8d1779feab453155606992d42a6315f6dd9d8e5f586d2d2bc6c6ec859ae1edba

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 11:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

libyuv_plugin.dll.svn-base?id=8328c31dba7c71ee20ee32f1a735d639f9e43928.html
Size

206KB
MD5

c53173ccb3bf5c9b605bf8362b76f1fd
SHA1

7e41b9efea1fa3d1f9e1b2982dcc49a9d935dd3e
SHA256

8d1779feab453155606992d42a6315f6dd9d8e5f586d2d2bc6c6ec859ae1edba
SHA512

ed35e14078b17ac5d57c7d2617511772816f66e8daa19542f6ae5945b63327b9dcd24ab4f2daf0598e8d95a30fb6f3414ec719b60338610b1784ead7fbfc2fa4
SSDEEP

1536:eh/FHvYQ4ECaYd4m2+PksEwjypms+ZHMSL0um0Qive9H3UVE8B:eh/FvXj6MtYJRAw3vjD

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5096	msedge.exe
5096	msedge.exe
2452	msedge.exe
2452	msedge.exe
3300	identity_helper.exe
3300	identity_helper.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 4372	2452	msedge.exe	86
PID 2452 wrote to memory of 4372	2452	msedge.exe	86
PID 2452 wrote to memory of 5080	2452	msedge.exe	87
PID 2452 wrote to memory of 5080	2452	msedge.exe	87
PID 2452 wrote to memory of 5080	2452	msedge.exe	87
PID 2452 wrote to memory of 5080	2452	msedge.exe	87
PID 2452 wrote to memory of 5080	2452	msedge.exe	87
PID 2452 wrote to memory of 5080	2452	msedge.exe	87
PID 2452 wrote to memory of 5080	2452	msedge.exe	87
PID 2452 wrote to memory of 5080	2452	msedge.exe	87
PID 2452 wrote to memory of 5080	2452	msedge.exe	87
PID 2452 wrote to memory of 5080	2452	msedge.exe	87
PID 2452 wrote to memory of 5080	2452	msedge.exe	87
PID 2452 wrote to memory of 5080	2452	msedge.exe	87
PID 2452 wrote to memory of 5080	2452	msedge.exe	87
PID 2452 wrote to memory of 5080	2452	msedge.exe	87
PID 2452 wrote to memory of 5080	2452	msedge.exe	87
PID 2452 wrote to memory of 5080	2452	msedge.exe	87
PID 2452 wrote to memory of 5080	2452	msedge.exe	87
PID 2452 wrote to memory of 5080	2452	msedge.exe	87
PID 2452 wrote to memory of 5080	2452	msedge.exe	87
PID 2452 wrote to memory of 5080	2452	msedge.exe	87
PID 2452 wrote to memory of 5080	2452	msedge.exe	87
PID 2452 wrote to memory of 5080	2452	msedge.exe	87
PID 2452 wrote to memory of 5080	2452	msedge.exe	87
PID 2452 wrote to memory of 5080	2452	msedge.exe	87
PID 2452 wrote to memory of 5080	2452	msedge.exe	87
PID 2452 wrote to memory of 5080	2452	msedge.exe	87
PID 2452 wrote to memory of 5080	2452	msedge.exe	87
PID 2452 wrote to memory of 5080	2452	msedge.exe	87
PID 2452 wrote to memory of 5080	2452	msedge.exe	87
PID 2452 wrote to memory of 5080	2452	msedge.exe	87
PID 2452 wrote to memory of 5080	2452	msedge.exe	87
PID 2452 wrote to memory of 5080	2452	msedge.exe	87
PID 2452 wrote to memory of 5080	2452	msedge.exe	87
PID 2452 wrote to memory of 5080	2452	msedge.exe	87
PID 2452 wrote to memory of 5080	2452	msedge.exe	87
PID 2452 wrote to memory of 5080	2452	msedge.exe	87
PID 2452 wrote to memory of 5080	2452	msedge.exe	87
PID 2452 wrote to memory of 5080	2452	msedge.exe	87
PID 2452 wrote to memory of 5080	2452	msedge.exe	87
PID 2452 wrote to memory of 5080	2452	msedge.exe	87
PID 2452 wrote to memory of 5096	2452	msedge.exe	88
PID 2452 wrote to memory of 5096	2452	msedge.exe	88
PID 2452 wrote to memory of 5092	2452	msedge.exe	89
PID 2452 wrote to memory of 5092	2452	msedge.exe	89
PID 2452 wrote to memory of 5092	2452	msedge.exe	89
PID 2452 wrote to memory of 5092	2452	msedge.exe	89
PID 2452 wrote to memory of 5092	2452	msedge.exe	89
PID 2452 wrote to memory of 5092	2452	msedge.exe	89
PID 2452 wrote to memory of 5092	2452	msedge.exe	89
PID 2452 wrote to memory of 5092	2452	msedge.exe	89
PID 2452 wrote to memory of 5092	2452	msedge.exe	89
PID 2452 wrote to memory of 5092	2452	msedge.exe	89
PID 2452 wrote to memory of 5092	2452	msedge.exe	89
PID 2452 wrote to memory of 5092	2452	msedge.exe	89
PID 2452 wrote to memory of 5092	2452	msedge.exe	89
PID 2452 wrote to memory of 5092	2452	msedge.exe	89
PID 2452 wrote to memory of 5092	2452	msedge.exe	89
PID 2452 wrote to memory of 5092	2452	msedge.exe	89
PID 2452 wrote to memory of 5092	2452	msedge.exe	89
PID 2452 wrote to memory of 5092	2452	msedge.exe	89
PID 2452 wrote to memory of 5092	2452	msedge.exe	89
PID 2452 wrote to memory of 5092	2452	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\libyuv_plugin.dll.svn-base_id=8328c31dba7c71ee20ee32f1a735d639f9e43928.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe1b2546f8,0x7ffe1b254708,0x7ffe1b254718
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,14759735935881976037,3478310522375215640,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,14759735935881976037,3478310522375215640,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,14759735935881976037,3478310522375215640,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,14759735935881976037,3478310522375215640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,14759735935881976037,3478310522375215640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,14759735935881976037,3478310522375215640,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3044 /prefetch:8
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,14759735935881976037,3478310522375215640,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3044 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,14759735935881976037,3478310522375215640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,14759735935881976037,3478310522375215640,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,14759735935881976037,3478310522375215640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,14759735935881976037,3478310522375215640,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,14759735935881976037,3478310522375215640,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2292 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2904

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
846ce533b9e20979bf1857f1afb61925

SHA1
4c6726618d10805940dba5e6cf849448b552bf68

SHA256
b81574d678f49d36d874dc062a1291092ab94164b92f7e30d42d9c61cc0e77c3

SHA512
8fb228fae89f063159dabc93871db205d836bdb4ec8f54a2f642bd0b1ac531eea0c21234a8ca75a0ae9a008d2399a9bf20a481f5d6a6eab53a533cd03aeaaa2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
104aab1e178489256a1425b28119ec93

SHA1
0bcf8ad28df672c618cb832ba8de8f85bd858a6c

SHA256
b92c19f079ef5948cb58654ce76f582a480a82cddc5083764ed7f1eac27b8d01

SHA512
b4f930f87eb86497672f32eb7cc77548d8afb09ad9fdba0508f368d5710e3a75c44b1fd9f96c98c2f0bd08deb4afde28330b11cf23e456c92cc509d28677d2cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
756779bbdebc060cce3a2062f3b77e4f

SHA1
176476c460d05da72c1af7b09b6d02b2d5b2ff92

SHA256
5a6161cd47ad4193a89416901c0ee1bc7962e54a84fdb751d859c97eb6e3d459

SHA512
024a44533270919cc83b4ccad29ce02822d72892a3d63fb7d9355df5bf370a93638198f78d7eac088635e5fd15f3c077db6bd2b5c5f17122735ce975317b0e25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e8a5bafca74b9eaa0dccbbaaf98a0f9b

SHA1
76bf61d4ece25bbeab68e83e6183256d9340e191

SHA256
0f5e153d5eb485cecf98b0bae3b009d3dca1b84910148a36a6739978d2b0282e

SHA512
c3525aeb8a34c789d743f36c8cbc076ca9acd3e1aae9d2af3b9281a95f640a015bb31cea3223fee597a78d4b07642ac382f70f06dbf7e03f32b4757d36f8d08d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6eb4dfaf8b489986f53be40a1109359c

SHA1
f3ed53be72f122a681be6fda05753d0cebaa7cd8

SHA256
ff6ed788caa8e1b06961c5b088ebca737d7a92f874b7690574c846b3ba8394a9

SHA512
36b30707de6f52830aa2c6653076a58bc1a9ed530a4b6b3a6d2b2a0bc2465ce2021f24ef5eb74c088bfba2749fca9b1282d5677287efa25c95186e1af1e25252

Download Submit