hxxps://cdn[.]discordapp[.]com/attachments/1267410065145593918/1267412602447990826/setup[.]zip?ex=66a8b177&is=66a75ff7&hm=25889dd9dddcffc74a9bfa5301612c6e4360f1a057c5e7506ad1fb4a2463f0c4&

max time kernel
145s
max time network
137s
platform
windows11-21h2_x64
resource
win11-20250217-en
resource tags

arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system
submitted
10/03/2025, 20:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1267410065145593918/1267412602447990826/setup.zip?ex=66a8b177&is=66a75ff7&hm=25889dd9dddcffc74a9bfa5301612c6e4360f1a057c5e7506ad1fb4a2463f0c4&

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
660	msedge.exe
660	msedge.exe
3020	msedge.exe
3020	msedge.exe
3296	msedge.exe
3296	msedge.exe
5356	identity_helper.exe
5356	identity_helper.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 828	3020	msedge.exe	81
PID 3020 wrote to memory of 828	3020	msedge.exe	81
PID 3020 wrote to memory of 6044	3020	msedge.exe	82
PID 3020 wrote to memory of 6044	3020	msedge.exe	82
PID 3020 wrote to memory of 6044	3020	msedge.exe	82
PID 3020 wrote to memory of 6044	3020	msedge.exe	82
PID 3020 wrote to memory of 6044	3020	msedge.exe	82
PID 3020 wrote to memory of 6044	3020	msedge.exe	82
PID 3020 wrote to memory of 6044	3020	msedge.exe	82
PID 3020 wrote to memory of 6044	3020	msedge.exe	82
PID 3020 wrote to memory of 6044	3020	msedge.exe	82
PID 3020 wrote to memory of 6044	3020	msedge.exe	82
PID 3020 wrote to memory of 6044	3020	msedge.exe	82
PID 3020 wrote to memory of 6044	3020	msedge.exe	82
PID 3020 wrote to memory of 6044	3020	msedge.exe	82
PID 3020 wrote to memory of 6044	3020	msedge.exe	82
PID 3020 wrote to memory of 6044	3020	msedge.exe	82
PID 3020 wrote to memory of 6044	3020	msedge.exe	82
PID 3020 wrote to memory of 6044	3020	msedge.exe	82
PID 3020 wrote to memory of 6044	3020	msedge.exe	82
PID 3020 wrote to memory of 6044	3020	msedge.exe	82
PID 3020 wrote to memory of 6044	3020	msedge.exe	82
PID 3020 wrote to memory of 6044	3020	msedge.exe	82
PID 3020 wrote to memory of 6044	3020	msedge.exe	82
PID 3020 wrote to memory of 6044	3020	msedge.exe	82
PID 3020 wrote to memory of 6044	3020	msedge.exe	82
PID 3020 wrote to memory of 6044	3020	msedge.exe	82
PID 3020 wrote to memory of 6044	3020	msedge.exe	82
PID 3020 wrote to memory of 6044	3020	msedge.exe	82
PID 3020 wrote to memory of 6044	3020	msedge.exe	82
PID 3020 wrote to memory of 6044	3020	msedge.exe	82
PID 3020 wrote to memory of 6044	3020	msedge.exe	82
PID 3020 wrote to memory of 6044	3020	msedge.exe	82
PID 3020 wrote to memory of 6044	3020	msedge.exe	82
PID 3020 wrote to memory of 6044	3020	msedge.exe	82
PID 3020 wrote to memory of 6044	3020	msedge.exe	82
PID 3020 wrote to memory of 6044	3020	msedge.exe	82
PID 3020 wrote to memory of 6044	3020	msedge.exe	82
PID 3020 wrote to memory of 6044	3020	msedge.exe	82
PID 3020 wrote to memory of 6044	3020	msedge.exe	82
PID 3020 wrote to memory of 6044	3020	msedge.exe	82
PID 3020 wrote to memory of 6044	3020	msedge.exe	82
PID 3020 wrote to memory of 660	3020	msedge.exe	83
PID 3020 wrote to memory of 660	3020	msedge.exe	83
PID 3020 wrote to memory of 1096	3020	msedge.exe	84
PID 3020 wrote to memory of 1096	3020	msedge.exe	84
PID 3020 wrote to memory of 1096	3020	msedge.exe	84
PID 3020 wrote to memory of 1096	3020	msedge.exe	84
PID 3020 wrote to memory of 1096	3020	msedge.exe	84
PID 3020 wrote to memory of 1096	3020	msedge.exe	84
PID 3020 wrote to memory of 1096	3020	msedge.exe	84
PID 3020 wrote to memory of 1096	3020	msedge.exe	84
PID 3020 wrote to memory of 1096	3020	msedge.exe	84
PID 3020 wrote to memory of 1096	3020	msedge.exe	84
PID 3020 wrote to memory of 1096	3020	msedge.exe	84
PID 3020 wrote to memory of 1096	3020	msedge.exe	84
PID 3020 wrote to memory of 1096	3020	msedge.exe	84
PID 3020 wrote to memory of 1096	3020	msedge.exe	84
PID 3020 wrote to memory of 1096	3020	msedge.exe	84
PID 3020 wrote to memory of 1096	3020	msedge.exe	84
PID 3020 wrote to memory of 1096	3020	msedge.exe	84
PID 3020 wrote to memory of 1096	3020	msedge.exe	84
PID 3020 wrote to memory of 1096	3020	msedge.exe	84
PID 3020 wrote to memory of 1096	3020	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://cdn.discordapp.com/attachments/1267410065145593918/1267412602447990826/setup.zip?ex=66a8b177&is=66a75ff7&hm=25889dd9dddcffc74a9bfa5301612c6e4360f1a057c5e7506ad1fb4a2463f0c4&
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffdb66f3cb8,0x7ffdb66f3cc8,0x7ffdb66f3cd8
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,6891554195339286816,14589076059669111377,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1884 /prefetch:2
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1888,6891554195339286816,14589076059669111377,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1888,6891554195339286816,14589076059669111377,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,6891554195339286816,14589076059669111377,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,6891554195339286816,14589076059669111377,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1888,6891554195339286816,14589076059669111377,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4624 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,6891554195339286816,14589076059669111377,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,6891554195339286816,14589076059669111377,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1888,6891554195339286816,14589076059669111377,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1888,6891554195339286816,14589076059669111377,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,6891554195339286816,14589076059669111377,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,6891554195339286816,14589076059669111377,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,6891554195339286816,14589076059669111377,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=876 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8ae85e5cf3f16b6f88fea75afff52ab0

SHA1
b5e295ed2ddf08be4d80d37a9ecd65c25df6e517

SHA256
d45c4ed2ae15c6079c37164fa5f36c8413ad19234f11bf698f0db413788e78d8

SHA512
3ab8a201e3d426262d40d00a4d9f37c323df95f2edcb3a1a831c081a64825f5cf5cd37e7f9b9ed38eda7e09989f7ba9f5f9146ee49929acd1d61f17058b0c4eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
57d5636cf19706fbbd7b4f22dd021e66

SHA1
4f8eade2a567064c8e2f711333f59d0c2f32ace9

SHA256
7ad1541c32bd8190e8e949d9c97a39fc65cb327f7f9f5eb23e5e888a2b94c023

SHA512
b755cc197864b65207dbcf79007ebb652bfee509f7118b03894900d9cb5223e81e82ea5ac943427b34c6272d568e9a3d5f9ee2c69862e09d123e89e3961d4b42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
475B

MD5
7588d0a7f5947bf85cc64056656e7bc4

SHA1
902f0c27f0e959a739b97170d64e875fd849cffa

SHA256
1fa61200ca2f78e5ab30771748ba2eb720bebe8e7ab0b5056e18b4b848e8f59c

SHA512
d8362ab6e00b73f3bf49cc47acaca47050e9cbda9e2f5cc2de0b0d45a713bde411c50d2cced20aae13352901abe8f792e53ca43d6a0cd2f57e13dd32e7b49d96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a37fee4bae5bb60935120ae61877b929

SHA1
b7878268ae130aa3469a436cb785db2ec5b0e189

SHA256
5a36ddc292370bc206a6a7f135473cb09cbe9bb51a5eeaefd6d6981f0364604a

SHA512
e514f2f44ad4e940f3aa147336e5c36019940ebbb5191c1224547a690c5d8528394284a7b7d8fffcc3e088a2b556ce40134ec3af427782bbecaa900ef0abb56a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b3b4015fd056b785e95c51e3d341bc6b

SHA1
aefb467647d269836f00f31096a14333bbad6a9e

SHA256
1231dc1ec094ef2e02cc0dc9057d1d824574af4e3dab8d9948f4f7115fad5808

SHA512
cfa9bb5836cc229319e9161663ea78612716cb61a7249bdc73d94b2a18286488bd0409a154f0fea1fb2787e507b615c2669db7ebd0188b70fd44fe50b3f493d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0d4b0d0ad88ffe5ff7bf29ea38b642c9

SHA1
7bc42c919dcca68746603ef84a41e63178dfaa35

SHA256
dbff26b2ab84e8afcde94cd4d4c46b205a86eeff0cbf639d18764194cecaa112

SHA512
59715341bc145e6d8a9ec63cf375a5f521c215cf1c06c9e16ea55d6b8554f01ecebf272564d5e6ebee22be5b595d289dbfb42c478f3f1ce238422b72f9ea8500

Download Submit