ef6f1b82cebc1c5c57aac17cb71ec3138d12314725b26cfdce13c6d56cba53cf

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2024 00:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

libvout_directx_plugin.dll.svn-base?id=8328c31dba7c71ee20ee32f1a735d639f9e43928.html
Size

392KB
MD5

be63fc6d26cb0df9d00c47ebf525c6a0
SHA1

a36b882974b11c7eee51728624b6dcff3eb9e988
SHA256

ef6f1b82cebc1c5c57aac17cb71ec3138d12314725b26cfdce13c6d56cba53cf
SHA512

cfb4b6f686eb7d9110e7e43bea28ae8787ccddda5aa26040ef33e6a7179c0d62ca60da6d67a4437e91856647b6cb70e217b17d2ca9234df07905f6737f319bb9
SSDEEP

3072:Eh/L4AEyUxJZF4WL4lh8tfWQJ0BMo45K0R8V8AZ:PyUxJZOQ4lCWQJ0BMo45K0OV8s

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3752	msedge.exe
3752	msedge.exe
4604	msedge.exe
4604	msedge.exe
2376	identity_helper.exe
2376	identity_helper.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 4280	4604	msedge.exe	83
PID 4604 wrote to memory of 4280	4604	msedge.exe	83
PID 4604 wrote to memory of 4520	4604	msedge.exe	84
PID 4604 wrote to memory of 4520	4604	msedge.exe	84
PID 4604 wrote to memory of 4520	4604	msedge.exe	84
PID 4604 wrote to memory of 4520	4604	msedge.exe	84
PID 4604 wrote to memory of 4520	4604	msedge.exe	84
PID 4604 wrote to memory of 4520	4604	msedge.exe	84
PID 4604 wrote to memory of 4520	4604	msedge.exe	84
PID 4604 wrote to memory of 4520	4604	msedge.exe	84
PID 4604 wrote to memory of 4520	4604	msedge.exe	84
PID 4604 wrote to memory of 4520	4604	msedge.exe	84
PID 4604 wrote to memory of 4520	4604	msedge.exe	84
PID 4604 wrote to memory of 4520	4604	msedge.exe	84
PID 4604 wrote to memory of 4520	4604	msedge.exe	84
PID 4604 wrote to memory of 4520	4604	msedge.exe	84
PID 4604 wrote to memory of 4520	4604	msedge.exe	84
PID 4604 wrote to memory of 4520	4604	msedge.exe	84
PID 4604 wrote to memory of 4520	4604	msedge.exe	84
PID 4604 wrote to memory of 4520	4604	msedge.exe	84
PID 4604 wrote to memory of 4520	4604	msedge.exe	84
PID 4604 wrote to memory of 4520	4604	msedge.exe	84
PID 4604 wrote to memory of 4520	4604	msedge.exe	84
PID 4604 wrote to memory of 4520	4604	msedge.exe	84
PID 4604 wrote to memory of 4520	4604	msedge.exe	84
PID 4604 wrote to memory of 4520	4604	msedge.exe	84
PID 4604 wrote to memory of 4520	4604	msedge.exe	84
PID 4604 wrote to memory of 4520	4604	msedge.exe	84
PID 4604 wrote to memory of 4520	4604	msedge.exe	84
PID 4604 wrote to memory of 4520	4604	msedge.exe	84
PID 4604 wrote to memory of 4520	4604	msedge.exe	84
PID 4604 wrote to memory of 4520	4604	msedge.exe	84
PID 4604 wrote to memory of 4520	4604	msedge.exe	84
PID 4604 wrote to memory of 4520	4604	msedge.exe	84
PID 4604 wrote to memory of 4520	4604	msedge.exe	84
PID 4604 wrote to memory of 4520	4604	msedge.exe	84
PID 4604 wrote to memory of 4520	4604	msedge.exe	84
PID 4604 wrote to memory of 4520	4604	msedge.exe	84
PID 4604 wrote to memory of 4520	4604	msedge.exe	84
PID 4604 wrote to memory of 4520	4604	msedge.exe	84
PID 4604 wrote to memory of 4520	4604	msedge.exe	84
PID 4604 wrote to memory of 4520	4604	msedge.exe	84
PID 4604 wrote to memory of 3752	4604	msedge.exe	85
PID 4604 wrote to memory of 3752	4604	msedge.exe	85
PID 4604 wrote to memory of 864	4604	msedge.exe	86
PID 4604 wrote to memory of 864	4604	msedge.exe	86
PID 4604 wrote to memory of 864	4604	msedge.exe	86
PID 4604 wrote to memory of 864	4604	msedge.exe	86
PID 4604 wrote to memory of 864	4604	msedge.exe	86
PID 4604 wrote to memory of 864	4604	msedge.exe	86
PID 4604 wrote to memory of 864	4604	msedge.exe	86
PID 4604 wrote to memory of 864	4604	msedge.exe	86
PID 4604 wrote to memory of 864	4604	msedge.exe	86
PID 4604 wrote to memory of 864	4604	msedge.exe	86
PID 4604 wrote to memory of 864	4604	msedge.exe	86
PID 4604 wrote to memory of 864	4604	msedge.exe	86
PID 4604 wrote to memory of 864	4604	msedge.exe	86
PID 4604 wrote to memory of 864	4604	msedge.exe	86
PID 4604 wrote to memory of 864	4604	msedge.exe	86
PID 4604 wrote to memory of 864	4604	msedge.exe	86
PID 4604 wrote to memory of 864	4604	msedge.exe	86
PID 4604 wrote to memory of 864	4604	msedge.exe	86
PID 4604 wrote to memory of 864	4604	msedge.exe	86
PID 4604 wrote to memory of 864	4604	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\libvout_directx_plugin.dll.svn-base_id=8328c31dba7c71ee20ee32f1a735d639f9e43928.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9675246f8,0x7ff967524708,0x7ff967524718
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,17557886314574780008,9760748006135586179,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,17557886314574780008,9760748006135586179,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,17557886314574780008,9760748006135586179,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17557886314574780008,9760748006135586179,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17557886314574780008,9760748006135586179,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,17557886314574780008,9760748006135586179,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4196 /prefetch:8
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,17557886314574780008,9760748006135586179,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4196 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17557886314574780008,9760748006135586179,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17557886314574780008,9760748006135586179,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17557886314574780008,9760748006135586179,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17557886314574780008,9760748006135586179,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,17557886314574780008,9760748006135586179,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3400 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2316

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cff358b013d6f9f633bc1587f6f54ffa

SHA1
6cb7852e096be24695ff1bc213abde42d35bb376

SHA256
39205cdf989e3a86822b3f473c5fc223d7290b98c2a3fb7f75e366fc8e3ecbe9

SHA512
8831c223a1f0cf5f71fa851cdd82f4a9f03e5f267513e05b936756c116997f749ffa563623b4724de921d049de34a8f277cc539f58997cda4d178ea205be2259

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc629a750e345390344524fe0ea7dcd7

SHA1
5f9f00a358caaef0321707c4f6f38d52bd7e0399

SHA256
38b634f3fedcf2a9dc3280aa76bd1ea93e192200b8a48904664fac5c9944636a

SHA512
2a941fe90b748d0326e011258fa9b494dc2f47ac047767455ed16a41d523f04370f818316503a5bad0ff5c5699e92a0aaf3952748b09287c5328354bfa6cc902

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1d5daf7cb4f897309e8ad65b76a8147e

SHA1
7dde9fac1dcac6280e9882ed02233441d73207a6

SHA256
a6198849a8b6e28fc9ea4d6c16f40941911e9c4ec1eb0b67e900cd08a73a305d

SHA512
acefe3c5d1345d1569b3a17e4f4ff231f1593e02efd524f85b91c7158902f51838fec0954d9fe26a958ecf8587c356a9a0da7b729019004f45f0e8c88c821cf0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
87f07f81bfb028a2def8964a9550f423

SHA1
1d381c11f8ea830c51ffb8dc5c7d659a63183223

SHA256
247f602ff8f75839966df1c67a79bda7cbe40853f19d2a6e3a03da1d8859639b

SHA512
610c739c1661521062bc0194a478bc51a67ba342a170c680892cedf71199e24b73423dcf4d6d3e3fc43405186f5ff22562933a5acb84f5ddd7e8e1991cd86e10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
df14b03e0e435e3fcf705a73622d1b22

SHA1
b9f5c70059df7a59d37d7fbc4a42a58bc00044a7

SHA256
f13c43bc9ed32d8bcd6fc3d038eef2730d771a0228c139d4e7fb1ea14e78be63

SHA512
d43f297e2dfe4a84066a871aa99ca1a57550205e94b22b94016cf3e056863ce2aa556dcd27e13f69e507e9523d542e79c21f3dd1730917919f7a6facc1d4262b

Download Submit