlCNzZFfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9InsxNDY3MEYwNS1FQkM1LTQyQ0EtQkVBOC00OUJENTE1Mjg4MTh9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iMiIgcGh5c21lbW9yeT0iNCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTk1LjQzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMSIgY29ob3J0PSJycmZAMC40OCI-PHVwZGF0ZWNoZWNrLz48cGluZyByPSIyIiByZD0iNjYxMiIgcGluZ19mcmVzaG5lc3M9IntENTQ1NTQwOC0yQTMxLTQ4NjgtODE1My0zQjRDRDBDMzcxMDZ9Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjEzMi4wLjI5NTcuMTQwIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9IjEiIGNvaG9ydD0icnJmQDAuMjAiIG9vYmVfaW5zdGFsbF90aW1lPSIxODQ0Njc0NDA3MzcwOTU1MTYwNiIgdXBkYXRlX2NvdW50PSIxIiBsYXN0X2xhdW5jaF9jb3VudD0iMSIgbGFzdF9sYXVuY2hfdGltZT0iMTMzODM0MzIxNTY1MTMxNDYwIj48dXBkYXRlY2hlY2svPjxwaW5nIGFjdGl2ZT0iMSIgYT0iMiIgcj0iMiIgYWQ9IjY2MTIiIHJkPSI2NjEyIiBwaW5nX2ZyZXNobmVzcz0iezZDQzI2QUE4LUU3OUQtNDAyQS1BOERELTM4OUVBRDM5NEIxNX0iLz48L2FwcD48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iMTMyLjAuMjk1Ny4xNDAiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxIiBjb2hvcnQ9InJyZkAwLjI4IiB1cGRhdGVfY291bnQ9IjEiPjx1cGRhdGVjaGVjay8-PHBpbmcgcj0iMiIgcmQ9IjY2MTIiIHBpbmdfZnJlc2huZXNzPSJ7NDYxMTFDMUMtMDc4Mi00NkI2LUJEQkItQkU2OUVCRTk0MjI4fSIvPjwvYXBwPjwvcmVxdWVzdD4
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:3520

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
PID:3320

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Desktop\StartNew.rar"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Desktop\StartNew.rar
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4124
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1940 -parentBuildID 20240401114208 -prefsHandle 1848 -prefMapHandle 1840 -prefsLen 27429 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c28d1092-3526-4114-a3c2-8c73be533855} 4124 "\\.\pipe\gecko-crash-server-pipe.4124" gpu
      4⤵
      PID:3464
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2420 -parentBuildID 20240401114208 -prefsHandle 2412 -prefMapHandle 2280 -prefsLen 28349 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c0764791-b9b5-454a-b7df-9dcdbd986eb6} 4124 "\\.\pipe\gecko-crash-server-pipe.4124" socket
      4⤵
      Checks processor information in registry
      PID:1596
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3280 -childID 1 -isForBrowser -prefsHandle 3292 -prefMapHandle 2952 -prefsLen 28490 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2ed63bae-b719-41da-8e37-8bf5855ec212} 4124 "\\.\pipe\gecko-crash-server-pipe.4124" tab
      4⤵
      PID:3532
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3208 -childID 2 -isForBrowser -prefsHandle 3076 -prefMapHandle 2752 -prefsLen 32839 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f1df3d32-2690-4e78-9329-6330af0df957} 4124 "\\.\pipe\gecko-crash-server-pipe.4124" tab
      4⤵
      PID:896
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4664 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4712 -prefMapHandle 4708 -prefsLen 32839 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {79ce20f7-3c51-4b8b-bb17-39d423be17dd} 4124 "\\.\pipe\gecko-crash-server-pipe.4124" utility
      4⤵
      Checks processor information in registry
      PID:5780
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5752 -childID 3 -isForBrowser -prefsHandle 5744 -prefMapHandle 5740 -prefsLen 27226 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8af254b3-a28e-4361-a9e2-893470663348} 4124 "\\.\pipe\gecko-crash-server-pipe.4124" tab
      4⤵
      PID:5240
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5788 -childID 4 -isForBrowser -prefsHandle 5864 -prefMapHandle 5860 -prefsLen 27226 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a3825520-ffa0-44e6-819f-a424ccbbb3d3} 4124 "\\.\pipe\gecko-crash-server-pipe.4124" tab
      4⤵
      PID:5252
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6016 -childID 5 -isForBrowser -prefsHandle 5760 -prefMapHandle 5764 -prefsLen 27226 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a8851e41-8cd2-4a95-8cc6-ae25d0e955dd} 4124 "\\.\pipe\gecko-crash-server-pipe.4124" tab
      4⤵
      PID:5264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2552,i,1394014676065102427,603922297840707476,262144 --variations-seed-version --mojo-platform-channel-handle=3980 /prefetch:14
1⤵
PID:6104

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"
1⤵
- Modifies system executable filetype association
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
380KB

MD5
e35e32a1b8c3803c10ed90716fbc20ff

SHA1
4ab0fba8d2a190822114228e85de4c490bf758de

SHA256
d84c31eefbf5e6733819ccbe8d85b9e0d96b8c2ac499f88d8c165050bf51b52e

SHA512
7197eb2746c32155ab3011a5d01c1d9572145cdf88711de3a58d3acfc9e0d54c3ecef8b15fc3d793a713485b1d23ad7087fc0703988d25cf5c8ce5c5ad4e8b00

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
406KB

MD5
fd39c3d6a89a43152f76d4158a3291fb

SHA1
090c8d436ed51aeb52be15f0583dd6c2cf1b21a7

SHA256
557b4945a9b59c1c4a4ea2cc7f957436b8eb182f7118c77d876e4937132e5e19

SHA512
62d51767fb0a9dab35519c75738d99e95b557a243eb20882745278bfe5835b54367ab0100182b7847bdc6d5c43e0c9b8591e50fb8434141d802025257475c196

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\PreSignInSettingsConfig.json

Filesize
63KB

MD5
e516a60bc980095e8d156b1a99ab5eee

SHA1
238e243ffc12d4e012fd020c9822703109b987f6

SHA256
543796a1b343b4ebc0285d89cb8eb70667ac7b513da37495e38003704e9d88d7

SHA512
9b51e99ba20e9da56d1acc24a1cf9f9c9dbdeb742bec034e0ff2bc179a60f4aff249f40344f9ddd43229dcdefa1041940f65afb336d46c175ffeff725c638d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\HJ588GA9\update100[2].xml

Filesize
726B

MD5
53244e542ddf6d280a2b03e28f0646b7

SHA1
d9925f810a95880c92974549deead18d56f19c37

SHA256
36a6bd38a8a6f5a75b73caffae5ae66dfabcaefd83da65b493fa881ea8a64e7d

SHA512
4aa71d92ea2c46df86565d97aac75395371d3e17877ab252a297b84dca2ab251d50aaffc62eab9961f0df48de6f12be04a1f4a2cbde75b9ae7bcce6eb5450c62

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\srrvfmx4.default-release\activity-stream.discovery_stream.json.tmp

Filesize
21KB

MD5
a50791bc3685d9e6f9f241147e00cb09

SHA1
ef23951a0afe53e47c97138ef159bf8386a3ba0d

SHA256
83d85d0b9b936f3fc4dc718ff95b0520fec455eee8f1650c6be67003ff3d10f6

SHA512
70beaca4494de4d6e21346230ea064feb96f8b31a967d3c74bb423c02397c2fbe12630b5bcbc902dde553ca3dc9efcb8c646d2c7fa563aed1466277a9d045296

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\5fce85d1-f028-40e4-93f9-918aaab707a3.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\srrvfmx4.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
93dcb3519d0e1f274aacba8db15a68f4

SHA1
88c2a7696cb8d34b6896fca5199b7c8ba4d1e711

SHA256
55c8dbf9f8225304ada3fbe1719740a6cca2e0ec5f28cc0d71a1a8433af23e87

SHA512
09196b1b791bee8f5a25c6ee1e48763a627b2717ce8afcbd02e2e4abeecfbee72efa587e79e7e471c57d39baef3f51e1859db9e537411f79198de0f3376c8f66

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\srrvfmx4.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
f57d06fc7b71921f867b2bcd1bd16540

SHA1
44bcfc791417ec0ad81c60a4756ae9dfb95040eb

SHA256
943512b1a5fe3ccbcebc049604a20b24bbe907ab160ae19fdfac1e863db3bba6

SHA512
b03c5d9733ef49de582e7ffca0d1bef894f09683527f50f085bafc07fee6e3f6781e3b11130221c5153e33271d6c01ed5e1e0943de4605886d581e3a2aefff8a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\srrvfmx4.default-release\datareporting\glean\pending_pings\09f15793-3387-43b5-92d3-28a4e624c0b4

Filesize
671B

MD5
323f6ac563cdac730b08da625ae00d98

SHA1
bf3329abe0fabe739a2fdb70f9d4ee22aa9abfc4

SHA256
98a7e376fd3070875a95972dea60dc0670775a5609bfe4118d4b56bed68e2541

SHA512
31acadc45876a036c2d66664fe8f421fb43f376dfd1a6853aa2912335e72d7c0746c88b74ba624367e352f818e91f99a93c7aee40e85ad9a4d2e073e3d63302b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\srrvfmx4.default-release\datareporting\glean\pending_pings\355223bf-8e90-4db5-a587-d06e0b069ed1

Filesize
24KB

MD5
8605fc2d375ab8e69a006cb0490e8caf

SHA1
61ffbb62516f2613331245e28461ccf2dc5d2cbf

SHA256
bd60a487337c73e5a800a4ebd5185a9d2a396fa72c64293115aa924964ea75c1

SHA512
e110ffe159dd879e514430a60bda29c76a9221e09ca57f132e2e5bbe80bf24c26e1e9429e910265734c91304d3d7d7ee21c86593dedf4ed5ee6267fb103c785d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\srrvfmx4.default-release\datareporting\glean\pending_pings\55df0a50-4fa3-4b9e-b64f-9b99c839a5a7

Filesize
982B

MD5
5aaead6901e1b7dc88929b6bd17d9e88

SHA1
d6df9d2758f67064dc40975bfff066f492206c28

SHA256
40e8d8a02370e95280b2b1e1770d71dd34abad4ef4af43ba5ae696c1cd3fbe33

SHA512
b2a618a392b157f030531c6136dd5b64d5e63b7c0be27c866bd804a8b4587b000758ee26154b16d83c25236bb2c99a5a7ed6242a41d3ed3220a761d856c90831

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\srrvfmx4.default-release\prefs.js

Filesize
10KB

MD5
de500c43c1dd10e4e39c72f9c3b952b5

SHA1
c29f5873e277092561abaf7979f3c4c34d53f8c8

SHA256
e4947e0f1866c3722f008dfe4a1c0ee3119a568604def0d5c92df8d0e4fbda9d

SHA512
3eda3953f24d0983e7b92310e479a56792c09d53dfdc738e6f12da01d4dff5bc67c50f7f10d3b8bf643b76977680e0b4db093e796b7a87bac9beb9acb33bbd8b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\srrvfmx4.default-release\prefs.js

Filesize
9KB

MD5
1eafa0f34a354a05fc2fad037210ce12

SHA1
79bdb2d807c1a78f6678c9542fb38e4250db4459

SHA256
b0c86e2dd4bdf10a1b3c0ef8e203f4f07b10d22bfa18a9b82712466bd7a3e24a

SHA512
b2ef3c1771860183d7ce4aa96ee2ff675632f7428fd64d9b23dbea59e58fbf1e7586499eaea00eccb9a57938667a035b96dafef1baa3b29f7d5f1d749b6fb8e7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\srrvfmx4.default-release\prefs.js

Filesize
9KB

MD5
7bf869d5597e43d94a80bd0383b853c0

SHA1
e2f8bde5a4d65f76dfb038cdd20e44d5299538c4

SHA256
b24548fa7919e537a1092564699a1fe489c12d0cf958c27f5ecd5dccdd77a3b4

SHA512
2ce0bb00eb5493eae3ebe02526baa4d7524515c2c14d1406df6b52bd8ffa2d8c208b98fa7050c747d3072212293e0888c7f9434ca53049e9ed772a24c726cb8f

Download Submit
C:\Users\Admin\Downloads\74ARJ5_H.rar.part

Filesize
545KB

MD5
2336ceb3f559d1b1c0f097261ca2fc13

SHA1
4bec98a218c2d849b54489911b96db7be6676f77

SHA256
e174f14173f7bf7cb21c8f585cc9699c4e521e2758c8dc81b0dd96e41b48a5ae

SHA512
a424b40f2d9976ff2f35ff71c58c4fef67cd22fc48c6a806e1aec6486a95d04004fd1962837e4ef2d14be418ea13a19aeb7caad8beeba628c137fa7542d553a0

Download Submit
memory/3824-3-0x00007FFC1E250000-0x00007FFC1ED12000-memory.dmp

Filesize
10.8MB

Download
memory/3824-0-0x00007FFC1E253000-0x00007FFC1E255000-memory.dmp

Filesize
8KB

Download
memory/3824-6-0x00007FFC1E250000-0x00007FFC1ED12000-memory.dmp

Filesize
10.8MB

Download
memory/3824-4-0x0000021EA4B80000-0x0000021EA50A8000-memory.dmp

Filesize
5.2MB

Download
memory/3824-5-0x00007FFC1E253000-0x00007FFC1E255000-memory.dmp

Filesize
8KB

Download
memory/3824-2-0x0000021EA3700000-0x0000021EA38C2000-memory.dmp

Filesize
1.8MB

Download
memory/3824-1-0x0000021E890C0000-0x0000021E890D8000-memory.dmp

Filesize
96KB

Download