Analysis
-
max time kernel
154s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19-04-2024 10:19
Static task
static1
Behavioral task
behavioral1
Sample
libgrey_yuv_plugin.dll?id=8328c31dba7c71ee20ee32f1a735d639f9e43928.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
libgrey_yuv_plugin.dll?id=8328c31dba7c71ee20ee32f1a735d639f9e43928.html
Resource
win10v2004-20240412-en
General
-
Target
libgrey_yuv_plugin.dll?id=8328c31dba7c71ee20ee32f1a735d639f9e43928.html
-
Size
199KB
-
MD5
c9a9908f69ad06e0f57fd24d368c7e53
-
SHA1
4c28112a1f2d9fac4c72785e37b385e7311c768a
-
SHA256
0e5346d008d85b557cc4431e4544af2d10631729d60fa14f5f00f4d98f902da1
-
SHA512
a8f058aaf05f0b44c12d46ecf681b2db0db85a09e1488adb7e39f6fe9aa90e7999f6b3d407ff85ed4c39ce988a37ad84a6ab3d5cd6814ebdb631dc0e97cf72d4
-
SSDEEP
1536:Eh/B4y+2sFgLmSF3JOksuMm29VpzJlIW3HOe8LLN2DgkPE8B:Eh/BDsFP9B5BfT+1LUskF
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2740 msedge.exe 2740 msedge.exe 2276 msedge.exe 2276 msedge.exe 3936 identity_helper.exe 3936 identity_helper.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2276 wrote to memory of 3104 2276 msedge.exe 83 PID 2276 wrote to memory of 3104 2276 msedge.exe 83 PID 2276 wrote to memory of 4004 2276 msedge.exe 84 PID 2276 wrote to memory of 4004 2276 msedge.exe 84 PID 2276 wrote to memory of 4004 2276 msedge.exe 84 PID 2276 wrote to memory of 4004 2276 msedge.exe 84 PID 2276 wrote to memory of 4004 2276 msedge.exe 84 PID 2276 wrote to memory of 4004 2276 msedge.exe 84 PID 2276 wrote to memory of 4004 2276 msedge.exe 84 PID 2276 wrote to memory of 4004 2276 msedge.exe 84 PID 2276 wrote to memory of 4004 2276 msedge.exe 84 PID 2276 wrote to memory of 4004 2276 msedge.exe 84 PID 2276 wrote to memory of 4004 2276 msedge.exe 84 PID 2276 wrote to memory of 4004 2276 msedge.exe 84 PID 2276 wrote to memory of 4004 2276 msedge.exe 84 PID 2276 wrote to memory of 4004 2276 msedge.exe 84 PID 2276 wrote to memory of 4004 2276 msedge.exe 84 PID 2276 wrote to memory of 4004 2276 msedge.exe 84 PID 2276 wrote to memory of 4004 2276 msedge.exe 84 PID 2276 wrote to memory of 4004 2276 msedge.exe 84 PID 2276 wrote to memory of 4004 2276 msedge.exe 84 PID 2276 wrote to memory of 4004 2276 msedge.exe 84 PID 2276 wrote to memory of 4004 2276 msedge.exe 84 PID 2276 wrote to memory of 4004 2276 msedge.exe 84 PID 2276 wrote to memory of 4004 2276 msedge.exe 84 PID 2276 wrote to memory of 4004 2276 msedge.exe 84 PID 2276 wrote to memory of 4004 2276 msedge.exe 84 PID 2276 wrote to memory of 4004 2276 msedge.exe 84 PID 2276 wrote to memory of 4004 2276 msedge.exe 84 PID 2276 wrote to memory of 4004 2276 msedge.exe 84 PID 2276 wrote to memory of 4004 2276 msedge.exe 84 PID 2276 wrote to memory of 4004 2276 msedge.exe 84 PID 2276 wrote to memory of 4004 2276 msedge.exe 84 PID 2276 wrote to memory of 4004 2276 msedge.exe 84 PID 2276 wrote to memory of 4004 2276 msedge.exe 84 PID 2276 wrote to memory of 4004 2276 msedge.exe 84 PID 2276 wrote to memory of 4004 2276 msedge.exe 84 PID 2276 wrote to memory of 4004 2276 msedge.exe 84 PID 2276 wrote to memory of 4004 2276 msedge.exe 84 PID 2276 wrote to memory of 4004 2276 msedge.exe 84 PID 2276 wrote to memory of 4004 2276 msedge.exe 84 PID 2276 wrote to memory of 4004 2276 msedge.exe 84 PID 2276 wrote to memory of 2740 2276 msedge.exe 85 PID 2276 wrote to memory of 2740 2276 msedge.exe 85 PID 2276 wrote to memory of 3752 2276 msedge.exe 86 PID 2276 wrote to memory of 3752 2276 msedge.exe 86 PID 2276 wrote to memory of 3752 2276 msedge.exe 86 PID 2276 wrote to memory of 3752 2276 msedge.exe 86 PID 2276 wrote to memory of 3752 2276 msedge.exe 86 PID 2276 wrote to memory of 3752 2276 msedge.exe 86 PID 2276 wrote to memory of 3752 2276 msedge.exe 86 PID 2276 wrote to memory of 3752 2276 msedge.exe 86 PID 2276 wrote to memory of 3752 2276 msedge.exe 86 PID 2276 wrote to memory of 3752 2276 msedge.exe 86 PID 2276 wrote to memory of 3752 2276 msedge.exe 86 PID 2276 wrote to memory of 3752 2276 msedge.exe 86 PID 2276 wrote to memory of 3752 2276 msedge.exe 86 PID 2276 wrote to memory of 3752 2276 msedge.exe 86 PID 2276 wrote to memory of 3752 2276 msedge.exe 86 PID 2276 wrote to memory of 3752 2276 msedge.exe 86 PID 2276 wrote to memory of 3752 2276 msedge.exe 86 PID 2276 wrote to memory of 3752 2276 msedge.exe 86 PID 2276 wrote to memory of 3752 2276 msedge.exe 86 PID 2276 wrote to memory of 3752 2276 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\libgrey_yuv_plugin.dll_id=8328c31dba7c71ee20ee32f1a735d639f9e43928.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd551e46f8,0x7ffd551e4708,0x7ffd551e47182⤵PID:3104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,854586059625688045,17717809903773046843,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:22⤵PID:4004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,854586059625688045,17717809903773046843,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,854586059625688045,17717809903773046843,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:82⤵PID:3752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,854586059625688045,17717809903773046843,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:12⤵PID:4980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,854586059625688045,17717809903773046843,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:3116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,854586059625688045,17717809903773046843,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:12⤵PID:2044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,854586059625688045,17717809903773046843,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:12⤵PID:3892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,854586059625688045,17717809903773046843,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 /prefetch:82⤵PID:4092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,854586059625688045,17717809903773046843,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,854586059625688045,17717809903773046843,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:12⤵PID:4864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,854586059625688045,17717809903773046843,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:12⤵PID:4876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,854586059625688045,17717809903773046843,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4836 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2704
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5056
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5032
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD58c91c8582b0c918416d14bd7eedd686e
SHA1b2ff8149bc21144fdcec64111afda492965c6621
SHA2561e839706b748c04adf8efa2790564ca1efd707fdf6451e71af6862e07123717e
SHA512a93be868d9f08097bff39069378a0bfa0f5c78e74e9e8df820be9b0426cbfe84e03e9638b329b6142279ed140a120c4c4c21857f410fc4789a370445c3919dcf
-
Filesize
152B
MD52579d07b98bbefadc929d80fb3dbd32a
SHA11ceb57c4b81f0f23500e118a4b9a225116a467de
SHA256b8443c289ad36568a2bf794ac9ec1f259a9dd930c36680dafc8d0cb4de81feb6
SHA51253522ad5e8e2a272d5b1bff9b9226b7d976d47413891c60d7efebd4365baff12b6891e3f79b20e14892ec7c654ad2d437941014290c428c6b1bd78a7b3e557de
-
Filesize
6KB
MD534ac9d9598ec022ff3a8432ab97b7add
SHA1b74b8b1ff32aac213984c4cc4d213b56046b15d6
SHA25647c4906566c6abce60de8fcafb81094e290a33376d99c24f7c7205e062659cc9
SHA512b9b29852a6542a3ae91439ef88fa8e133637b462fc09182159e0e73a0617e9ad038a175a1d3d84e8380b8dffcaece893d07dbf344ea467bb09405064e23a2b9b
-
Filesize
6KB
MD5331e343e471a56551678b9ac35aa1043
SHA129ce0b6c6dd7ac392fb458fe522b071cd39326a1
SHA2565c606b3000d683fc55708a7783818096ae08ccef887ca3fc5500695057cacea3
SHA51254ce778b5e050b4e4259899e0defd8bd35890e303dd15291e255b5fcdc77fc3c3293a899de9c1d04623b402dac719501e305722b39bc7b742b1253f2f762bc9a
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD558d1f6788e2edcbe44167c9057150b85
SHA102db0e44c231a104cbcb654f0e9a399ada5b79a1
SHA2567809467da99ed3705550528fe8c76177715872287b1054437ab3d8ac7c13d033
SHA5123ddb00997c7bddb6c1f3691b3ae899972b79b94a44b04ccfe8a0795e6b7c4ed52f6fbec9242b12c4c62c8bab1a269ac2bb9bfe2fd0cacebbc60014123125a4ac