4cf049a21a6cbeb113522633792e83c3c1fe99a662331f9de2c165d34f089d52

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 00:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

librv32_plugin.html
Size

6KB
MD5

6dba643d142208f697835b40a0d459b8
SHA1

fa70207d72cff6ac8f9426fcb86e29428fee8201
SHA256

4cf049a21a6cbeb113522633792e83c3c1fe99a662331f9de2c165d34f089d52
SHA512

591c1f7cf9ffb45d3de7fe6a767bf74edaf47b0e6aa834c70f851390cc38e10b2125d9c88d33bf6b2dec4a94f37774c6c1ad85c92d4c8c2d516f45553ffabbfa
SSDEEP

192:ZyiPMcMHy3HgDcjdFXXahGB/lo36xygsCyDUQE8uI:Z9PMcMHySkX7/yE8uI

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3032	msedge.exe
3032	msedge.exe
1568	msedge.exe
1568	msedge.exe
4968	identity_helper.exe
4968	identity_helper.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 2944	1568	msedge.exe	85
PID 1568 wrote to memory of 2944	1568	msedge.exe	85
PID 1568 wrote to memory of 5024	1568	msedge.exe	86
PID 1568 wrote to memory of 5024	1568	msedge.exe	86
PID 1568 wrote to memory of 5024	1568	msedge.exe	86
PID 1568 wrote to memory of 5024	1568	msedge.exe	86
PID 1568 wrote to memory of 5024	1568	msedge.exe	86
PID 1568 wrote to memory of 5024	1568	msedge.exe	86
PID 1568 wrote to memory of 5024	1568	msedge.exe	86
PID 1568 wrote to memory of 5024	1568	msedge.exe	86
PID 1568 wrote to memory of 5024	1568	msedge.exe	86
PID 1568 wrote to memory of 5024	1568	msedge.exe	86
PID 1568 wrote to memory of 5024	1568	msedge.exe	86
PID 1568 wrote to memory of 5024	1568	msedge.exe	86
PID 1568 wrote to memory of 5024	1568	msedge.exe	86
PID 1568 wrote to memory of 5024	1568	msedge.exe	86
PID 1568 wrote to memory of 5024	1568	msedge.exe	86
PID 1568 wrote to memory of 5024	1568	msedge.exe	86
PID 1568 wrote to memory of 5024	1568	msedge.exe	86
PID 1568 wrote to memory of 5024	1568	msedge.exe	86
PID 1568 wrote to memory of 5024	1568	msedge.exe	86
PID 1568 wrote to memory of 5024	1568	msedge.exe	86
PID 1568 wrote to memory of 5024	1568	msedge.exe	86
PID 1568 wrote to memory of 5024	1568	msedge.exe	86
PID 1568 wrote to memory of 5024	1568	msedge.exe	86
PID 1568 wrote to memory of 5024	1568	msedge.exe	86
PID 1568 wrote to memory of 5024	1568	msedge.exe	86
PID 1568 wrote to memory of 5024	1568	msedge.exe	86
PID 1568 wrote to memory of 5024	1568	msedge.exe	86
PID 1568 wrote to memory of 5024	1568	msedge.exe	86
PID 1568 wrote to memory of 5024	1568	msedge.exe	86
PID 1568 wrote to memory of 5024	1568	msedge.exe	86
PID 1568 wrote to memory of 5024	1568	msedge.exe	86
PID 1568 wrote to memory of 5024	1568	msedge.exe	86
PID 1568 wrote to memory of 5024	1568	msedge.exe	86
PID 1568 wrote to memory of 5024	1568	msedge.exe	86
PID 1568 wrote to memory of 5024	1568	msedge.exe	86
PID 1568 wrote to memory of 5024	1568	msedge.exe	86
PID 1568 wrote to memory of 5024	1568	msedge.exe	86
PID 1568 wrote to memory of 5024	1568	msedge.exe	86
PID 1568 wrote to memory of 5024	1568	msedge.exe	86
PID 1568 wrote to memory of 5024	1568	msedge.exe	86
PID 1568 wrote to memory of 3032	1568	msedge.exe	87
PID 1568 wrote to memory of 3032	1568	msedge.exe	87
PID 1568 wrote to memory of 2700	1568	msedge.exe	88
PID 1568 wrote to memory of 2700	1568	msedge.exe	88
PID 1568 wrote to memory of 2700	1568	msedge.exe	88
PID 1568 wrote to memory of 2700	1568	msedge.exe	88
PID 1568 wrote to memory of 2700	1568	msedge.exe	88
PID 1568 wrote to memory of 2700	1568	msedge.exe	88
PID 1568 wrote to memory of 2700	1568	msedge.exe	88
PID 1568 wrote to memory of 2700	1568	msedge.exe	88
PID 1568 wrote to memory of 2700	1568	msedge.exe	88
PID 1568 wrote to memory of 2700	1568	msedge.exe	88
PID 1568 wrote to memory of 2700	1568	msedge.exe	88
PID 1568 wrote to memory of 2700	1568	msedge.exe	88
PID 1568 wrote to memory of 2700	1568	msedge.exe	88
PID 1568 wrote to memory of 2700	1568	msedge.exe	88
PID 1568 wrote to memory of 2700	1568	msedge.exe	88
PID 1568 wrote to memory of 2700	1568	msedge.exe	88
PID 1568 wrote to memory of 2700	1568	msedge.exe	88
PID 1568 wrote to memory of 2700	1568	msedge.exe	88
PID 1568 wrote to memory of 2700	1568	msedge.exe	88
PID 1568 wrote to memory of 2700	1568	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\librv32_plugin.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xd8,0x100,0x104,0xe4,0x108,0x7ffe2a0e46f8,0x7ffe2a0e4708,0x7ffe2a0e4718
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,13615425734698454388,420726285989327997,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,13615425734698454388,420726285989327997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,13615425734698454388,420726285989327997,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,13615425734698454388,420726285989327997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,13615425734698454388,420726285989327997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,13615425734698454388,420726285989327997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1368 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,13615425734698454388,420726285989327997,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,13615425734698454388,420726285989327997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3616 /prefetch:8
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,13615425734698454388,420726285989327997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3616 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,13615425734698454388,420726285989327997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,13615425734698454388,420726285989327997,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,13615425734698454388,420726285989327997,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5148 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2316

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
846ce533b9e20979bf1857f1afb61925

SHA1
4c6726618d10805940dba5e6cf849448b552bf68

SHA256
b81574d678f49d36d874dc062a1291092ab94164b92f7e30d42d9c61cc0e77c3

SHA512
8fb228fae89f063159dabc93871db205d836bdb4ec8f54a2f642bd0b1ac531eea0c21234a8ca75a0ae9a008d2399a9bf20a481f5d6a6eab53a533cd03aeaaa2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
104aab1e178489256a1425b28119ec93

SHA1
0bcf8ad28df672c618cb832ba8de8f85bd858a6c

SHA256
b92c19f079ef5948cb58654ce76f582a480a82cddc5083764ed7f1eac27b8d01

SHA512
b4f930f87eb86497672f32eb7cc77548d8afb09ad9fdba0508f368d5710e3a75c44b1fd9f96c98c2f0bd08deb4afde28330b11cf23e456c92cc509d28677d2cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c8747eda65254cfc6ad74e2b90b6c887

SHA1
3897165d7b3c6f2082b695de3e4f694e25e1f25b

SHA256
0a5cdb38acba9df095f57313ef7b4cac4b19d0a96f7970f21d330e06e056887e

SHA512
aa9e8bee52d46c46accf2b191c67ca3cb7359ca755de51825e3d97bdd355643e2f4045ed455de8832e600933cadfe688c446db9a069aec2c162f827f1c7c3237

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f820fedb380f4e304e003b062d0830e9

SHA1
054c24412d30e0c46e7d2d7c5ace100eeffd9d3f

SHA256
9bfd461601602f4555b122e9f6e95ff63271bee1ba15b23326cbe96a668b443a

SHA512
3c24914bff7942bf91fbf264b07c9a2eccac56f8d5c75c7f264d46503e328f9f079795193c34359b69ce8755229d133d28ac8436492d96f76faaa5c0b2deeb07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
333314cd2e9914be127f27b9bfb815a4

SHA1
8a2516bd6b7f08dc7ce35a8cf03e815a976013dd

SHA256
d7543c1a8f16fbb6d5194a38a0037b39061ef88ba6dfca2a1398ad5b1d72187d

SHA512
74060a27f29cb771d9fda0e9e72127e6bd02e717c17f4ac148c2a51e1e6d8ead776db158b85e9688f20837fad05c96c2024258a6ab5809c7c1fe0d5365ff976d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
81d183b9ddd7902b012153890d3f578d

SHA1
65945e3fab30c05a4f84d9ac5fc461a1d76ac56e

SHA256
4a7a518ced236036b6a0d9622cd92d31486cf1f80047be42167898fd2f024494

SHA512
923fbafc27926712d9302ed40eca640a7d303b55d582dcc5c316fe2e7c0c0a10ceea8ff5f6c3f89773e4d58026301405268a4de9f81fdefbe1e15461df8ba1f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4dfa9c34c130c23e1c854c9c0bfcea63

SHA1
61b2f90f913080c4bce1a4ab6a7c333442b1dfaa

SHA256
98119169f9a4f7445fc5efa82132f2e48e62c5235a1b16030fd066a704e92346

SHA512
9f6c8939394db89af1c4255764101dbad2e13439048d3788d91ced6c67e71181c56acdc82e3ec6ef39ab45d3fd1b8a78759943156b46ef1b2c3d03e30fea2805

Download Submit