8d98352d5a22cbca47fbbc47308dfb182feff6776c335391e2d40103945d16cd

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 10:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
libfloat32_mixer_plugin.dll.svn-base?id=e3b43bd36fd50840467669364014ee53553872c1.html
Size 193KB
Sample240419-ma6dyafe22
SHA256 8d98352d5a22cbca47fbbc47308dfb182feff6776c335391e2d40103945d16cd
MD5 a1793266acf336d428ac866ea16c6103
SHA1 9a3f68ca704edca56f732cf9a73d7f58c94ac365
SHA512 166805e25df2026f5628275740914e715428655d3a29fedb790c310f5f39ed5d4e34b29d8d38cfa455567e9b5f2a9239fdbe4220184aaad46e13ae43083dddf4
SSDEEP 1536:8h/APYm9IHkHk5Ap2FDiEumDvtzl3IH+a4aBE8JNLr99IE8B:8h/APY4Ik8nJ5RSu+Es399w
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1812	msedge.exe
1812	msedge.exe
4388	msedge.exe
4388	msedge.exe
4448	identity_helper.exe
4448	identity_helper.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 4424	4388	msedge.exe	84
PID 4388 wrote to memory of 4424	4388	msedge.exe	84
PID 4388 wrote to memory of 3728	4388	msedge.exe	85
PID 4388 wrote to memory of 3728	4388	msedge.exe	85
PID 4388 wrote to memory of 3728	4388	msedge.exe	85
PID 4388 wrote to memory of 3728	4388	msedge.exe	85
PID 4388 wrote to memory of 3728	4388	msedge.exe	85
PID 4388 wrote to memory of 3728	4388	msedge.exe	85
PID 4388 wrote to memory of 3728	4388	msedge.exe	85
PID 4388 wrote to memory of 3728	4388	msedge.exe	85
PID 4388 wrote to memory of 3728	4388	msedge.exe	85
PID 4388 wrote to memory of 3728	4388	msedge.exe	85
PID 4388 wrote to memory of 3728	4388	msedge.exe	85
PID 4388 wrote to memory of 3728	4388	msedge.exe	85
PID 4388 wrote to memory of 3728	4388	msedge.exe	85
PID 4388 wrote to memory of 3728	4388	msedge.exe	85
PID 4388 wrote to memory of 3728	4388	msedge.exe	85
PID 4388 wrote to memory of 3728	4388	msedge.exe	85
PID 4388 wrote to memory of 3728	4388	msedge.exe	85
PID 4388 wrote to memory of 3728	4388	msedge.exe	85
PID 4388 wrote to memory of 3728	4388	msedge.exe	85
PID 4388 wrote to memory of 3728	4388	msedge.exe	85
PID 4388 wrote to memory of 3728	4388	msedge.exe	85
PID 4388 wrote to memory of 3728	4388	msedge.exe	85
PID 4388 wrote to memory of 3728	4388	msedge.exe	85
PID 4388 wrote to memory of 3728	4388	msedge.exe	85
PID 4388 wrote to memory of 3728	4388	msedge.exe	85
PID 4388 wrote to memory of 3728	4388	msedge.exe	85
PID 4388 wrote to memory of 3728	4388	msedge.exe	85
PID 4388 wrote to memory of 3728	4388	msedge.exe	85
PID 4388 wrote to memory of 3728	4388	msedge.exe	85
PID 4388 wrote to memory of 3728	4388	msedge.exe	85
PID 4388 wrote to memory of 3728	4388	msedge.exe	85
PID 4388 wrote to memory of 3728	4388	msedge.exe	85
PID 4388 wrote to memory of 3728	4388	msedge.exe	85
PID 4388 wrote to memory of 3728	4388	msedge.exe	85
PID 4388 wrote to memory of 3728	4388	msedge.exe	85
PID 4388 wrote to memory of 3728	4388	msedge.exe	85
PID 4388 wrote to memory of 3728	4388	msedge.exe	85
PID 4388 wrote to memory of 3728	4388	msedge.exe	85
PID 4388 wrote to memory of 3728	4388	msedge.exe	85
PID 4388 wrote to memory of 3728	4388	msedge.exe	85
PID 4388 wrote to memory of 1812	4388	msedge.exe	86
PID 4388 wrote to memory of 1812	4388	msedge.exe	86
PID 4388 wrote to memory of 3396	4388	msedge.exe	87
PID 4388 wrote to memory of 3396	4388	msedge.exe	87
PID 4388 wrote to memory of 3396	4388	msedge.exe	87
PID 4388 wrote to memory of 3396	4388	msedge.exe	87
PID 4388 wrote to memory of 3396	4388	msedge.exe	87
PID 4388 wrote to memory of 3396	4388	msedge.exe	87
PID 4388 wrote to memory of 3396	4388	msedge.exe	87
PID 4388 wrote to memory of 3396	4388	msedge.exe	87
PID 4388 wrote to memory of 3396	4388	msedge.exe	87
PID 4388 wrote to memory of 3396	4388	msedge.exe	87
PID 4388 wrote to memory of 3396	4388	msedge.exe	87
PID 4388 wrote to memory of 3396	4388	msedge.exe	87
PID 4388 wrote to memory of 3396	4388	msedge.exe	87
PID 4388 wrote to memory of 3396	4388	msedge.exe	87
PID 4388 wrote to memory of 3396	4388	msedge.exe	87
PID 4388 wrote to memory of 3396	4388	msedge.exe	87
PID 4388 wrote to memory of 3396	4388	msedge.exe	87
PID 4388 wrote to memory of 3396	4388	msedge.exe	87
PID 4388 wrote to memory of 3396	4388	msedge.exe	87
PID 4388 wrote to memory of 3396	4388	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\libfloat32_mixer_plugin.dll.svn-base_id=e3b43bd36fd50840467669364014ee53553872c1.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb3e7446f8,0x7ffb3e744708,0x7ffb3e744718
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,2578568574036305628,11067519365886277210,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,2578568574036305628,11067519365886277210,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,2578568574036305628,11067519365886277210,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2578568574036305628,11067519365886277210,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2578568574036305628,11067519365886277210,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2578568574036305628,11067519365886277210,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2578568574036305628,11067519365886277210,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,2578568574036305628,11067519365886277210,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,2578568574036305628,11067519365886277210,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2578568574036305628,11067519365886277210,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2578568574036305628,11067519365886277210,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,2578568574036305628,11067519365886277210,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1e839706b748c04adf8efa2790564ca1efd707fdf6451e71af6862e07123717e
MD5 8c91c8582b0c918416d14bd7eedd686e
SHA1 b2ff8149bc21144fdcec64111afda492965c6621
SHA512 a93be868d9f08097bff39069378a0bfa0f5c78e74e9e8df820be9b0426cbfe84e03e9638b329b6142279ed140a120c4c4c21857f410fc4789a370445c3919dcf
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b8443c289ad36568a2bf794ac9ec1f259a9dd930c36680dafc8d0cb4de81feb6
MD5 2579d07b98bbefadc929d80fb3dbd32a
SHA1 1ceb57c4b81f0f23500e118a4b9a225116a467de
SHA512 53522ad5e8e2a272d5b1bff9b9226b7d976d47413891c60d7efebd4365baff12b6891e3f79b20e14892ec7c654ad2d437941014290c428c6b1bd78a7b3e557de
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 67c1c5fa5a6d9b46336cf830e301712624f4e17d72e49fcd1144cf26878e54ee
MD5 c76bc08caad50bfb69735b1b3bb74ffc
SHA1 98734435edd8f7c05e77595b0b30bab5f9cd0055
SHA512 3868ac071726866a573bc90a7f889737ffcee72b4fea0a115f984cadc1bb9c663229a88f8c70e4ebd1e29f3fcb32a348f54572f65a6381ee9ca76233046713e5
SSDEEP 96:n8ksvxm/Ynmqr19ntwpvWMoiVmdeEpq7VFUWQyV+VD7AiEwb:n8ksEjoDntGWMuqTrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 361896bacc2c129d019ec31be47ec8f103fa3f4ccec7423066f3ceaea40f5d2d
MD5 ddced901ce9ab6042f286900ce0c77f8
SHA1 94a14fd3fb029e8b3594f2d972204e64406c4a7b
SHA512 b1c9bf520f1938d63816584f1a02c658b431a6cfe54371861da96b1616b90312e3ba8ca53f5fbe4bf0934d9266e1ec188168ae218f7a7992f7df032b542ea5fe
SSDEEP 96:n8ksvxm/YQYmqr19ftwpvWMoiVmdeH7VFUWQyV+VDCziEwb:n8ksE9oDftGWMXTro
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 41125961c8a39983375fc1a8805e433daa5568ea09b348556c6f159f25d6dd28
MD5 bedd39903acc09a0b2170103fc66393e
SHA1 fbd91d8209be09b9cf7aa7a036cc00690c3404f7
SHA512 69576386ebb68c16132e392644ae8de86a7a3a2306a9cccb3aeb3ea6ece692e4a73b294b383ef5ccbb1a4e23537243fb1a6e35335fcaf922cfa87253efe6bd4d
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupaLze2RUB+uCkdP4M+olzOU:A9iIxuERzA83h09RZxYAB9MAKO4UUn
MD5 SHA1 SHA512 SSDEEP

Submit Download