87a2f589b19a92a1726e3f77e1ec3424307158b4c52d853bb3ec23cd899a86a8

Analysis

max time kernel
152s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 10:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

libstream_filter_record_plugin.dll.svn-base?id=8328c31dba7c71ee20ee32f1a735d639f9e43928.html
Size

7KB
MD5

fef0bad98e3f2f1d2f3276162b230cda
SHA1

c185c32c6dade5d606eabda24a8da40385e4728a
SHA256

87a2f589b19a92a1726e3f77e1ec3424307158b4c52d853bb3ec23cd899a86a8
SHA512

94be26393717043ba924d245bbcf048889ccc6ed6631f7411e792460799c4e4c57aae9c2a44f07819c6f3447b42ae36948687428d21c612775a60444f9d30d89
SSDEEP

192:ZUvvTPMcMHyPvvavvtvviKvvavvCfvvMXRvvTvv5B/lo38vvMvvDvvngvvzvvYP3:ZoPMcMHyP9Xl/cE8uI

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3248	msedge.exe
3248	msedge.exe
2204	msedge.exe
2204	msedge.exe
1408	identity_helper.exe
1408	identity_helper.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 1652	2204	msedge.exe	85
PID 2204 wrote to memory of 1652	2204	msedge.exe	85
PID 2204 wrote to memory of 1828	2204	msedge.exe	88
PID 2204 wrote to memory of 1828	2204	msedge.exe	88
PID 2204 wrote to memory of 1828	2204	msedge.exe	88
PID 2204 wrote to memory of 1828	2204	msedge.exe	88
PID 2204 wrote to memory of 1828	2204	msedge.exe	88
PID 2204 wrote to memory of 1828	2204	msedge.exe	88
PID 2204 wrote to memory of 1828	2204	msedge.exe	88
PID 2204 wrote to memory of 1828	2204	msedge.exe	88
PID 2204 wrote to memory of 1828	2204	msedge.exe	88
PID 2204 wrote to memory of 1828	2204	msedge.exe	88
PID 2204 wrote to memory of 1828	2204	msedge.exe	88
PID 2204 wrote to memory of 1828	2204	msedge.exe	88
PID 2204 wrote to memory of 1828	2204	msedge.exe	88
PID 2204 wrote to memory of 1828	2204	msedge.exe	88
PID 2204 wrote to memory of 1828	2204	msedge.exe	88
PID 2204 wrote to memory of 1828	2204	msedge.exe	88
PID 2204 wrote to memory of 1828	2204	msedge.exe	88
PID 2204 wrote to memory of 1828	2204	msedge.exe	88
PID 2204 wrote to memory of 1828	2204	msedge.exe	88
PID 2204 wrote to memory of 1828	2204	msedge.exe	88
PID 2204 wrote to memory of 1828	2204	msedge.exe	88
PID 2204 wrote to memory of 1828	2204	msedge.exe	88
PID 2204 wrote to memory of 1828	2204	msedge.exe	88
PID 2204 wrote to memory of 1828	2204	msedge.exe	88
PID 2204 wrote to memory of 1828	2204	msedge.exe	88
PID 2204 wrote to memory of 1828	2204	msedge.exe	88
PID 2204 wrote to memory of 1828	2204	msedge.exe	88
PID 2204 wrote to memory of 1828	2204	msedge.exe	88
PID 2204 wrote to memory of 1828	2204	msedge.exe	88
PID 2204 wrote to memory of 1828	2204	msedge.exe	88
PID 2204 wrote to memory of 1828	2204	msedge.exe	88
PID 2204 wrote to memory of 1828	2204	msedge.exe	88
PID 2204 wrote to memory of 1828	2204	msedge.exe	88
PID 2204 wrote to memory of 1828	2204	msedge.exe	88
PID 2204 wrote to memory of 1828	2204	msedge.exe	88
PID 2204 wrote to memory of 1828	2204	msedge.exe	88
PID 2204 wrote to memory of 1828	2204	msedge.exe	88
PID 2204 wrote to memory of 1828	2204	msedge.exe	88
PID 2204 wrote to memory of 1828	2204	msedge.exe	88
PID 2204 wrote to memory of 1828	2204	msedge.exe	88
PID 2204 wrote to memory of 3248	2204	msedge.exe	89
PID 2204 wrote to memory of 3248	2204	msedge.exe	89
PID 2204 wrote to memory of 3588	2204	msedge.exe	90
PID 2204 wrote to memory of 3588	2204	msedge.exe	90
PID 2204 wrote to memory of 3588	2204	msedge.exe	90
PID 2204 wrote to memory of 3588	2204	msedge.exe	90
PID 2204 wrote to memory of 3588	2204	msedge.exe	90
PID 2204 wrote to memory of 3588	2204	msedge.exe	90
PID 2204 wrote to memory of 3588	2204	msedge.exe	90
PID 2204 wrote to memory of 3588	2204	msedge.exe	90
PID 2204 wrote to memory of 3588	2204	msedge.exe	90
PID 2204 wrote to memory of 3588	2204	msedge.exe	90
PID 2204 wrote to memory of 3588	2204	msedge.exe	90
PID 2204 wrote to memory of 3588	2204	msedge.exe	90
PID 2204 wrote to memory of 3588	2204	msedge.exe	90
PID 2204 wrote to memory of 3588	2204	msedge.exe	90
PID 2204 wrote to memory of 3588	2204	msedge.exe	90
PID 2204 wrote to memory of 3588	2204	msedge.exe	90
PID 2204 wrote to memory of 3588	2204	msedge.exe	90
PID 2204 wrote to memory of 3588	2204	msedge.exe	90
PID 2204 wrote to memory of 3588	2204	msedge.exe	90
PID 2204 wrote to memory of 3588	2204	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\libstream_filter_record_plugin.dll.svn-base_id=8328c31dba7c71ee20ee32f1a735d639f9e43928.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff89fb046f8,0x7ff89fb04708,0x7ff89fb04718
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,12411719015470325618,16529744271427097213,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,12411719015470325618,16529744271427097213,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,12411719015470325618,16529744271427097213,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12411719015470325618,16529744271427097213,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12411719015470325618,16529744271427097213,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12411719015470325618,16529744271427097213,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12411719015470325618,16529744271427097213,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12411719015470325618,16529744271427097213,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12411719015470325618,16529744271427097213,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,12411719015470325618,16529744271427097213,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:8
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,12411719015470325618,16529744271427097213,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,12411719015470325618,16529744271427097213,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4784 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2476

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
846ce533b9e20979bf1857f1afb61925

SHA1
4c6726618d10805940dba5e6cf849448b552bf68

SHA256
b81574d678f49d36d874dc062a1291092ab94164b92f7e30d42d9c61cc0e77c3

SHA512
8fb228fae89f063159dabc93871db205d836bdb4ec8f54a2f642bd0b1ac531eea0c21234a8ca75a0ae9a008d2399a9bf20a481f5d6a6eab53a533cd03aeaaa2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
104aab1e178489256a1425b28119ec93

SHA1
0bcf8ad28df672c618cb832ba8de8f85bd858a6c

SHA256
b92c19f079ef5948cb58654ce76f582a480a82cddc5083764ed7f1eac27b8d01

SHA512
b4f930f87eb86497672f32eb7cc77548d8afb09ad9fdba0508f368d5710e3a75c44b1fd9f96c98c2f0bd08deb4afde28330b11cf23e456c92cc509d28677d2cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cedc14bf21b91146c0298395c15427e4

SHA1
cc5bc784e7946dad978a63243a10d787a3395a99

SHA256
54a25cec7edf53697ad1d0b3ae516c941db76b99d1d884766b0bd4872c14f46a

SHA512
105a0e2292c1793a415fa422e01015a4b9b7bceb6aa075d847a356ccf29a0312aea4068a403b9326e09a96d3c28f544f124ff900aaa369c9a262951d470bcc2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
13e92358a91c64d75ec0bd574c47c77a

SHA1
c75496b8a1459c1e0019caa85d56b702c6e5e63e

SHA256
3bc2ba538b76bb2c10524b8142ec3d64934ff3c642ad3a8a0749256469ad875f

SHA512
e05cc82a4537cd1c43349f6f7f0d496e156b198949e550cf81359ae4abfe1ea1ec956262fac7df6e39fc8d561a3bebb4a4a4ecf458a0cad007c85d7fefcd119e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
797c4ddf02583117abc0b28765a2737a

SHA1
d873d9192fa7a4dd8b05c624cf2a30409a63b313

SHA256
a63e07974b5a5cd247c3aba97a3706ae6cd0a23dd2279c36d028cf8d405e22a0

SHA512
5a47bfc5f51aed74e9679826640eff35a5b6f5a2b63fb89ac0f2fc9e3e44e51272e7957d5280e641db2337d025c9607a1e90bf07520e0fbf9b2c05a7ec49a9e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2d4a09cde1f9c2cd8b33bf0d73d39e4f

SHA1
0cf1a77fe6997ce3046878e29bb2f26835f0bcbf

SHA256
a560faf3e7fc40d378e1fad8db8780062d790ed04a552ae805a6f3f36ceebe0b

SHA512
d939c9cd6856dbc6aa9b3d6cdb61297fcda0abc074abb28faa21e0f2e7bbd2faaa37538a34f0a8c6def2eccaf89f0149e9476b28206e777c5e204bc008f223cc

Download Submit