c2718c38f26479f18d548889d78d4733684e960ae1c5a564854fc27df35d9340

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2024 00:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

libasf_plugin.dll.html
Size

7KB
MD5

8440b2fa76acb95149cf6c4e680a6dbd
SHA1

e0ea169b7790125fac11f423fca7fd6f73b240db
SHA256

c2718c38f26479f18d548889d78d4733684e960ae1c5a564854fc27df35d9340
SHA512

f2082fb0e0e94a5a68e8496f23fd8261ee1a78f70490562e2b4f0050d36122fb0471944103f82f92bd81c957662f8b3d057c09358ac9698f19a129d6538dc718
SSDEEP

192:ZvBvTPMcMHyx1SBvJBv/7Bv/dZBv/CBvCgBv0mXHP5BxSTBv/5BvST/lo3fSBvvb:ZJPMcMHyx1yFdr5mXHP5BxSteT/2aqIN

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3728	msedge.exe
3728	msedge.exe
3544	msedge.exe
3544	msedge.exe
4852	identity_helper.exe
4852	identity_helper.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3544 wrote to memory of 3432	3544	msedge.exe	84
PID 3544 wrote to memory of 3432	3544	msedge.exe	84
PID 3544 wrote to memory of 5116	3544	msedge.exe	85
PID 3544 wrote to memory of 5116	3544	msedge.exe	85
PID 3544 wrote to memory of 5116	3544	msedge.exe	85
PID 3544 wrote to memory of 5116	3544	msedge.exe	85
PID 3544 wrote to memory of 5116	3544	msedge.exe	85
PID 3544 wrote to memory of 5116	3544	msedge.exe	85
PID 3544 wrote to memory of 5116	3544	msedge.exe	85
PID 3544 wrote to memory of 5116	3544	msedge.exe	85
PID 3544 wrote to memory of 5116	3544	msedge.exe	85
PID 3544 wrote to memory of 5116	3544	msedge.exe	85
PID 3544 wrote to memory of 5116	3544	msedge.exe	85
PID 3544 wrote to memory of 5116	3544	msedge.exe	85
PID 3544 wrote to memory of 5116	3544	msedge.exe	85
PID 3544 wrote to memory of 5116	3544	msedge.exe	85
PID 3544 wrote to memory of 5116	3544	msedge.exe	85
PID 3544 wrote to memory of 5116	3544	msedge.exe	85
PID 3544 wrote to memory of 5116	3544	msedge.exe	85
PID 3544 wrote to memory of 5116	3544	msedge.exe	85
PID 3544 wrote to memory of 5116	3544	msedge.exe	85
PID 3544 wrote to memory of 5116	3544	msedge.exe	85
PID 3544 wrote to memory of 5116	3544	msedge.exe	85
PID 3544 wrote to memory of 5116	3544	msedge.exe	85
PID 3544 wrote to memory of 5116	3544	msedge.exe	85
PID 3544 wrote to memory of 5116	3544	msedge.exe	85
PID 3544 wrote to memory of 5116	3544	msedge.exe	85
PID 3544 wrote to memory of 5116	3544	msedge.exe	85
PID 3544 wrote to memory of 5116	3544	msedge.exe	85
PID 3544 wrote to memory of 5116	3544	msedge.exe	85
PID 3544 wrote to memory of 5116	3544	msedge.exe	85
PID 3544 wrote to memory of 5116	3544	msedge.exe	85
PID 3544 wrote to memory of 5116	3544	msedge.exe	85
PID 3544 wrote to memory of 5116	3544	msedge.exe	85
PID 3544 wrote to memory of 5116	3544	msedge.exe	85
PID 3544 wrote to memory of 5116	3544	msedge.exe	85
PID 3544 wrote to memory of 5116	3544	msedge.exe	85
PID 3544 wrote to memory of 5116	3544	msedge.exe	85
PID 3544 wrote to memory of 5116	3544	msedge.exe	85
PID 3544 wrote to memory of 5116	3544	msedge.exe	85
PID 3544 wrote to memory of 5116	3544	msedge.exe	85
PID 3544 wrote to memory of 5116	3544	msedge.exe	85
PID 3544 wrote to memory of 3728	3544	msedge.exe	86
PID 3544 wrote to memory of 3728	3544	msedge.exe	86
PID 3544 wrote to memory of 3060	3544	msedge.exe	87
PID 3544 wrote to memory of 3060	3544	msedge.exe	87
PID 3544 wrote to memory of 3060	3544	msedge.exe	87
PID 3544 wrote to memory of 3060	3544	msedge.exe	87
PID 3544 wrote to memory of 3060	3544	msedge.exe	87
PID 3544 wrote to memory of 3060	3544	msedge.exe	87
PID 3544 wrote to memory of 3060	3544	msedge.exe	87
PID 3544 wrote to memory of 3060	3544	msedge.exe	87
PID 3544 wrote to memory of 3060	3544	msedge.exe	87
PID 3544 wrote to memory of 3060	3544	msedge.exe	87
PID 3544 wrote to memory of 3060	3544	msedge.exe	87
PID 3544 wrote to memory of 3060	3544	msedge.exe	87
PID 3544 wrote to memory of 3060	3544	msedge.exe	87
PID 3544 wrote to memory of 3060	3544	msedge.exe	87
PID 3544 wrote to memory of 3060	3544	msedge.exe	87
PID 3544 wrote to memory of 3060	3544	msedge.exe	87
PID 3544 wrote to memory of 3060	3544	msedge.exe	87
PID 3544 wrote to memory of 3060	3544	msedge.exe	87
PID 3544 wrote to memory of 3060	3544	msedge.exe	87
PID 3544 wrote to memory of 3060	3544	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\libasf_plugin.dll.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb226846f8,0x7ffb22684708,0x7ffb22684718
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,3571492963847382995,3749994575718353093,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2016 /prefetch:2
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,3571492963847382995,3749994575718353093,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2520 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,3571492963847382995,3749994575718353093,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2948 /prefetch:8
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,3571492963847382995,3749994575718353093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,3571492963847382995,3749994575718353093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,3571492963847382995,3749994575718353093,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,3571492963847382995,3749994575718353093,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,3571492963847382995,3749994575718353093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,3571492963847382995,3749994575718353093,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,3571492963847382995,3749994575718353093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,3571492963847382995,3749994575718353093,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,3571492963847382995,3749994575718353093,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1396 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3240

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4136

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9519bc058003dbea34765176083739e

SHA1
ef49b8790219eaddbdacb7fc97d3d05433b8575c

SHA256
e034683bc434a09f5d0293cb786e6a3943b902614f9211d42bed47759164d38b

SHA512
a1b67ccf313173c560ead25671c64de65e3e2599251926e33ce8399fde682fce5cb20f36ee330fcd8bb8f7a9c00ef432da56c9b02dfd7d3f02865f390c342b53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cb138796dbfb37877fcae3430bb1e2a7

SHA1
82bb82178c07530e42eca6caf3178d66527558bc

SHA256
50c55ba7baeebe1fa4573118edbca59010d659ea42761148618fb3af8a1c9bdd

SHA512
287471cccbe33e08015d6fc35e0bcdca0ec79bebc3a58f6a340b7747b5b2257b33651574bc83ed529aef2ba94be6e68968e59d2a8ef5f733dce9df6404ad7cc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0006f6db505014a2d7c52d539f0fe6fe

SHA1
06ee0b2128fa5a44b1aee33e1c11e22b504d055e

SHA256
f7bfafe5732ecb46db702cc02e02d663ef86c0490b4066df3d58ec50c219286d

SHA512
aec45d7b5686483a9310ffe87af5165278c3bb039bb23608ce6638ba467250d8a8ef9e25ec4451f9c64a4e86467874df0f9540210016da3191c71a1e83f3838d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8d8e571b8ea502682cceb0f5310b56fe

SHA1
4897dc5233f3a7adec038df7796abcb5ec59f3a4

SHA256
48ecef3cb27664e62918bfe9f12d48c38f91396125a6cd72f330789e1212413c

SHA512
1b99b92e4dc180bbbf422d107b47cd6a0491653d095b608bc456c3695bde189fcf91279a8ce0fd1474d91491117fdaacd769db07d6f759bef0b160ca11445c3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9d6334d20b97c90e45c3ed5beeb0d15a

SHA1
ebe615e49f8b59877d579d973e2336bd6c41bcd8

SHA256
55b82201b9905dc55e3f85312c394765fef3dd8166258d438e0dc1fc086511a0

SHA512
a6238cdcd2dadcba6fef0315a50bc4469ff084022d88abd9901c6a1055c268d0f5ba2a1c215df97f46dc89480d783ebd912fb0b1727e0fc8599406d1df924ce8

Download Submit