3bb56ad9f516f474745ddd9162ab9f2e54c9c53c3364f73f68c15121ba717520

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 10:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

libstream_out_es_plugin.dll.svn-base?id=3053a167982e379b031fe9fbe2a1d57c23026a90.html
Size

7KB
MD5

a98dabc5579ba56c910c75bc7dd74f80
SHA1

3791111666e649eb7764343665a8ad1a312bb14c
SHA256

3bb56ad9f516f474745ddd9162ab9f2e54c9c53c3364f73f68c15121ba717520
SHA512

506dec0da2dbef75a28ad168587e722b2be224c69e32b5ac41a641ee47d933fe7f7466e27f0c09986252fde8bc14c1054418e264dfaf2cabbbf119ada75acbdc
SSDEEP

192:ZJpvTPMcMHyx1YpvHpv/tpv/d3pv/opvCipv0mXHP5BxS1pv/XpvST/lo3fYpvvH:ZbPMcMHyx127dRdmXHP5BxSDcT/2KaSN

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3160	msedge.exe
3160	msedge.exe
2600	msedge.exe
2600	msedge.exe
1844	identity_helper.exe
1844	identity_helper.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 2160	2600	msedge.exe	83
PID 2600 wrote to memory of 2160	2600	msedge.exe	83
PID 2600 wrote to memory of 3536	2600	msedge.exe	84
PID 2600 wrote to memory of 3536	2600	msedge.exe	84
PID 2600 wrote to memory of 3536	2600	msedge.exe	84
PID 2600 wrote to memory of 3536	2600	msedge.exe	84
PID 2600 wrote to memory of 3536	2600	msedge.exe	84
PID 2600 wrote to memory of 3536	2600	msedge.exe	84
PID 2600 wrote to memory of 3536	2600	msedge.exe	84
PID 2600 wrote to memory of 3536	2600	msedge.exe	84
PID 2600 wrote to memory of 3536	2600	msedge.exe	84
PID 2600 wrote to memory of 3536	2600	msedge.exe	84
PID 2600 wrote to memory of 3536	2600	msedge.exe	84
PID 2600 wrote to memory of 3536	2600	msedge.exe	84
PID 2600 wrote to memory of 3536	2600	msedge.exe	84
PID 2600 wrote to memory of 3536	2600	msedge.exe	84
PID 2600 wrote to memory of 3536	2600	msedge.exe	84
PID 2600 wrote to memory of 3536	2600	msedge.exe	84
PID 2600 wrote to memory of 3536	2600	msedge.exe	84
PID 2600 wrote to memory of 3536	2600	msedge.exe	84
PID 2600 wrote to memory of 3536	2600	msedge.exe	84
PID 2600 wrote to memory of 3536	2600	msedge.exe	84
PID 2600 wrote to memory of 3536	2600	msedge.exe	84
PID 2600 wrote to memory of 3536	2600	msedge.exe	84
PID 2600 wrote to memory of 3536	2600	msedge.exe	84
PID 2600 wrote to memory of 3536	2600	msedge.exe	84
PID 2600 wrote to memory of 3536	2600	msedge.exe	84
PID 2600 wrote to memory of 3536	2600	msedge.exe	84
PID 2600 wrote to memory of 3536	2600	msedge.exe	84
PID 2600 wrote to memory of 3536	2600	msedge.exe	84
PID 2600 wrote to memory of 3536	2600	msedge.exe	84
PID 2600 wrote to memory of 3536	2600	msedge.exe	84
PID 2600 wrote to memory of 3536	2600	msedge.exe	84
PID 2600 wrote to memory of 3536	2600	msedge.exe	84
PID 2600 wrote to memory of 3536	2600	msedge.exe	84
PID 2600 wrote to memory of 3536	2600	msedge.exe	84
PID 2600 wrote to memory of 3536	2600	msedge.exe	84
PID 2600 wrote to memory of 3536	2600	msedge.exe	84
PID 2600 wrote to memory of 3536	2600	msedge.exe	84
PID 2600 wrote to memory of 3536	2600	msedge.exe	84
PID 2600 wrote to memory of 3536	2600	msedge.exe	84
PID 2600 wrote to memory of 3536	2600	msedge.exe	84
PID 2600 wrote to memory of 3160	2600	msedge.exe	85
PID 2600 wrote to memory of 3160	2600	msedge.exe	85
PID 2600 wrote to memory of 2824	2600	msedge.exe	86
PID 2600 wrote to memory of 2824	2600	msedge.exe	86
PID 2600 wrote to memory of 2824	2600	msedge.exe	86
PID 2600 wrote to memory of 2824	2600	msedge.exe	86
PID 2600 wrote to memory of 2824	2600	msedge.exe	86
PID 2600 wrote to memory of 2824	2600	msedge.exe	86
PID 2600 wrote to memory of 2824	2600	msedge.exe	86
PID 2600 wrote to memory of 2824	2600	msedge.exe	86
PID 2600 wrote to memory of 2824	2600	msedge.exe	86
PID 2600 wrote to memory of 2824	2600	msedge.exe	86
PID 2600 wrote to memory of 2824	2600	msedge.exe	86
PID 2600 wrote to memory of 2824	2600	msedge.exe	86
PID 2600 wrote to memory of 2824	2600	msedge.exe	86
PID 2600 wrote to memory of 2824	2600	msedge.exe	86
PID 2600 wrote to memory of 2824	2600	msedge.exe	86
PID 2600 wrote to memory of 2824	2600	msedge.exe	86
PID 2600 wrote to memory of 2824	2600	msedge.exe	86
PID 2600 wrote to memory of 2824	2600	msedge.exe	86
PID 2600 wrote to memory of 2824	2600	msedge.exe	86
PID 2600 wrote to memory of 2824	2600	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\libstream_out_es_plugin.dll.svn-base_id=3053a167982e379b031fe9fbe2a1d57c23026a90.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9bd0146f8,0x7ff9bd014708,0x7ff9bd014718
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,2901279348609734714,2296600759675480293,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2240,2901279348609734714,2296600759675480293,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2504 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2240,2901279348609734714,2296600759675480293,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2524 /prefetch:8
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,2901279348609734714,2296600759675480293,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,2901279348609734714,2296600759675480293,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,2901279348609734714,2296600759675480293,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,2901279348609734714,2296600759675480293,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,2901279348609734714,2296600759675480293,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,2901279348609734714,2296600759675480293,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,2901279348609734714,2296600759675480293,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,2901279348609734714,2296600759675480293,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,2901279348609734714,2296600759675480293,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5272 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
846ce533b9e20979bf1857f1afb61925

SHA1
4c6726618d10805940dba5e6cf849448b552bf68

SHA256
b81574d678f49d36d874dc062a1291092ab94164b92f7e30d42d9c61cc0e77c3

SHA512
8fb228fae89f063159dabc93871db205d836bdb4ec8f54a2f642bd0b1ac531eea0c21234a8ca75a0ae9a008d2399a9bf20a481f5d6a6eab53a533cd03aeaaa2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
104aab1e178489256a1425b28119ec93

SHA1
0bcf8ad28df672c618cb832ba8de8f85bd858a6c

SHA256
b92c19f079ef5948cb58654ce76f582a480a82cddc5083764ed7f1eac27b8d01

SHA512
b4f930f87eb86497672f32eb7cc77548d8afb09ad9fdba0508f368d5710e3a75c44b1fd9f96c98c2f0bd08deb4afde28330b11cf23e456c92cc509d28677d2cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e0b61e402b2853cb3119fa9a3b7d0b3e

SHA1
9977696fc02b6f550cb85c854771e58aa27338a3

SHA256
71dd87f141e26ef3e2b141cfb313fc80c03d2ed691d6fb7d95f33d90c484f267

SHA512
c28a1d7fbe3ae9a8034c8875cc69f00118f3d98ff1f01d0ebc321ec87c81e0c2293c1c1d3d2fc1e7599d76092f3b5560e88fe5737af424edc47d245438f8ceb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bd12c053-cc73-41b1-9b0b-ad28070248da.tmp

Filesize
6KB

MD5
3542c2edf337588ad87cec6d96f63541

SHA1
9a14abcc60a1631fd5ceccaf9f1244e352bb4370

SHA256
d2c3a5d5fc0084110c5206cbd24a0ba7e29eac88a00fc488b6736dda8c560727

SHA512
e2775b13c3f3709b43a561292f93714bd81db7c08567865c49613a63225f5cc36bfd37fada7107a6db73a41b39d674b670826711efc6e8a45df48baeb438d1a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
37c47cc1154ad95c5a3f018f820651ac

SHA1
5243f862df952a22a7ad3600ae9d049517f955f7

SHA256
32f60a3a6a849485f42cf50d4380c8d1f7f8ad9c5ba91f5e080f02311ad13d40

SHA512
4a985326ef25d74c55b16f643521a1cf9a07f8dca8a6a8feaa529f669260440b34c890f314eca46af94656aaac63b9a8db524f19d5669a69496a331f0a68d347

Download Submit