dc179562e99e92f9e338eaee0f4f0afc325f0f1cad991789969aa87a9bc99cbe

Analysis

max time kernel
158s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 10:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

liblinear_resampler_plugin.dll.svn-base?id=e3b43bd36fd50840467669364014ee53553872c1.html
Size

206KB
MD5

f9b9c699c4d5c3e5980a7729b9aab268
SHA1

73d991976d7ad826f77ad297a280bc420c3c2dde
SHA256

dc179562e99e92f9e338eaee0f4f0afc325f0f1cad991789969aa87a9bc99cbe
SHA512

1320b2a9a220e236d979857ab4a9f74061bbd01ca51466ac268bf86a27a7de133beac4e53d8db6d2db3e7597d6b8c768a97e79147db05297d3ef752fce86b490
SSDEEP

1536:wh/AfYvEBuZWaStpxSmttqkW5I1O3Ze4wOAVgui7h5/Vd/R+UAE8B:wh/AfYMBuIpRrhed4yfX/XoU4

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
768	msedge.exe
768	msedge.exe
2924	msedge.exe
2924	msedge.exe
1660	identity_helper.exe
1660	identity_helper.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 1180	2924	msedge.exe	85
PID 2924 wrote to memory of 1180	2924	msedge.exe	85
PID 2924 wrote to memory of 4460	2924	msedge.exe	86
PID 2924 wrote to memory of 4460	2924	msedge.exe	86
PID 2924 wrote to memory of 4460	2924	msedge.exe	86
PID 2924 wrote to memory of 4460	2924	msedge.exe	86
PID 2924 wrote to memory of 4460	2924	msedge.exe	86
PID 2924 wrote to memory of 4460	2924	msedge.exe	86
PID 2924 wrote to memory of 4460	2924	msedge.exe	86
PID 2924 wrote to memory of 4460	2924	msedge.exe	86
PID 2924 wrote to memory of 4460	2924	msedge.exe	86
PID 2924 wrote to memory of 4460	2924	msedge.exe	86
PID 2924 wrote to memory of 4460	2924	msedge.exe	86
PID 2924 wrote to memory of 4460	2924	msedge.exe	86
PID 2924 wrote to memory of 4460	2924	msedge.exe	86
PID 2924 wrote to memory of 4460	2924	msedge.exe	86
PID 2924 wrote to memory of 4460	2924	msedge.exe	86
PID 2924 wrote to memory of 4460	2924	msedge.exe	86
PID 2924 wrote to memory of 4460	2924	msedge.exe	86
PID 2924 wrote to memory of 4460	2924	msedge.exe	86
PID 2924 wrote to memory of 4460	2924	msedge.exe	86
PID 2924 wrote to memory of 4460	2924	msedge.exe	86
PID 2924 wrote to memory of 4460	2924	msedge.exe	86
PID 2924 wrote to memory of 4460	2924	msedge.exe	86
PID 2924 wrote to memory of 4460	2924	msedge.exe	86
PID 2924 wrote to memory of 4460	2924	msedge.exe	86
PID 2924 wrote to memory of 4460	2924	msedge.exe	86
PID 2924 wrote to memory of 4460	2924	msedge.exe	86
PID 2924 wrote to memory of 4460	2924	msedge.exe	86
PID 2924 wrote to memory of 4460	2924	msedge.exe	86
PID 2924 wrote to memory of 4460	2924	msedge.exe	86
PID 2924 wrote to memory of 4460	2924	msedge.exe	86
PID 2924 wrote to memory of 4460	2924	msedge.exe	86
PID 2924 wrote to memory of 4460	2924	msedge.exe	86
PID 2924 wrote to memory of 4460	2924	msedge.exe	86
PID 2924 wrote to memory of 4460	2924	msedge.exe	86
PID 2924 wrote to memory of 4460	2924	msedge.exe	86
PID 2924 wrote to memory of 4460	2924	msedge.exe	86
PID 2924 wrote to memory of 4460	2924	msedge.exe	86
PID 2924 wrote to memory of 4460	2924	msedge.exe	86
PID 2924 wrote to memory of 4460	2924	msedge.exe	86
PID 2924 wrote to memory of 4460	2924	msedge.exe	86
PID 2924 wrote to memory of 768	2924	msedge.exe	87
PID 2924 wrote to memory of 768	2924	msedge.exe	87
PID 2924 wrote to memory of 4760	2924	msedge.exe	88
PID 2924 wrote to memory of 4760	2924	msedge.exe	88
PID 2924 wrote to memory of 4760	2924	msedge.exe	88
PID 2924 wrote to memory of 4760	2924	msedge.exe	88
PID 2924 wrote to memory of 4760	2924	msedge.exe	88
PID 2924 wrote to memory of 4760	2924	msedge.exe	88
PID 2924 wrote to memory of 4760	2924	msedge.exe	88
PID 2924 wrote to memory of 4760	2924	msedge.exe	88
PID 2924 wrote to memory of 4760	2924	msedge.exe	88
PID 2924 wrote to memory of 4760	2924	msedge.exe	88
PID 2924 wrote to memory of 4760	2924	msedge.exe	88
PID 2924 wrote to memory of 4760	2924	msedge.exe	88
PID 2924 wrote to memory of 4760	2924	msedge.exe	88
PID 2924 wrote to memory of 4760	2924	msedge.exe	88
PID 2924 wrote to memory of 4760	2924	msedge.exe	88
PID 2924 wrote to memory of 4760	2924	msedge.exe	88
PID 2924 wrote to memory of 4760	2924	msedge.exe	88
PID 2924 wrote to memory of 4760	2924	msedge.exe	88
PID 2924 wrote to memory of 4760	2924	msedge.exe	88
PID 2924 wrote to memory of 4760	2924	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\liblinear_resampler_plugin.dll.svn-base_id=e3b43bd36fd50840467669364014ee53553872c1.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe717a46f8,0x7ffe717a4708,0x7ffe717a4718
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,1165301690900801552,17149287601768532530,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,1165301690900801552,17149287601768532530,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,1165301690900801552,17149287601768532530,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1165301690900801552,17149287601768532530,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1165301690900801552,17149287601768532530,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1165301690900801552,17149287601768532530,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1165301690900801552,17149287601768532530,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,1165301690900801552,17149287601768532530,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3464 /prefetch:8
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,1165301690900801552,17149287601768532530,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3464 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1165301690900801552,17149287601768532530,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1165301690900801552,17149287601768532530,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,1165301690900801552,17149287601768532530,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5000 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:380

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8c91c8582b0c918416d14bd7eedd686e

SHA1
b2ff8149bc21144fdcec64111afda492965c6621

SHA256
1e839706b748c04adf8efa2790564ca1efd707fdf6451e71af6862e07123717e

SHA512
a93be868d9f08097bff39069378a0bfa0f5c78e74e9e8df820be9b0426cbfe84e03e9638b329b6142279ed140a120c4c4c21857f410fc4789a370445c3919dcf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2579d07b98bbefadc929d80fb3dbd32a

SHA1
1ceb57c4b81f0f23500e118a4b9a225116a467de

SHA256
b8443c289ad36568a2bf794ac9ec1f259a9dd930c36680dafc8d0cb4de81feb6

SHA512
53522ad5e8e2a272d5b1bff9b9226b7d976d47413891c60d7efebd4365baff12b6891e3f79b20e14892ec7c654ad2d437941014290c428c6b1bd78a7b3e557de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ec33193b9d05416114ce83736fd795e2

SHA1
8b9904c263acd405927e116263d2088dda9938ef

SHA256
c2332a75d0c7643029cbba39306efc35bc8009890c7f87bffb8678f8d294625e

SHA512
7511628091322b4aecad0d437a97e51cc84d82f04b1d8d08ebd805ce3c408e21e30fccd710aef3f7583be0b5bd1001bc67d785e60a409b1aa1ac2ba27089361e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
641572e978288a307c3e0d27e0bff73f

SHA1
665a9a84a56b8d67bc05db4e8aad9f984798aaa2

SHA256
aaeacf2e781d39d1441e6409882a8f7fe1e7d3dbd7abc5cd766ed40f24addfff

SHA512
11bad90c008b061edd9df1e35c70dcf1e0a423746dd5242c670576cf264b9bc5498b63e934b529524920858351613a58a3b7137fb3e076fe2b7788445d8c7148

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8e7aedad8447be229b34ddf5fa493fb9

SHA1
7d912cf2859dd787341248bd7315e7b8045dcec2

SHA256
7f6b027a3215be22573c6e166732ccb96704b7d7cbe074ba0aa3ca317e010df6

SHA512
2470af91d09e258b848212e65f31cf1ff558f20232b7112d804a15197209872a43b1943be99f2ca72b397d1ce52691c38e8a0b36796815e5bb3156c940175c10

Download Submit