90024d01d4cfe44d41ff38ab460e76b9c0f98c4cda87f22b74eb48e5bb84e385

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 00:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
libdts_plugin.dll.svn-base?id=8328c31dba7c71ee20ee32f1a735d639f9e43928.html
Size 226KB
Sample240418-ahxesace6y
SHA256 90024d01d4cfe44d41ff38ab460e76b9c0f98c4cda87f22b74eb48e5bb84e385
MD5 5dc4b6285e89d65d51dec28ef688bd2e
SHA1 461aae4bae5b8454ac8638101da274dbe59877ca
SHA512 d359e644362c50c6fe7b78000b5a5ce8cee7a47c24864e557acc3ce0d3d5fd79f42bc023f5483aa8a29015a5b6063db9d7637c4b1377ab1f9872875dffb8adfd
SSDEEP 1536:Ah/R7YIe0GkmbOzj8em5LaiPCBuealPMKDymhCFaRoMwpyzE8B:Ah/RYKUCn9al1DyLERolpyh
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1244	msedge.exe
1244	msedge.exe
5032	msedge.exe
5032	msedge.exe
4064	identity_helper.exe
4064	identity_helper.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 372	5032	msedge.exe	86
PID 5032 wrote to memory of 372	5032	msedge.exe	86
PID 5032 wrote to memory of 2604	5032	msedge.exe	87
PID 5032 wrote to memory of 2604	5032	msedge.exe	87
PID 5032 wrote to memory of 2604	5032	msedge.exe	87
PID 5032 wrote to memory of 2604	5032	msedge.exe	87
PID 5032 wrote to memory of 2604	5032	msedge.exe	87
PID 5032 wrote to memory of 2604	5032	msedge.exe	87
PID 5032 wrote to memory of 2604	5032	msedge.exe	87
PID 5032 wrote to memory of 2604	5032	msedge.exe	87
PID 5032 wrote to memory of 2604	5032	msedge.exe	87
PID 5032 wrote to memory of 2604	5032	msedge.exe	87
PID 5032 wrote to memory of 2604	5032	msedge.exe	87
PID 5032 wrote to memory of 2604	5032	msedge.exe	87
PID 5032 wrote to memory of 2604	5032	msedge.exe	87
PID 5032 wrote to memory of 2604	5032	msedge.exe	87
PID 5032 wrote to memory of 2604	5032	msedge.exe	87
PID 5032 wrote to memory of 2604	5032	msedge.exe	87
PID 5032 wrote to memory of 2604	5032	msedge.exe	87
PID 5032 wrote to memory of 2604	5032	msedge.exe	87
PID 5032 wrote to memory of 2604	5032	msedge.exe	87
PID 5032 wrote to memory of 2604	5032	msedge.exe	87
PID 5032 wrote to memory of 2604	5032	msedge.exe	87
PID 5032 wrote to memory of 2604	5032	msedge.exe	87
PID 5032 wrote to memory of 2604	5032	msedge.exe	87
PID 5032 wrote to memory of 2604	5032	msedge.exe	87
PID 5032 wrote to memory of 2604	5032	msedge.exe	87
PID 5032 wrote to memory of 2604	5032	msedge.exe	87
PID 5032 wrote to memory of 2604	5032	msedge.exe	87
PID 5032 wrote to memory of 2604	5032	msedge.exe	87
PID 5032 wrote to memory of 2604	5032	msedge.exe	87
PID 5032 wrote to memory of 2604	5032	msedge.exe	87
PID 5032 wrote to memory of 2604	5032	msedge.exe	87
PID 5032 wrote to memory of 2604	5032	msedge.exe	87
PID 5032 wrote to memory of 2604	5032	msedge.exe	87
PID 5032 wrote to memory of 2604	5032	msedge.exe	87
PID 5032 wrote to memory of 2604	5032	msedge.exe	87
PID 5032 wrote to memory of 2604	5032	msedge.exe	87
PID 5032 wrote to memory of 2604	5032	msedge.exe	87
PID 5032 wrote to memory of 2604	5032	msedge.exe	87
PID 5032 wrote to memory of 2604	5032	msedge.exe	87
PID 5032 wrote to memory of 2604	5032	msedge.exe	87
PID 5032 wrote to memory of 1244	5032	msedge.exe	88
PID 5032 wrote to memory of 1244	5032	msedge.exe	88
PID 5032 wrote to memory of 2108	5032	msedge.exe	89
PID 5032 wrote to memory of 2108	5032	msedge.exe	89
PID 5032 wrote to memory of 2108	5032	msedge.exe	89
PID 5032 wrote to memory of 2108	5032	msedge.exe	89
PID 5032 wrote to memory of 2108	5032	msedge.exe	89
PID 5032 wrote to memory of 2108	5032	msedge.exe	89
PID 5032 wrote to memory of 2108	5032	msedge.exe	89
PID 5032 wrote to memory of 2108	5032	msedge.exe	89
PID 5032 wrote to memory of 2108	5032	msedge.exe	89
PID 5032 wrote to memory of 2108	5032	msedge.exe	89
PID 5032 wrote to memory of 2108	5032	msedge.exe	89
PID 5032 wrote to memory of 2108	5032	msedge.exe	89
PID 5032 wrote to memory of 2108	5032	msedge.exe	89
PID 5032 wrote to memory of 2108	5032	msedge.exe	89
PID 5032 wrote to memory of 2108	5032	msedge.exe	89
PID 5032 wrote to memory of 2108	5032	msedge.exe	89
PID 5032 wrote to memory of 2108	5032	msedge.exe	89
PID 5032 wrote to memory of 2108	5032	msedge.exe	89
PID 5032 wrote to memory of 2108	5032	msedge.exe	89
PID 5032 wrote to memory of 2108	5032	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\libdts_plugin.dll.svn-base_id=8328c31dba7c71ee20ee32f1a735d639f9e43928.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff80cb746f8,0x7ff80cb74708,0x7ff80cb74718
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,15827272016531599103,3869826261083399291,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,15827272016531599103,3869826261083399291,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,15827272016531599103,3869826261083399291,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15827272016531599103,3869826261083399291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15827272016531599103,3869826261083399291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,15827272016531599103,3869826261083399291,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4188 /prefetch:8
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,15827272016531599103,3869826261083399291,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4188 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15827272016531599103,3869826261083399291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15827272016531599103,3869826261083399291,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15827272016531599103,3869826261083399291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15827272016531599103,3869826261083399291,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,15827272016531599103,3869826261083399291,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4640 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 39205cdf989e3a86822b3f473c5fc223d7290b98c2a3fb7f75e366fc8e3ecbe9
MD5 cff358b013d6f9f633bc1587f6f54ffa
SHA1 6cb7852e096be24695ff1bc213abde42d35bb376
SHA512 8831c223a1f0cf5f71fa851cdd82f4a9f03e5f267513e05b936756c116997f749ffa563623b4724de921d049de34a8f277cc539f58997cda4d178ea205be2259
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 38b634f3fedcf2a9dc3280aa76bd1ea93e192200b8a48904664fac5c9944636a
MD5 dc629a750e345390344524fe0ea7dcd7
SHA1 5f9f00a358caaef0321707c4f6f38d52bd7e0399
SHA512 2a941fe90b748d0326e011258fa9b494dc2f47ac047767455ed16a41d523f04370f818316503a5bad0ff5c5699e92a0aaf3952748b09287c5328354bfa6cc902
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 9b13da59a5d0db3b2615a6d1b786c2cb64a7c96f3cd3460f4cde884928d55618
MD5 d8407488b2f8545f2ba2723b6a25c121
SHA1 32bab8d370f6d695cdf07d0836ab48faed6e2a19
SHA512 0d21322a4159a1ab611790cbdcbd8def8a77df018dc3b2febc52d895a03cf8427fbfb2cfe0a6318a2aac86de9c1821394657ac71634b7c41fb1a20549074a5f1
SSDEEP 96:n9kyvxm/YQYmq/1wLOwpvWMoiVmdeHmN/UWQyV+VD7ziEwb:n9kyE9QeqGWMXQrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 72651c92e13f4d50266ed377e443d3e3e46218e91b86aa3bf879fa6219726794
MD5 77901eba46273e71465dab17de044d9c
SHA1 df3185c68dbaae7d0476544e1e7c9dd4d6afa297
SHA512 5e016ad6b6ca81ed430d32eb1cca5278918b0f7cd87ae19e0ca301dbef54cc8f1f2801f5f7ded4af9e317a32dc11a5625d9cba1ea4512e630922bdbc5482c0d1
SSDEEP 96:n9kyvxm/Ynmq/1w7OwpvWMoiVmdeEtqmN/UWQyV+VD7AiEwb:n9kyEjQeaGWMOqQrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 5f513748fbe164004e35da428b91202e34ee8397748914baa86ef8d4984a8d45
MD5 ed2b262dbaeb0061eb4ff93553856ce0
SHA1 1ae4a05190514feb72c60cd750d4c1f7021ef72a
SHA512 1d7533f77d9eb43fe054563e9a089c25f12adc18f33448e2696dd996b44c8b3219157ec7878a551deec5051a780fbd3e2a58426d677199c6247eb209b7080d64
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupHSe2RUkql/dP4M+olzO6zA:A9iIxuERzA83h09RZxYHsk1AKO4Uc6
MD5 SHA1 SHA512 SSDEEP

Submit Download