0e81c5e6f4901b4c5b528ff4b38ae6c75d7852838277f10e25b81984adf4f5bc

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 10:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
libclone_plugin.dll.svn-base?id=8328c31dba7c71ee20ee32f1a735d639f9e43928.html
Size 7KB
Sample240419-l8czlsfa52
SHA256 0e81c5e6f4901b4c5b528ff4b38ae6c75d7852838277f10e25b81984adf4f5bc
MD5 3e9b584915716377a402411d59299603
SHA1 ea7384cedde4828645764a5e2e4834c47553a584
SHA512 cfa6c1d0022dc9fc70edc02b619d1acf5f4b3b74256fb6c20d88f9685b936f955ba4effa81263641b03085bbe59eebec651a66e7ff58dbe338b4c1775ba6bbe8
SSDEEP 192:ZuvTPMcMHyvvsvNvi8vsvCfvMXZv7v5B/lo3Gv2vLvnSvbvYvvLvdUQE8uI:ZyPMcMHyT1XN/EE8uI
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2696	msedge.exe
2696	msedge.exe
1600	msedge.exe
1600	msedge.exe
4328	identity_helper.exe
4328	identity_helper.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 2124	1600	msedge.exe	87
PID 1600 wrote to memory of 2124	1600	msedge.exe	87
PID 1600 wrote to memory of 3360	1600	msedge.exe	88
PID 1600 wrote to memory of 3360	1600	msedge.exe	88
PID 1600 wrote to memory of 3360	1600	msedge.exe	88
PID 1600 wrote to memory of 3360	1600	msedge.exe	88
PID 1600 wrote to memory of 3360	1600	msedge.exe	88
PID 1600 wrote to memory of 3360	1600	msedge.exe	88
PID 1600 wrote to memory of 3360	1600	msedge.exe	88
PID 1600 wrote to memory of 3360	1600	msedge.exe	88
PID 1600 wrote to memory of 3360	1600	msedge.exe	88
PID 1600 wrote to memory of 3360	1600	msedge.exe	88
PID 1600 wrote to memory of 3360	1600	msedge.exe	88
PID 1600 wrote to memory of 3360	1600	msedge.exe	88
PID 1600 wrote to memory of 3360	1600	msedge.exe	88
PID 1600 wrote to memory of 3360	1600	msedge.exe	88
PID 1600 wrote to memory of 3360	1600	msedge.exe	88
PID 1600 wrote to memory of 3360	1600	msedge.exe	88
PID 1600 wrote to memory of 3360	1600	msedge.exe	88
PID 1600 wrote to memory of 3360	1600	msedge.exe	88
PID 1600 wrote to memory of 3360	1600	msedge.exe	88
PID 1600 wrote to memory of 3360	1600	msedge.exe	88
PID 1600 wrote to memory of 3360	1600	msedge.exe	88
PID 1600 wrote to memory of 3360	1600	msedge.exe	88
PID 1600 wrote to memory of 3360	1600	msedge.exe	88
PID 1600 wrote to memory of 3360	1600	msedge.exe	88
PID 1600 wrote to memory of 3360	1600	msedge.exe	88
PID 1600 wrote to memory of 3360	1600	msedge.exe	88
PID 1600 wrote to memory of 3360	1600	msedge.exe	88
PID 1600 wrote to memory of 3360	1600	msedge.exe	88
PID 1600 wrote to memory of 3360	1600	msedge.exe	88
PID 1600 wrote to memory of 3360	1600	msedge.exe	88
PID 1600 wrote to memory of 3360	1600	msedge.exe	88
PID 1600 wrote to memory of 3360	1600	msedge.exe	88
PID 1600 wrote to memory of 3360	1600	msedge.exe	88
PID 1600 wrote to memory of 3360	1600	msedge.exe	88
PID 1600 wrote to memory of 3360	1600	msedge.exe	88
PID 1600 wrote to memory of 3360	1600	msedge.exe	88
PID 1600 wrote to memory of 3360	1600	msedge.exe	88
PID 1600 wrote to memory of 3360	1600	msedge.exe	88
PID 1600 wrote to memory of 3360	1600	msedge.exe	88
PID 1600 wrote to memory of 3360	1600	msedge.exe	88
PID 1600 wrote to memory of 2696	1600	msedge.exe	89
PID 1600 wrote to memory of 2696	1600	msedge.exe	89
PID 1600 wrote to memory of 4548	1600	msedge.exe	90
PID 1600 wrote to memory of 4548	1600	msedge.exe	90
PID 1600 wrote to memory of 4548	1600	msedge.exe	90
PID 1600 wrote to memory of 4548	1600	msedge.exe	90
PID 1600 wrote to memory of 4548	1600	msedge.exe	90
PID 1600 wrote to memory of 4548	1600	msedge.exe	90
PID 1600 wrote to memory of 4548	1600	msedge.exe	90
PID 1600 wrote to memory of 4548	1600	msedge.exe	90
PID 1600 wrote to memory of 4548	1600	msedge.exe	90
PID 1600 wrote to memory of 4548	1600	msedge.exe	90
PID 1600 wrote to memory of 4548	1600	msedge.exe	90
PID 1600 wrote to memory of 4548	1600	msedge.exe	90
PID 1600 wrote to memory of 4548	1600	msedge.exe	90
PID 1600 wrote to memory of 4548	1600	msedge.exe	90
PID 1600 wrote to memory of 4548	1600	msedge.exe	90
PID 1600 wrote to memory of 4548	1600	msedge.exe	90
PID 1600 wrote to memory of 4548	1600	msedge.exe	90
PID 1600 wrote to memory of 4548	1600	msedge.exe	90
PID 1600 wrote to memory of 4548	1600	msedge.exe	90
PID 1600 wrote to memory of 4548	1600	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\libclone_plugin.dll.svn-base_id=8328c31dba7c71ee20ee32f1a735d639f9e43928.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa382846f8,0x7ffa38284708,0x7ffa38284718
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,3156622359576501965,3422942334150610231,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,3156622359576501965,3422942334150610231,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,3156622359576501965,3422942334150610231,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2604 /prefetch:8
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3156622359576501965,3422942334150610231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3156622359576501965,3422942334150610231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,3156622359576501965,3422942334150610231,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,3156622359576501965,3422942334150610231,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3156622359576501965,3422942334150610231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3156622359576501965,3422942334150610231,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3156622359576501965,3422942334150610231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3156622359576501965,3422942334150610231,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,3156622359576501965,3422942334150610231,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1596 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3236

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 39205cdf989e3a86822b3f473c5fc223d7290b98c2a3fb7f75e366fc8e3ecbe9
MD5 cff358b013d6f9f633bc1587f6f54ffa
SHA1 6cb7852e096be24695ff1bc213abde42d35bb376
SHA512 8831c223a1f0cf5f71fa851cdd82f4a9f03e5f267513e05b936756c116997f749ffa563623b4724de921d049de34a8f277cc539f58997cda4d178ea205be2259
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 38b634f3fedcf2a9dc3280aa76bd1ea93e192200b8a48904664fac5c9944636a
MD5 dc629a750e345390344524fe0ea7dcd7
SHA1 5f9f00a358caaef0321707c4f6f38d52bd7e0399
SHA512 2a941fe90b748d0326e011258fa9b494dc2f47ac047767455ed16a41d523f04370f818316503a5bad0ff5c5699e92a0aaf3952748b09287c5328354bfa6cc902
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 efacf998be379d0667f0a7bfa5faea265e91c520ad730d31c31ced846f78a09a
MD5 21ab6fd67330800dbc1b552aa25bf246
SHA1 6666f2130392ab699ed24ca9bad15892f7eaf014
SHA512 ed2b57b66efa98335b34f9e0af5f4908c511822070460c58131d7c08a842c35edc128ab06a511756936ee2474ddefb451e82aeeb9ac9f3b7ca0dd2097bdd9d18
SSDEEP 96:n6kKvxm/YQYmqM1prOwpvWMoiVmdeHmNnUWQyV+VDCziEwb:n6kKE9T7KGWMXQro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 e07fdfad2103b167b3024cdb8da1593a34d7097912cc51cb3681c3e0080e8155
MD5 acc89fdfbcfe575d9a526f0c27f1e9e3
SHA1 d335f57efaeb32f5182b9bbd4867bd570fc88ab4
SHA512 dee58445b11c85c7da889acd4b9ce5113e5b1b8c0aa22c09a488219b80f22455049e2feb4cb88e29c85b4d38dcb44e09f338d0df2bdb7c3ddcecd88d74ebc12c
SSDEEP 96:n6kKvxm/YnmqM1pbOwpvWMoiVmdeE9qmNnUWQyV+VD7AiEwb:n6kKEjT76GWMqqQrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 8a1ad67434b50e47fb13a4de5304a5096dcc1664178df29904149c4122aa71b8
MD5 911369b0c8344718ec2ccc63ffec4da5
SHA1 0fa956b88a309a89beeda286e6291e5f39888077
SHA512 d526247056984ad69531de68136b81df52aa707b549c21a339cc66a3a383e469391e9ed1452d7468c51c8f865822b0dff71238023a3075f84b3e328f14e1d230
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupSne2RUfqlTdP4M+olzO6z6:A9iIxuERzA83h09RZxYSPzpAKO4Ud5
MD5 SHA1 SHA512 SSDEEP

Submit Download