fa8ae96cbef7e6956fa90b9e6b318eb5270d0a8ba19b77821c38a26dc3d5de1b

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2024 00:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

libvmem_plugin.dll.html
Size

7KB
MD5

ec9fa7206a6f2d00a06dc49cdced7766
SHA1

4f6ae4dc40f2ecfadbc094f3039d26c61d3e5374
SHA256

fa8ae96cbef7e6956fa90b9e6b318eb5270d0a8ba19b77821c38a26dc3d5de1b
SHA512

896d768faff16a1904d630a0f85fc627bc02649356e94548a3eb1ef7f634fbe31fbb645285396ae862b88c5e8bbad36f2fbebd1ea101002c4573917071e44a54
SSDEEP

192:ZWvTPMcMHyx1Pvwv/Kv/dAv//vClv0mXHP5BxSSv/gvST/lo3fPvvQv/ovLavJv0:ZKPMcMHyx1m4dWjmXHP5BxSQJT/2ecfN

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1216	msedge.exe
1216	msedge.exe
1236	msedge.exe
1236	msedge.exe
4872	identity_helper.exe
4872	identity_helper.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 1972	1236	msedge.exe	89
PID 1236 wrote to memory of 1972	1236	msedge.exe	89
PID 1236 wrote to memory of 4808	1236	msedge.exe	90
PID 1236 wrote to memory of 4808	1236	msedge.exe	90
PID 1236 wrote to memory of 4808	1236	msedge.exe	90
PID 1236 wrote to memory of 4808	1236	msedge.exe	90
PID 1236 wrote to memory of 4808	1236	msedge.exe	90
PID 1236 wrote to memory of 4808	1236	msedge.exe	90
PID 1236 wrote to memory of 4808	1236	msedge.exe	90
PID 1236 wrote to memory of 4808	1236	msedge.exe	90
PID 1236 wrote to memory of 4808	1236	msedge.exe	90
PID 1236 wrote to memory of 4808	1236	msedge.exe	90
PID 1236 wrote to memory of 4808	1236	msedge.exe	90
PID 1236 wrote to memory of 4808	1236	msedge.exe	90
PID 1236 wrote to memory of 4808	1236	msedge.exe	90
PID 1236 wrote to memory of 4808	1236	msedge.exe	90
PID 1236 wrote to memory of 4808	1236	msedge.exe	90
PID 1236 wrote to memory of 4808	1236	msedge.exe	90
PID 1236 wrote to memory of 4808	1236	msedge.exe	90
PID 1236 wrote to memory of 4808	1236	msedge.exe	90
PID 1236 wrote to memory of 4808	1236	msedge.exe	90
PID 1236 wrote to memory of 4808	1236	msedge.exe	90
PID 1236 wrote to memory of 4808	1236	msedge.exe	90
PID 1236 wrote to memory of 4808	1236	msedge.exe	90
PID 1236 wrote to memory of 4808	1236	msedge.exe	90
PID 1236 wrote to memory of 4808	1236	msedge.exe	90
PID 1236 wrote to memory of 4808	1236	msedge.exe	90
PID 1236 wrote to memory of 4808	1236	msedge.exe	90
PID 1236 wrote to memory of 4808	1236	msedge.exe	90
PID 1236 wrote to memory of 4808	1236	msedge.exe	90
PID 1236 wrote to memory of 4808	1236	msedge.exe	90
PID 1236 wrote to memory of 4808	1236	msedge.exe	90
PID 1236 wrote to memory of 4808	1236	msedge.exe	90
PID 1236 wrote to memory of 4808	1236	msedge.exe	90
PID 1236 wrote to memory of 4808	1236	msedge.exe	90
PID 1236 wrote to memory of 4808	1236	msedge.exe	90
PID 1236 wrote to memory of 4808	1236	msedge.exe	90
PID 1236 wrote to memory of 4808	1236	msedge.exe	90
PID 1236 wrote to memory of 4808	1236	msedge.exe	90
PID 1236 wrote to memory of 4808	1236	msedge.exe	90
PID 1236 wrote to memory of 4808	1236	msedge.exe	90
PID 1236 wrote to memory of 4808	1236	msedge.exe	90
PID 1236 wrote to memory of 1216	1236	msedge.exe	91
PID 1236 wrote to memory of 1216	1236	msedge.exe	91
PID 1236 wrote to memory of 3480	1236	msedge.exe	92
PID 1236 wrote to memory of 3480	1236	msedge.exe	92
PID 1236 wrote to memory of 3480	1236	msedge.exe	92
PID 1236 wrote to memory of 3480	1236	msedge.exe	92
PID 1236 wrote to memory of 3480	1236	msedge.exe	92
PID 1236 wrote to memory of 3480	1236	msedge.exe	92
PID 1236 wrote to memory of 3480	1236	msedge.exe	92
PID 1236 wrote to memory of 3480	1236	msedge.exe	92
PID 1236 wrote to memory of 3480	1236	msedge.exe	92
PID 1236 wrote to memory of 3480	1236	msedge.exe	92
PID 1236 wrote to memory of 3480	1236	msedge.exe	92
PID 1236 wrote to memory of 3480	1236	msedge.exe	92
PID 1236 wrote to memory of 3480	1236	msedge.exe	92
PID 1236 wrote to memory of 3480	1236	msedge.exe	92
PID 1236 wrote to memory of 3480	1236	msedge.exe	92
PID 1236 wrote to memory of 3480	1236	msedge.exe	92
PID 1236 wrote to memory of 3480	1236	msedge.exe	92
PID 1236 wrote to memory of 3480	1236	msedge.exe	92
PID 1236 wrote to memory of 3480	1236	msedge.exe	92
PID 1236 wrote to memory of 3480	1236	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\libvmem_plugin.dll.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc470046f8,0x7ffc47004708,0x7ffc47004718
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2248,17439487443794381710,17730572297419680067,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2248,17439487443794381710,17730572297419680067,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2248,17439487443794381710,17730572297419680067,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,17439487443794381710,17730572297419680067,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,17439487443794381710,17730572297419680067,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,17439487443794381710,17730572297419680067,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,17439487443794381710,17730572297419680067,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,17439487443794381710,17730572297419680067,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2284 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,17439487443794381710,17730572297419680067,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,17439487443794381710,17730572297419680067,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,17439487443794381710,17730572297419680067,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2248,17439487443794381710,17730572297419680067,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1392 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1472

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cff358b013d6f9f633bc1587f6f54ffa

SHA1
6cb7852e096be24695ff1bc213abde42d35bb376

SHA256
39205cdf989e3a86822b3f473c5fc223d7290b98c2a3fb7f75e366fc8e3ecbe9

SHA512
8831c223a1f0cf5f71fa851cdd82f4a9f03e5f267513e05b936756c116997f749ffa563623b4724de921d049de34a8f277cc539f58997cda4d178ea205be2259

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc629a750e345390344524fe0ea7dcd7

SHA1
5f9f00a358caaef0321707c4f6f38d52bd7e0399

SHA256
38b634f3fedcf2a9dc3280aa76bd1ea93e192200b8a48904664fac5c9944636a

SHA512
2a941fe90b748d0326e011258fa9b494dc2f47ac047767455ed16a41d523f04370f818316503a5bad0ff5c5699e92a0aaf3952748b09287c5328354bfa6cc902

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d692f4c0d1224056e6f5cbf5381b3ecf

SHA1
68300b82bb7c6565f5460cc7bdbae45f9e3a1854

SHA256
45965f9d443394cc76f63452ed6a49f225b3a9c9a2e544027d1c9f638b884125

SHA512
255dc8e94a79274788c884eaf38e8bdb5c4436ddb539e84b815c3ab2efd6af6c6d3417183fb6b83074a0bf1198ba5eea9213f91ab4f1c9933c21c9395c1eddf1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7c6f5153d08317b10853e3a4c96fe40f

SHA1
37f0db2dd96c3ff23be83d96caa4b41956a9539b

SHA256
c450277db55430f406d6fbf2b220ade77779dcb865f971f9323afd7e775dd507

SHA512
2a3ce75b49534c3fa78b60c1f00861a399b28b9e1781db2d22ec8e3ecdfcf47ebdbdfaf11e6011637e4ab59f79020d47303ff77d62f6aaa02a0ae234df5c6828

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
991f2b348f3109b16db15c1f02d70bdd

SHA1
cc442c0bcc34db3589c9b2bc30075e92c8664349

SHA256
90c50644a3a065f91d75b90207fcb256638af101e251e599fc3520cd28d95a97

SHA512
0383577236976533c4ffcd9890097f579f5d408e86fcacab143df858b3018f58c9f8c516af4a259b3c2bb23f6d993c72b6937df4fb174763d1afdc8f2df60f3f

Download Submit