5a0965b44545afd963414a9f835f3aa035a355d597ae536fc0d9ad68b7886a0d

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 00:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
libshout_plugin.dll.svn-base?id=8328c31dba7c71ee20ee32f1a735d639f9e43928.html
Size 203KB
Sample240418-a4s99add62
SHA256 5a0965b44545afd963414a9f835f3aa035a355d597ae536fc0d9ad68b7886a0d
MD5 fc14e52330e239b92bad442e215ebfbc
SHA1 eec0639de3475383e31a859e2e22504426ba09a1
SHA512 3da25c0adf9b9ccb24ea42940dd50d71ecbedeafb934a7bcbcd1267b4181ae0139d71d8f840a272d8ae4c3192386a1e523d37b06db662ca16886a5e046f7e12f
SSDEEP 1536:kh/RbIiKQ3cmd+8PsK2ZAGbzOOE4GIrhNGkwWynoflJZuN+wE8B:kh/RzVF6qQnOaeHW5flPuN+I
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3428	msedge.exe
3428	msedge.exe
4940	msedge.exe
4940	msedge.exe
3140	identity_helper.exe
3140	identity_helper.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 3300	4940	msedge.exe	85
PID 4940 wrote to memory of 3300	4940	msedge.exe	85
PID 4940 wrote to memory of 4008	4940	msedge.exe	86
PID 4940 wrote to memory of 4008	4940	msedge.exe	86
PID 4940 wrote to memory of 4008	4940	msedge.exe	86
PID 4940 wrote to memory of 4008	4940	msedge.exe	86
PID 4940 wrote to memory of 4008	4940	msedge.exe	86
PID 4940 wrote to memory of 4008	4940	msedge.exe	86
PID 4940 wrote to memory of 4008	4940	msedge.exe	86
PID 4940 wrote to memory of 4008	4940	msedge.exe	86
PID 4940 wrote to memory of 4008	4940	msedge.exe	86
PID 4940 wrote to memory of 4008	4940	msedge.exe	86
PID 4940 wrote to memory of 4008	4940	msedge.exe	86
PID 4940 wrote to memory of 4008	4940	msedge.exe	86
PID 4940 wrote to memory of 4008	4940	msedge.exe	86
PID 4940 wrote to memory of 4008	4940	msedge.exe	86
PID 4940 wrote to memory of 4008	4940	msedge.exe	86
PID 4940 wrote to memory of 4008	4940	msedge.exe	86
PID 4940 wrote to memory of 4008	4940	msedge.exe	86
PID 4940 wrote to memory of 4008	4940	msedge.exe	86
PID 4940 wrote to memory of 4008	4940	msedge.exe	86
PID 4940 wrote to memory of 4008	4940	msedge.exe	86
PID 4940 wrote to memory of 4008	4940	msedge.exe	86
PID 4940 wrote to memory of 4008	4940	msedge.exe	86
PID 4940 wrote to memory of 4008	4940	msedge.exe	86
PID 4940 wrote to memory of 4008	4940	msedge.exe	86
PID 4940 wrote to memory of 4008	4940	msedge.exe	86
PID 4940 wrote to memory of 4008	4940	msedge.exe	86
PID 4940 wrote to memory of 4008	4940	msedge.exe	86
PID 4940 wrote to memory of 4008	4940	msedge.exe	86
PID 4940 wrote to memory of 4008	4940	msedge.exe	86
PID 4940 wrote to memory of 4008	4940	msedge.exe	86
PID 4940 wrote to memory of 4008	4940	msedge.exe	86
PID 4940 wrote to memory of 4008	4940	msedge.exe	86
PID 4940 wrote to memory of 4008	4940	msedge.exe	86
PID 4940 wrote to memory of 4008	4940	msedge.exe	86
PID 4940 wrote to memory of 4008	4940	msedge.exe	86
PID 4940 wrote to memory of 4008	4940	msedge.exe	86
PID 4940 wrote to memory of 4008	4940	msedge.exe	86
PID 4940 wrote to memory of 4008	4940	msedge.exe	86
PID 4940 wrote to memory of 4008	4940	msedge.exe	86
PID 4940 wrote to memory of 4008	4940	msedge.exe	86
PID 4940 wrote to memory of 3428	4940	msedge.exe	87
PID 4940 wrote to memory of 3428	4940	msedge.exe	87
PID 4940 wrote to memory of 2052	4940	msedge.exe	88
PID 4940 wrote to memory of 2052	4940	msedge.exe	88
PID 4940 wrote to memory of 2052	4940	msedge.exe	88
PID 4940 wrote to memory of 2052	4940	msedge.exe	88
PID 4940 wrote to memory of 2052	4940	msedge.exe	88
PID 4940 wrote to memory of 2052	4940	msedge.exe	88
PID 4940 wrote to memory of 2052	4940	msedge.exe	88
PID 4940 wrote to memory of 2052	4940	msedge.exe	88
PID 4940 wrote to memory of 2052	4940	msedge.exe	88
PID 4940 wrote to memory of 2052	4940	msedge.exe	88
PID 4940 wrote to memory of 2052	4940	msedge.exe	88
PID 4940 wrote to memory of 2052	4940	msedge.exe	88
PID 4940 wrote to memory of 2052	4940	msedge.exe	88
PID 4940 wrote to memory of 2052	4940	msedge.exe	88
PID 4940 wrote to memory of 2052	4940	msedge.exe	88
PID 4940 wrote to memory of 2052	4940	msedge.exe	88
PID 4940 wrote to memory of 2052	4940	msedge.exe	88
PID 4940 wrote to memory of 2052	4940	msedge.exe	88
PID 4940 wrote to memory of 2052	4940	msedge.exe	88
PID 4940 wrote to memory of 2052	4940	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\libshout_plugin.dll.svn-base_id=8328c31dba7c71ee20ee32f1a735d639f9e43928.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0xd8,0x7fff07a746f8,0x7fff07a74708,0x7fff07a74718
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,3487799099360266980,1155968186426387588,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,3487799099360266980,1155968186426387588,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,3487799099360266980,1155968186426387588,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3487799099360266980,1155968186426387588,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3487799099360266980,1155968186426387588,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,3487799099360266980,1155968186426387588,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,3487799099360266980,1155968186426387588,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3487799099360266980,1155968186426387588,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3487799099360266980,1155968186426387588,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3487799099360266980,1155968186426387588,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3487799099360266980,1155968186426387588,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,3487799099360266980,1155968186426387588,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 e04101215c3534dbc77c0b5df2e1d1ff74c277d2946f391f939c9a7948a22dd0
MD5 120a75f233314ba1fe34e9d6c09f30b9
SHA1 a9f92f2d3f111eaadd9bcf8fceb3c9553753539c
SHA512 3c4eb93e425b50e8bcc1712f4cc2be11888a0273c3a619fc6bf72ccab876a427158f661bfc80d0c1e47ef4116febf76a3aaa31a60ec662eae0e51c7f1d3d89b3
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 dbce3287c7ae69ccbd1d780c39f3ffa3c98bd4609a939fff8ee9c99f14265041
MD5 bc2edd0741d97ae237e9f00bf3244144
SHA1 7c1e5d324f5c7137a3c4ec85146659f026c11782
SHA512 00f505a0b4ea0df626175bf9d39a205f18f9754b62e4dba6fbb5b4a716b3539e7809723e1596bcfe1ba3041e22342e3a9cbaad88e84ce9c8c6531331bbc25093
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 91b979382f026099f9425e8249ae9a904a7a1a523a837c23e7750d9b16b4ebda
MD5 12d1935dc904580b8c079de0f0ab8089
SHA1 b4e258056ada5890ff2ae3a7878885f540e02d46
SHA512 aa5b85a2388bc0f01c1f60897dd1497730b5e8e5d008070a678ca2d6f3b516719074737a0024760f03ff58bfa04e12ac906eec9edc1a0da9b0fcabd55f80ba9f
SSDEEP 96:neksvxm/YQYmqa1ipwpvWMoiVmdeHwJMUWQyV+VDCziEwb:neksE910pGWMXVro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c2988df0d33cb457512bfbdd349e00cda1d300a8f08297981c33fb105347b7e6
MD5 9985016aa44066048aec56896a232d88
SHA1 6a7133033c73047b0504033c6f00f21d1b9523df
SHA512 c3cb8155ce3f711b4a691bbf4817d164397a0756552167ec9f556362bf5f1d1e7386ce0ee4d169a5b7af12262a7dcf547f70adf9c8e9118b756667116aa98f1f
SSDEEP 96:neksvxm/Ynmqa1iRwpvWMoiVmdeEkqwJMUWQyV+VD7AiEwb:neksEj10RGWMbqVrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 d367f6a2fca9cd77fc9fef736d3b08d0e07d1691deaf4b56c02bb63848d646b4
MD5 58fb299f32e3fe0de55b9547577599e9
SHA1 cf9a03c9812088e86924a17fc6f4d352dad21735
SHA512 adc67feddf77f732f6e9f82f2145b2caecd71bb033b3cdfac3367286b831ca6a2a3e5bbb5edb4e21fa0ab17d8d845c0466dcead4d85fab801ecb3118920dd889
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupxe2RUe32cdP4M+olzO6z3q:A9iIxuERzA83h09RZxYl6kAKO4UQA
MD5 SHA1 SHA512 SSDEEP

Submit Download