1b4a603b1e2f50838abda38cdcf9149bbc05e950ccd3d86efc943e4bd4d53191

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 00:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

libi422_i420_plugin.html
Size

6KB
MD5

7041be10ce01a6191c46b73080f90d21
SHA1

f1a823c0fde458699fb360a4d446c78e7a92fffe
SHA256

1b4a603b1e2f50838abda38cdcf9149bbc05e950ccd3d86efc943e4bd4d53191
SHA512

d7f1668fed141734ddf2056bab3caeedb2f30db93f332e2baa1080d1d2bb8ec7a8ec1c9c944722a722622e9e0aeb0adaaacb3cf7823346477afbc295f0b28696
SSDEEP

192:ZgiPMcMHyjzaDOn9FXDmGB/lo3IZgpeUgDUQE8uI:ZzPMcMHywKX9/PE8uI

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5024	msedge.exe
5024	msedge.exe
3864	msedge.exe
3864	msedge.exe
1156	identity_helper.exe
1156	identity_helper.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3864 wrote to memory of 1648	3864	msedge.exe	84
PID 3864 wrote to memory of 1648	3864	msedge.exe	84
PID 3864 wrote to memory of 652	3864	msedge.exe	85
PID 3864 wrote to memory of 652	3864	msedge.exe	85
PID 3864 wrote to memory of 652	3864	msedge.exe	85
PID 3864 wrote to memory of 652	3864	msedge.exe	85
PID 3864 wrote to memory of 652	3864	msedge.exe	85
PID 3864 wrote to memory of 652	3864	msedge.exe	85
PID 3864 wrote to memory of 652	3864	msedge.exe	85
PID 3864 wrote to memory of 652	3864	msedge.exe	85
PID 3864 wrote to memory of 652	3864	msedge.exe	85
PID 3864 wrote to memory of 652	3864	msedge.exe	85
PID 3864 wrote to memory of 652	3864	msedge.exe	85
PID 3864 wrote to memory of 652	3864	msedge.exe	85
PID 3864 wrote to memory of 652	3864	msedge.exe	85
PID 3864 wrote to memory of 652	3864	msedge.exe	85
PID 3864 wrote to memory of 652	3864	msedge.exe	85
PID 3864 wrote to memory of 652	3864	msedge.exe	85
PID 3864 wrote to memory of 652	3864	msedge.exe	85
PID 3864 wrote to memory of 652	3864	msedge.exe	85
PID 3864 wrote to memory of 652	3864	msedge.exe	85
PID 3864 wrote to memory of 652	3864	msedge.exe	85
PID 3864 wrote to memory of 652	3864	msedge.exe	85
PID 3864 wrote to memory of 652	3864	msedge.exe	85
PID 3864 wrote to memory of 652	3864	msedge.exe	85
PID 3864 wrote to memory of 652	3864	msedge.exe	85
PID 3864 wrote to memory of 652	3864	msedge.exe	85
PID 3864 wrote to memory of 652	3864	msedge.exe	85
PID 3864 wrote to memory of 652	3864	msedge.exe	85
PID 3864 wrote to memory of 652	3864	msedge.exe	85
PID 3864 wrote to memory of 652	3864	msedge.exe	85
PID 3864 wrote to memory of 652	3864	msedge.exe	85
PID 3864 wrote to memory of 652	3864	msedge.exe	85
PID 3864 wrote to memory of 652	3864	msedge.exe	85
PID 3864 wrote to memory of 652	3864	msedge.exe	85
PID 3864 wrote to memory of 652	3864	msedge.exe	85
PID 3864 wrote to memory of 652	3864	msedge.exe	85
PID 3864 wrote to memory of 652	3864	msedge.exe	85
PID 3864 wrote to memory of 652	3864	msedge.exe	85
PID 3864 wrote to memory of 652	3864	msedge.exe	85
PID 3864 wrote to memory of 652	3864	msedge.exe	85
PID 3864 wrote to memory of 652	3864	msedge.exe	85
PID 3864 wrote to memory of 5024	3864	msedge.exe	86
PID 3864 wrote to memory of 5024	3864	msedge.exe	86
PID 3864 wrote to memory of 2128	3864	msedge.exe	87
PID 3864 wrote to memory of 2128	3864	msedge.exe	87
PID 3864 wrote to memory of 2128	3864	msedge.exe	87
PID 3864 wrote to memory of 2128	3864	msedge.exe	87
PID 3864 wrote to memory of 2128	3864	msedge.exe	87
PID 3864 wrote to memory of 2128	3864	msedge.exe	87
PID 3864 wrote to memory of 2128	3864	msedge.exe	87
PID 3864 wrote to memory of 2128	3864	msedge.exe	87
PID 3864 wrote to memory of 2128	3864	msedge.exe	87
PID 3864 wrote to memory of 2128	3864	msedge.exe	87
PID 3864 wrote to memory of 2128	3864	msedge.exe	87
PID 3864 wrote to memory of 2128	3864	msedge.exe	87
PID 3864 wrote to memory of 2128	3864	msedge.exe	87
PID 3864 wrote to memory of 2128	3864	msedge.exe	87
PID 3864 wrote to memory of 2128	3864	msedge.exe	87
PID 3864 wrote to memory of 2128	3864	msedge.exe	87
PID 3864 wrote to memory of 2128	3864	msedge.exe	87
PID 3864 wrote to memory of 2128	3864	msedge.exe	87
PID 3864 wrote to memory of 2128	3864	msedge.exe	87
PID 3864 wrote to memory of 2128	3864	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\libi422_i420_plugin.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe5b1f46f8,0x7ffe5b1f4708,0x7ffe5b1f4718
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,5014989110152689124,8131756400829759071,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2244,5014989110152689124,8131756400829759071,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2632 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2244,5014989110152689124,8131756400829759071,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,5014989110152689124,8131756400829759071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,5014989110152689124,8131756400829759071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,5014989110152689124,8131756400829759071,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,5014989110152689124,8131756400829759071,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,5014989110152689124,8131756400829759071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,5014989110152689124,8131756400829759071,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,5014989110152689124,8131756400829759071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,5014989110152689124,8131756400829759071,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,5014989110152689124,8131756400829759071,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4708 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3720

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
120a75f233314ba1fe34e9d6c09f30b9

SHA1
a9f92f2d3f111eaadd9bcf8fceb3c9553753539c

SHA256
e04101215c3534dbc77c0b5df2e1d1ff74c277d2946f391f939c9a7948a22dd0

SHA512
3c4eb93e425b50e8bcc1712f4cc2be11888a0273c3a619fc6bf72ccab876a427158f661bfc80d0c1e47ef4116febf76a3aaa31a60ec662eae0e51c7f1d3d89b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bc2edd0741d97ae237e9f00bf3244144

SHA1
7c1e5d324f5c7137a3c4ec85146659f026c11782

SHA256
dbce3287c7ae69ccbd1d780c39f3ffa3c98bd4609a939fff8ee9c99f14265041

SHA512
00f505a0b4ea0df626175bf9d39a205f18f9754b62e4dba6fbb5b4a716b3539e7809723e1596bcfe1ba3041e22342e3a9cbaad88e84ce9c8c6531331bbc25093

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d2885d48435f14357629b0ffbf108bcc

SHA1
a0945c4308e97f85ac20c9aa4541970e5be4813d

SHA256
bd540026377e6cd93fa8b9e5e1a82251e4ef48b17e16c5e0072458e966563417

SHA512
0de8b049828ecc4e1720173e35392f4dc4245b747b3134a8a549f107a992f7df3df503a2053c33b163ab7f1a52f5901ebb35831c80e2264b2c3340cc11e62844

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9a8ea47c9f4b489d72afda512a8e4df5

SHA1
128206084653233e7791ac8093fbe8fbf50b0e35

SHA256
91a7c1bd1acc6c9a8f6639d6b2ab86b5844b813082855c309beab87112260b47

SHA512
d7e4921d04b7f6e979bee534dd0e8a33635f3d9adca5fbfaa408639c6f295814209fe5e6436e35944d200df56e0f5970a35a575659b67fb14d3cb2125a20f2ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cc0f9050448959739cc3640cd2801178

SHA1
f29eb645da6ead431a5a4e69c630ea8144417ef0

SHA256
0aa10096feae6fa79a258ad708340c5786c609b309074e8890cd1f88039c769f

SHA512
ada532245ef35aac45aac96e41d9366140026c2af80ab06e5f52722ab5b0787fa1c6298ca545fb5772cd2440ea2af25b0215d35a604176506fd91dc17101d9c3

Download Submit