a9adc0d7feaf7412e221aa890d80357ab70a3382279a193464166bb2ac71a59a

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 00:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
libvisual_plugin.dll.svn-base?id=3053a167982e379b031fe9fbe2a1d57c23026a90.html
Size 7KB
Sample240418-babc1sea77
SHA256 a9adc0d7feaf7412e221aa890d80357ab70a3382279a193464166bb2ac71a59a
MD5 087391bda53a13cb3ac3673127192da4
SHA1 9b81143a978b2472cf894eef4c02ea62764155e5
SHA512 53fc45a91fd9e621523a3b24dd56d490bd1c61755fe5a374e67ef7d6e017d756bef561fadf615ab0898e3698fe1393264376b401b50be2fbbccef0bd8a82c3e8
SSDEEP 192:Z7vTPMcMHyx1ivJv/Xv/dZv/SvCcv0mXHP5BxUFv/PvST/lo3fivvpv/BvWvIvgv:Z3PMcMHyx1m3dRBmXHP5BxUNST/2WedN
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1980	msedge.exe
1980	msedge.exe
520	msedge.exe
520	msedge.exe
2708	identity_helper.exe
2708	identity_helper.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 520 wrote to memory of 4552	520	msedge.exe	84
PID 520 wrote to memory of 4552	520	msedge.exe	84
PID 520 wrote to memory of 4928	520	msedge.exe	87
PID 520 wrote to memory of 4928	520	msedge.exe	87
PID 520 wrote to memory of 4928	520	msedge.exe	87
PID 520 wrote to memory of 4928	520	msedge.exe	87
PID 520 wrote to memory of 4928	520	msedge.exe	87
PID 520 wrote to memory of 4928	520	msedge.exe	87
PID 520 wrote to memory of 4928	520	msedge.exe	87
PID 520 wrote to memory of 4928	520	msedge.exe	87
PID 520 wrote to memory of 4928	520	msedge.exe	87
PID 520 wrote to memory of 4928	520	msedge.exe	87
PID 520 wrote to memory of 4928	520	msedge.exe	87
PID 520 wrote to memory of 4928	520	msedge.exe	87
PID 520 wrote to memory of 4928	520	msedge.exe	87
PID 520 wrote to memory of 4928	520	msedge.exe	87
PID 520 wrote to memory of 4928	520	msedge.exe	87
PID 520 wrote to memory of 4928	520	msedge.exe	87
PID 520 wrote to memory of 4928	520	msedge.exe	87
PID 520 wrote to memory of 4928	520	msedge.exe	87
PID 520 wrote to memory of 4928	520	msedge.exe	87
PID 520 wrote to memory of 4928	520	msedge.exe	87
PID 520 wrote to memory of 4928	520	msedge.exe	87
PID 520 wrote to memory of 4928	520	msedge.exe	87
PID 520 wrote to memory of 4928	520	msedge.exe	87
PID 520 wrote to memory of 4928	520	msedge.exe	87
PID 520 wrote to memory of 4928	520	msedge.exe	87
PID 520 wrote to memory of 4928	520	msedge.exe	87
PID 520 wrote to memory of 4928	520	msedge.exe	87
PID 520 wrote to memory of 4928	520	msedge.exe	87
PID 520 wrote to memory of 4928	520	msedge.exe	87
PID 520 wrote to memory of 4928	520	msedge.exe	87
PID 520 wrote to memory of 4928	520	msedge.exe	87
PID 520 wrote to memory of 4928	520	msedge.exe	87
PID 520 wrote to memory of 4928	520	msedge.exe	87
PID 520 wrote to memory of 4928	520	msedge.exe	87
PID 520 wrote to memory of 4928	520	msedge.exe	87
PID 520 wrote to memory of 4928	520	msedge.exe	87
PID 520 wrote to memory of 4928	520	msedge.exe	87
PID 520 wrote to memory of 4928	520	msedge.exe	87
PID 520 wrote to memory of 4928	520	msedge.exe	87
PID 520 wrote to memory of 4928	520	msedge.exe	87
PID 520 wrote to memory of 1980	520	msedge.exe	88
PID 520 wrote to memory of 1980	520	msedge.exe	88
PID 520 wrote to memory of 5096	520	msedge.exe	89
PID 520 wrote to memory of 5096	520	msedge.exe	89
PID 520 wrote to memory of 5096	520	msedge.exe	89
PID 520 wrote to memory of 5096	520	msedge.exe	89
PID 520 wrote to memory of 5096	520	msedge.exe	89
PID 520 wrote to memory of 5096	520	msedge.exe	89
PID 520 wrote to memory of 5096	520	msedge.exe	89
PID 520 wrote to memory of 5096	520	msedge.exe	89
PID 520 wrote to memory of 5096	520	msedge.exe	89
PID 520 wrote to memory of 5096	520	msedge.exe	89
PID 520 wrote to memory of 5096	520	msedge.exe	89
PID 520 wrote to memory of 5096	520	msedge.exe	89
PID 520 wrote to memory of 5096	520	msedge.exe	89
PID 520 wrote to memory of 5096	520	msedge.exe	89
PID 520 wrote to memory of 5096	520	msedge.exe	89
PID 520 wrote to memory of 5096	520	msedge.exe	89
PID 520 wrote to memory of 5096	520	msedge.exe	89
PID 520 wrote to memory of 5096	520	msedge.exe	89
PID 520 wrote to memory of 5096	520	msedge.exe	89
PID 520 wrote to memory of 5096	520	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\libvisual_plugin.dll.svn-base_id=3053a167982e379b031fe9fbe2a1d57c23026a90.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9764146f8,0x7ff976414708,0x7ff976414718
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,4093296476590354073,12712612181616654953,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,4093296476590354073,12712612181616654953,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,4093296476590354073,12712612181616654953,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:8
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,4093296476590354073,12712612181616654953,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,4093296476590354073,12712612181616654953,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,4093296476590354073,12712612181616654953,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,4093296476590354073,12712612181616654953,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,4093296476590354073,12712612181616654953,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,4093296476590354073,12712612181616654953,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,4093296476590354073,12712612181616654953,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4728 /prefetch:8
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,4093296476590354073,12712612181616654953,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4728 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,4093296476590354073,12712612181616654953,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3112 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 0eff6f3011208a312a1010db0620bb6680fe49d4fa3344930302e950b74ad005
MD5 e2ece0fcb9f6256efba522462a9a9288
SHA1 ccc599f64d30e15833b45c7e52924d4bd2f54acb
SHA512 ead68dd972cfb1eccc194572279ae3e4ac989546bfb9e8d511c6bc178fc12aaebd20b49860d2b70ac1f5d4236b0df1b484a979b926edbe23f281b8139ff1a9ac
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 3118d55d1f04ecdd849971d8c49896b5c874bdbea63e5288547b9812c0640e10
MD5 864aa9768ef47143c455b31fd314d660
SHA1 09d879e0e77698f28b435ed0e7d8e166e28fafa2
SHA512 75dce411fce8166c8905ed8da910adb1dd08ab1c9d7cd5431ef905531f2f0374caf73dedd5d238b457ece61273f6c81e632d23eb8409efbb6bf0d01442008488
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 7378d758bdc9cc1abdff364ee217d5f141627b34ceeb32e36167058a9db35d18
MD5 55a065abccfaf47fe15e3e5027b198b2
SHA1 264611ef577f7cc83c3c2ff3d649fc87d42a95d6
SHA512 ef0755c39afc21741007fe177daa18d2f48e1f16e07180dcf2d6a3f7407764d5b481baa6ca426fcfa200ee37906943b43ede97bfbb5169258ec1030c534b14db
SSDEEP 96:n8kivxm/YQYmqR1huaOwpvWMoiVmdeHbv+UgUWQyV+VDCziEwb:n8kiE9uzuaOGWMXLXgro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 7c7b20539e968ab54734cae095c673c6a7299159e7852790b6f1e75ec8bfea6c
MD5 a026ea72fc62807f0cb32ececf1ccfc5
SHA1 d2b752c3dc80c1ec2ed2965f40906b20a736da5e
SHA512 824be69d37ae9e7dea98e3a1001ed0097ee0da042315402522995de6af91b98e27657befb422cd8a5119008d53238e1e140524c163d6088636afec42c757b915
SSDEEP 96:n8kivxm/YnmqR1heaOwpvWMoiVmdeE9qbv+UgUWQyV+VDCAiEwb:n8kiEjuzeaOGWMCqLXgrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 f3db5938121518d4e744f321eebd30e4ff4dca1217afbecf87ae9b75651d9851
MD5 7fc26e4a3d5abf4b62e080600856b6a2
SHA1 bf4d216c706bc46f76312568b224b89bbdfda3e7
SHA512 f4c64606ba24d58349daf14c8f8fe8347ddc2d9495657f5820ed33eee49a60375f9ac0a61e6408c211917c98c90b29c3e2fadd33da980cf5c8eb76c406cfafb5
SSDEEP 192:ioCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup6QTu8Qe2RU+qJf8dP4M+oF:29iIxuERzA83h09RZxYe8O8EAKO4UcD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 b0abd7980afe287a593b4c97e6af7b78645fd5dedefcea4ded1aba0466894331
MD5 f176657672147508c804ba291330e346
SHA1 f6349a35038fd92694a91f9d9f123a6c926d4232
SHA512 18f649bcc44a782ddbf6818bcf7a7eba81439bc9090acca0c199f6146cf5ffc7b9604c93168176cc9b20d6c3a8bb27ef8da284d740381698ecbcc494b822c526
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupSQTu8Qe2RU+qAfHdP4M+oF:A9iIxuERzA83h09RZxYW8OT9AKO4UcD
MD5 SHA1 SHA512 SSDEEP

Submit Download