3b5d1e33b9cf7940a0468c99d1fcae88912794627079f2c31d80fab781a9abb5

Analysis

max time kernel
147s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 00:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

libflacsys_plugin.dll.svn-base?id=8328c31dba7c71ee20ee32f1a735d639f9e43928.html
Size

7KB
MD5

228d16c3c1900caefc9387857dda3e92
SHA1

5f60b445be6a7b7d4d70c700add6f091f3e6ce84
SHA256

3b5d1e33b9cf7940a0468c99d1fcae88912794627079f2c31d80fab781a9abb5
SHA512

b361e5f337aaf4bee1c2541a921d5ea057cc8f0819576c978e9527aad408fdb0b7590b1afb3f6bb7680f42eca40f64aebae4bed7eca8e3683162915137b02f16
SSDEEP

192:Z+pvTPMcMHyRpv0pv3pviEpv0pvCBpvMX7pv7pv5B/lo32pvmpvtpvRpv9pvdpv4:ZOPMcMHyflX3/fE8uI

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
228	msedge.exe
228	msedge.exe
4008	msedge.exe
4008	msedge.exe
3020	identity_helper.exe
3020	identity_helper.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4008 wrote to memory of 1584	4008	msedge.exe	83
PID 4008 wrote to memory of 1584	4008	msedge.exe	83
PID 4008 wrote to memory of 1968	4008	msedge.exe	85
PID 4008 wrote to memory of 1968	4008	msedge.exe	85
PID 4008 wrote to memory of 1968	4008	msedge.exe	85
PID 4008 wrote to memory of 1968	4008	msedge.exe	85
PID 4008 wrote to memory of 1968	4008	msedge.exe	85
PID 4008 wrote to memory of 1968	4008	msedge.exe	85
PID 4008 wrote to memory of 1968	4008	msedge.exe	85
PID 4008 wrote to memory of 1968	4008	msedge.exe	85
PID 4008 wrote to memory of 1968	4008	msedge.exe	85
PID 4008 wrote to memory of 1968	4008	msedge.exe	85
PID 4008 wrote to memory of 1968	4008	msedge.exe	85
PID 4008 wrote to memory of 1968	4008	msedge.exe	85
PID 4008 wrote to memory of 1968	4008	msedge.exe	85
PID 4008 wrote to memory of 1968	4008	msedge.exe	85
PID 4008 wrote to memory of 1968	4008	msedge.exe	85
PID 4008 wrote to memory of 1968	4008	msedge.exe	85
PID 4008 wrote to memory of 1968	4008	msedge.exe	85
PID 4008 wrote to memory of 1968	4008	msedge.exe	85
PID 4008 wrote to memory of 1968	4008	msedge.exe	85
PID 4008 wrote to memory of 1968	4008	msedge.exe	85
PID 4008 wrote to memory of 1968	4008	msedge.exe	85
PID 4008 wrote to memory of 1968	4008	msedge.exe	85
PID 4008 wrote to memory of 1968	4008	msedge.exe	85
PID 4008 wrote to memory of 1968	4008	msedge.exe	85
PID 4008 wrote to memory of 1968	4008	msedge.exe	85
PID 4008 wrote to memory of 1968	4008	msedge.exe	85
PID 4008 wrote to memory of 1968	4008	msedge.exe	85
PID 4008 wrote to memory of 1968	4008	msedge.exe	85
PID 4008 wrote to memory of 1968	4008	msedge.exe	85
PID 4008 wrote to memory of 1968	4008	msedge.exe	85
PID 4008 wrote to memory of 1968	4008	msedge.exe	85
PID 4008 wrote to memory of 1968	4008	msedge.exe	85
PID 4008 wrote to memory of 1968	4008	msedge.exe	85
PID 4008 wrote to memory of 1968	4008	msedge.exe	85
PID 4008 wrote to memory of 1968	4008	msedge.exe	85
PID 4008 wrote to memory of 1968	4008	msedge.exe	85
PID 4008 wrote to memory of 1968	4008	msedge.exe	85
PID 4008 wrote to memory of 1968	4008	msedge.exe	85
PID 4008 wrote to memory of 1968	4008	msedge.exe	85
PID 4008 wrote to memory of 1968	4008	msedge.exe	85
PID 4008 wrote to memory of 228	4008	msedge.exe	86
PID 4008 wrote to memory of 228	4008	msedge.exe	86
PID 4008 wrote to memory of 4892	4008	msedge.exe	87
PID 4008 wrote to memory of 4892	4008	msedge.exe	87
PID 4008 wrote to memory of 4892	4008	msedge.exe	87
PID 4008 wrote to memory of 4892	4008	msedge.exe	87
PID 4008 wrote to memory of 4892	4008	msedge.exe	87
PID 4008 wrote to memory of 4892	4008	msedge.exe	87
PID 4008 wrote to memory of 4892	4008	msedge.exe	87
PID 4008 wrote to memory of 4892	4008	msedge.exe	87
PID 4008 wrote to memory of 4892	4008	msedge.exe	87
PID 4008 wrote to memory of 4892	4008	msedge.exe	87
PID 4008 wrote to memory of 4892	4008	msedge.exe	87
PID 4008 wrote to memory of 4892	4008	msedge.exe	87
PID 4008 wrote to memory of 4892	4008	msedge.exe	87
PID 4008 wrote to memory of 4892	4008	msedge.exe	87
PID 4008 wrote to memory of 4892	4008	msedge.exe	87
PID 4008 wrote to memory of 4892	4008	msedge.exe	87
PID 4008 wrote to memory of 4892	4008	msedge.exe	87
PID 4008 wrote to memory of 4892	4008	msedge.exe	87
PID 4008 wrote to memory of 4892	4008	msedge.exe	87
PID 4008 wrote to memory of 4892	4008	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\libflacsys_plugin.dll.svn-base_id=8328c31dba7c71ee20ee32f1a735d639f9e43928.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff04f846f8,0x7fff04f84708,0x7fff04f84718
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,11507265931123664126,17966091697961068512,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,11507265931123664126,17966091697961068512,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,11507265931123664126,17966091697961068512,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11507265931123664126,17966091697961068512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11507265931123664126,17966091697961068512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11507265931123664126,17966091697961068512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11507265931123664126,17966091697961068512,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11507265931123664126,17966091697961068512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11507265931123664126,17966091697961068512,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,11507265931123664126,17966091697961068512,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,11507265931123664126,17966091697961068512,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,11507265931123664126,17966091697961068512,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5500 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1612

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
846ce533b9e20979bf1857f1afb61925

SHA1
4c6726618d10805940dba5e6cf849448b552bf68

SHA256
b81574d678f49d36d874dc062a1291092ab94164b92f7e30d42d9c61cc0e77c3

SHA512
8fb228fae89f063159dabc93871db205d836bdb4ec8f54a2f642bd0b1ac531eea0c21234a8ca75a0ae9a008d2399a9bf20a481f5d6a6eab53a533cd03aeaaa2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
104aab1e178489256a1425b28119ec93

SHA1
0bcf8ad28df672c618cb832ba8de8f85bd858a6c

SHA256
b92c19f079ef5948cb58654ce76f582a480a82cddc5083764ed7f1eac27b8d01

SHA512
b4f930f87eb86497672f32eb7cc77548d8afb09ad9fdba0508f368d5710e3a75c44b1fd9f96c98c2f0bd08deb4afde28330b11cf23e456c92cc509d28677d2cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d346ed5f9e09aa327990a60474a6fbcf

SHA1
86b9296b80bcf476901da014eb51e8fbeefc9e46

SHA256
65130bee79257b0ff939656e255f22353c971a99f8e7782dbfbcb6fccf931b68

SHA512
27d35f2d7b7034b95d863cf2e90cf0763c67a9a4880f342e7b80703ed3a47ab8e742216938b712a247bff2e0f83288077acdb18757a12cf61dfd737715ff5168

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4e4279506cea0fb5a41ed60a9afec7fb

SHA1
4dfd549403a7897dc98a27bf1fad58b11da2dbae

SHA256
f51694fbeabcb7249bcfc4f434a9a3dacdae3d64ab0d2a9a7331cb00bb3ae7c5

SHA512
8553c8c85c07c80fdaad780c7f4f832b8491ec8083133579a4b6a9fb671f5ce90f2eb9d17ee2895ebc028bf8f0f000b9b3ab05b1e707af7ce1de1f96575c53a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b63143ac25422f244c7fae190fb38104

SHA1
5a710c32ad9c66ff3a4dd7a1d95c4afac3c65421

SHA256
a291a134671d165c153a66ef7fd5a2a0e680ce827c38c7e5d5641aca037c762f

SHA512
5b8847d4e21c1ea9a7beae2e78ed11a9c766119daaf821432855402c78b3890ec6f0810dfbda8c5775974fba02d86fd0c7c4e52b5bf9482cbf50d1d3f531f260

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2e4352db7506232b19f7b85aeba58fc0

SHA1
87bfc255134d41489665dd13d2ad5d574ca7639d

SHA256
936a77579e9d60dcff2c7561b8e699d873eac4415bc8bd547dcbb87d1f428417

SHA512
fde5a93a4274b7655a617b0131fa4ad5a8bf021d96bff5797ab4973454439db04c782ad0e682d3b6fee143a2c34dacf05d10648ad576c3332c891332801ef7e7

Download Submit