7fcf9ef484ac626e36bea70691d139fa97afb5836328874590c8ab2d5fd7184d

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 00:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

libvlccore.html
Size

6KB
MD5

a63dd4b758f011f330d4ae196b2a5e87
SHA1

860bc7d7c3ff9f7de4f45008843e506dabc829c4
SHA256

7fcf9ef484ac626e36bea70691d139fa97afb5836328874590c8ab2d5fd7184d
SHA512

d704d267a7e0bf929251f8dc66b2ea3a7c9d61637e365e99387f56093acbfe044afb448983e7a78c5ef8090035ff980b0c1b2196b0c0bde17125c86e390e7883
SSDEEP

96:ZRfPMcMHyF7MnH5+XpR9wleDrlFAnV34brbWbUtiES3uI:Z9PMcMHySUXNB/lo3HUQE8uI

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4604	msedge.exe
4604	msedge.exe
952	msedge.exe
952	msedge.exe
2704	identity_helper.exe
2704	identity_helper.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 4900	952	msedge.exe	83
PID 952 wrote to memory of 4900	952	msedge.exe	83
PID 952 wrote to memory of 2536	952	msedge.exe	84
PID 952 wrote to memory of 2536	952	msedge.exe	84
PID 952 wrote to memory of 2536	952	msedge.exe	84
PID 952 wrote to memory of 2536	952	msedge.exe	84
PID 952 wrote to memory of 2536	952	msedge.exe	84
PID 952 wrote to memory of 2536	952	msedge.exe	84
PID 952 wrote to memory of 2536	952	msedge.exe	84
PID 952 wrote to memory of 2536	952	msedge.exe	84
PID 952 wrote to memory of 2536	952	msedge.exe	84
PID 952 wrote to memory of 2536	952	msedge.exe	84
PID 952 wrote to memory of 2536	952	msedge.exe	84
PID 952 wrote to memory of 2536	952	msedge.exe	84
PID 952 wrote to memory of 2536	952	msedge.exe	84
PID 952 wrote to memory of 2536	952	msedge.exe	84
PID 952 wrote to memory of 2536	952	msedge.exe	84
PID 952 wrote to memory of 2536	952	msedge.exe	84
PID 952 wrote to memory of 2536	952	msedge.exe	84
PID 952 wrote to memory of 2536	952	msedge.exe	84
PID 952 wrote to memory of 2536	952	msedge.exe	84
PID 952 wrote to memory of 2536	952	msedge.exe	84
PID 952 wrote to memory of 2536	952	msedge.exe	84
PID 952 wrote to memory of 2536	952	msedge.exe	84
PID 952 wrote to memory of 2536	952	msedge.exe	84
PID 952 wrote to memory of 2536	952	msedge.exe	84
PID 952 wrote to memory of 2536	952	msedge.exe	84
PID 952 wrote to memory of 2536	952	msedge.exe	84
PID 952 wrote to memory of 2536	952	msedge.exe	84
PID 952 wrote to memory of 2536	952	msedge.exe	84
PID 952 wrote to memory of 2536	952	msedge.exe	84
PID 952 wrote to memory of 2536	952	msedge.exe	84
PID 952 wrote to memory of 2536	952	msedge.exe	84
PID 952 wrote to memory of 2536	952	msedge.exe	84
PID 952 wrote to memory of 2536	952	msedge.exe	84
PID 952 wrote to memory of 2536	952	msedge.exe	84
PID 952 wrote to memory of 2536	952	msedge.exe	84
PID 952 wrote to memory of 2536	952	msedge.exe	84
PID 952 wrote to memory of 2536	952	msedge.exe	84
PID 952 wrote to memory of 2536	952	msedge.exe	84
PID 952 wrote to memory of 2536	952	msedge.exe	84
PID 952 wrote to memory of 2536	952	msedge.exe	84
PID 952 wrote to memory of 4604	952	msedge.exe	85
PID 952 wrote to memory of 4604	952	msedge.exe	85
PID 952 wrote to memory of 976	952	msedge.exe	86
PID 952 wrote to memory of 976	952	msedge.exe	86
PID 952 wrote to memory of 976	952	msedge.exe	86
PID 952 wrote to memory of 976	952	msedge.exe	86
PID 952 wrote to memory of 976	952	msedge.exe	86
PID 952 wrote to memory of 976	952	msedge.exe	86
PID 952 wrote to memory of 976	952	msedge.exe	86
PID 952 wrote to memory of 976	952	msedge.exe	86
PID 952 wrote to memory of 976	952	msedge.exe	86
PID 952 wrote to memory of 976	952	msedge.exe	86
PID 952 wrote to memory of 976	952	msedge.exe	86
PID 952 wrote to memory of 976	952	msedge.exe	86
PID 952 wrote to memory of 976	952	msedge.exe	86
PID 952 wrote to memory of 976	952	msedge.exe	86
PID 952 wrote to memory of 976	952	msedge.exe	86
PID 952 wrote to memory of 976	952	msedge.exe	86
PID 952 wrote to memory of 976	952	msedge.exe	86
PID 952 wrote to memory of 976	952	msedge.exe	86
PID 952 wrote to memory of 976	952	msedge.exe	86
PID 952 wrote to memory of 976	952	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\libvlccore.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8a7be46f8,0x7ff8a7be4708,0x7ff8a7be4718
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1952,18212744999019210833,17827356779820731982,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1952,18212744999019210833,17827356779820731982,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1952,18212744999019210833,17827356779820731982,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,18212744999019210833,17827356779820731982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,18212744999019210833,17827356779820731982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1952,18212744999019210833,17827356779820731982,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1952,18212744999019210833,17827356779820731982,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,18212744999019210833,17827356779820731982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,18212744999019210833,17827356779820731982,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,18212744999019210833,17827356779820731982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,18212744999019210833,17827356779820731982,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1952,18212744999019210833,17827356779820731982,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2756

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9519bc058003dbea34765176083739e

SHA1
ef49b8790219eaddbdacb7fc97d3d05433b8575c

SHA256
e034683bc434a09f5d0293cb786e6a3943b902614f9211d42bed47759164d38b

SHA512
a1b67ccf313173c560ead25671c64de65e3e2599251926e33ce8399fde682fce5cb20f36ee330fcd8bb8f7a9c00ef432da56c9b02dfd7d3f02865f390c342b53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cb138796dbfb37877fcae3430bb1e2a7

SHA1
82bb82178c07530e42eca6caf3178d66527558bc

SHA256
50c55ba7baeebe1fa4573118edbca59010d659ea42761148618fb3af8a1c9bdd

SHA512
287471cccbe33e08015d6fc35e0bcdca0ec79bebc3a58f6a340b7747b5b2257b33651574bc83ed529aef2ba94be6e68968e59d2a8ef5f733dce9df6404ad7cc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0358047f7576a3658e23b7e709e53944

SHA1
566c2e27848b6b7147d723690c4475fc8e2e80ec

SHA256
eb69a1be0a2dcadd7b6b0056de1ca05e1ffdfbb4f2c310ba7aa16108e6b29831

SHA512
653d565980fee0dad71b0b02f1ae1a973b0e65682425de5586b9560aa6b3610849ceb76bc3810f7b57ef9906126fba13695bc7847a500444b2febb0d30f67987

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
86f5dfeb236ce883a57d12798905739b

SHA1
b3deeff0e8dd8cab82cb843c61320ef46dcb809b

SHA256
c694b5cbf69c132de3bd8ad84cc4a58a17e9f7453626bfe367f18590d08a08ec

SHA512
3147b9c965e3cba30b50f33521f0961da7ca094b85dc962f7efcd81175d0ed907586245349ba31f2cc1e964fbd04406d5c4687b9d60c4d6d3cb632e863347ea7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5f237147136ed4841013039eb8b8b620

SHA1
94748a6fa2a1ab3d2ae3507f2da88ba8cd3b3a1c

SHA256
bdc92d8d9f5bf641cf6b98dad4c76f766b9c351350bce49da84a4233f97da7b2

SHA512
0e52fee989563d5fa75bc9da88a9e77bb46d65f6c220415b49b9639ed7f057b6253b8c6ce2928387f388f80344278fd2c7b317d7d3160d38e3f2c7e1773dcd03

Download Submit