Overview

overview

7

Static

static

3

MicroSIP-3.22.12.exe

windows10-2004-x64

7

MicroSIP-3.22.12.exe

windows11-ltsc_2024-x64

7

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...nu.dll

windows10-2004-x64

3

$PLUGINSDI...nu.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows11-ltsc_2024-x64

3

MicroSIP.exe

windows10-2004-x64

7

MicroSIP.exe

windows11-ltsc_2024-x64

4

MicroSIP.url

windows10-2004-x64

4

MicroSIP.url

windows11-ltsc_2024-x64

4

SDL2.dll

windows10-2004-x64

3

SDL2.dll

windows11-ltsc_2024-x64

3

Uninstall.exe

windows10-2004-x64

7

Uninstall.exe

windows11-ltsc_2024-x64

7

avcodec-60.dll

windows10-2004-x64

3

avcodec-60.dll

windows11-ltsc_2024-x64

3

avformat-60.dll

windows10-2004-x64

3

avformat-60.dll

windows11-ltsc_2024-x64

3

avutil-58.dll

windows10-2004-x64

3

avutil-58.dll

windows11-ltsc_2024-x64

3

lame_enc.dll

windows10-2004-x64

3

lame_enc.dll

windows11-ltsc_2024-x64

3

swscale-7.dll

windows10-2004-x64

3

swscale-7.dll

windows11-ltsc_2024-x64

3

Analysis

  • user interaction
    yes
  • max time kernel
    14s
  • max time network
    24s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    05/08/2026, 01:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    MicroSIP-3.22.12.exe
  • Size 9.0MB
  • Sample260805-bf7neabd52
  • SHA256 505021a4561934d634afd533e7b27611094800b6668a5bfa795afbe858fe736f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoverypersistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 8 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Modifies registry class 23 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MicroSIP-3.22.12.exe
    "C:\Users\Admin\AppData\Local\Temp\MicroSIP-3.22.12.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    PID:1596
  • C:\Users\Admin\AppData\Local\MicroSIP\MicroSIP.exe
    "C:\Users\Admin\AppData\Local\MicroSIP\MicroSIP.exe" /minimized
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4228
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" url.dll,FileProtocolHandler https://www.microsip.org/check-version?ver=3.22.12
      2⤵
        PID:1544
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.microsip.org/check-version?ver=3.22.12
          3⤵
            PID:4188
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d4,0x7ffab1fdc188,0x7ffab1fdc194,0x7ffab1fdc1a0
              4⤵
                PID:4120
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,6069146268733509296,12969753857341765776,524288 --field-trial-handle=2720,i,11303200860060436312,13046068295898948841,262144 --variations-seed-version --mojo-platform-channel-handle=2820 /prefetch:3
                4⤵
                • System Time Discovery
                PID:2488
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,11367837448790446541,6241476996491931599,262144 --field-trial-handle=2720,i,11303200860060436312,13046068295898948841,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:2
                4⤵
                  PID:1660
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2252,i,4185682693540233209,9967716938312517238,524288 --field-trial-handle=2720,i,11303200860060436312,13046068295898948841,262144 --variations-seed-version --mojo-platform-channel-handle=2840 /prefetch:8
                  4⤵
                    PID:4896
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,15925931471204877590,12918800342056080040,2097152 --field-trial-handle=2720,i,11303200860060436312,13046068295898948841,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
                    4⤵
                      PID:1576
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,1291441179512073012,2845363109000525393,2097152 --field-trial-handle=2720,i,11303200860060436312,13046068295898948841,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
                      4⤵
                        PID:4888
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,16851867338071003320,116603444100173311,2097152 --field-trial-handle=2720,i,11303200860060436312,13046068295898948841,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
                        4⤵
                          PID:2572
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,8999377459858918611,11475936253344281646,2097152 --field-trial-handle=2720,i,11303200860060436312,13046068295898948841,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:2
                          4⤵
                            PID:2248
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,17189050745096583534,3545720300599381796,524288 --field-trial-handle=2720,i,11303200860060436312,13046068295898948841,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:8
                            4⤵
                              PID:1908
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,14582542304476657273,17078006692562017702,524288 --field-trial-handle=2720,i,11303200860060436312,13046068295898948841,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
                              4⤵
                                PID:1320
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,6633742526335281234,11093981158171799500,524288 --field-trial-handle=2720,i,11303200860060436312,13046068295898948841,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:8
                                4⤵
                                  PID:4460
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,11602857083905556006,7653876285812953453,524288 --field-trial-handle=2720,i,11303200860060436312,13046068295898948841,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:8
                                  4⤵
                                    PID:4196
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5776,i,7410032216639034132,17112803522917601703,2097152 --field-trial-handle=2720,i,11303200860060436312,13046068295898948841,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:1
                                    4⤵
                                      PID:224
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6200,i,5840976310352780286,11255380851984393030,2097152 --field-trial-handle=2720,i,11303200860060436312,13046068295898948841,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:1
                                      4⤵
                                        PID:808
                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                  1⤵
                                    PID:4536

                                  Network

                                        MITRE ATT&CK Enterprise v16

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        MicroSIP.exe
                                        • Path C:\Users\Admin\AppData\Local\MicroSIP\MicroSIP.exe
                                        • Size 12.6MB
                                        • SHA256 132e749f6d4f5d6a90c45be2ed2ff993a96c8f9094d35ff3164a0ea882d7fe1a
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        SDL2.dll
                                        • Path C:\Users\Admin\AppData\Local\MicroSIP\SDL2.dll
                                        • Size 1.1MB
                                        • SHA256 0983e4f6aeece71702f42b10ad537b2d9fe0d6872810171cbb1a6babbb99752f
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        avcodec-60.dll
                                        • Path C:\Users\Admin\AppData\Local\MicroSIP\avcodec-60.dll
                                        • Size 3.1MB
                                        • SHA256 d24bfcd6db823ff1b9781a1de5fb3997366f954ff12868f9a915b8dcee0995d2
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        avutil-58.dll
                                        • Path C:\Users\Admin\AppData\Local\MicroSIP\avutil-58.dll
                                        • Size 812KB
                                        • SHA256 647da18b39629dc9c5fd37ed4145a5d4033da8d40decf0e45c9e139d483ddf62
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        swscale-7.dll
                                        • Path C:\Users\Admin\AppData\Local\MicroSIP\swscale-7.dll
                                        • Size 466KB
                                        • SHA256 b92ece4b059d8fd788a5d289c36655176e74b8f61b037ba6c290eba82fa5452f
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        settings.dat
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                        • Size 280B
                                        • SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        settings.dat
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                        • Size 280B
                                        • SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        Edge Profile.ico
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                        • Size 70KB
                                        • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        SCT Auditing Pending Reports
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                        • Size 2B
                                        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        sync_diagnostic.log
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                        • Size 6KB
                                        • SHA256 1fc952d6c0e1a33e6c37e8b57804a7075daae29661af45109ccb41da927ffe0c
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        Local State
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                        • Size 8KB
                                        • SHA256 8912d9e57807d8849c23547552daf3fff06c099fefca3c60856f03e5e2fd232d
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        Local State
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                        • Size 8KB
                                        • SHA256 d1e2a96162a657682aa9954d62f06da0845dc7981af8386f5ecf905056c679f7
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                        • Size 2KB
                                        • SHA256 3f4f4c71b6f4f76f1ea503feb5d3968e2db47b3fa3e687035aa78f87ffb2522e
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        LangDLL.dll
                                        • Path C:\Users\Admin\AppData\Local\Temp\nsm557F.tmp\LangDLL.dll
                                        • Size 5KB
                                        • SHA256 131aa0df90c08dce2eecee46cce8759e9afff04bf15b7b0002c2a53ae5e92c36
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        StartMenu.dll
                                        • Path C:\Users\Admin\AppData\Local\Temp\nsm557F.tmp\StartMenu.dll
                                        • Size 7KB
                                        • SHA256 e74f442771f034a24b77d3a849b343551bdef69ef151c622cb9fd5f34dccda81
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        System.dll
                                        • Path C:\Users\Admin\AppData\Local\Temp\nsm557F.tmp\System.dll
                                        • Size 12KB
                                        • SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        nsDialogs.dll
                                        • Path C:\Users\Admin\AppData\Local\Temp\nsm557F.tmp\nsDialogs.dll
                                        • Size 9KB
                                        • SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        MicroSIP.ini
                                        • Path C:\Users\Admin\AppData\Roaming\MicroSIP\MicroSIP.ini
                                        • Size 3KB
                                        • SHA256 490c3f5d717fae65c84f5f8463bfdac3b461d091dec1da3fded3bef6f18f14fe
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        MicroSIP.ini
                                        • Path C:\Users\Admin\AppData\Roaming\MicroSIP\MicroSIP.ini
                                        • Size 56B
                                        • SHA256 bf674082d4abcfd9f1a12e20118168103a5ed614beb556284c282a3d35894d07
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        MicroSIP.ini
                                        • Path C:\Users\Admin\AppData\Roaming\MicroSIP\MicroSIP.ini
                                        • Size 142B
                                        • SHA256 387a6a86ac5758780675615ecd0efd5031dca48a71eef8af18333a546e328784
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        MicroSIP.lnk
                                        • Path C:\Users\Admin\Desktop\MicroSIP.lnk
                                        • Size 1KB
                                        • SHA256 3a3a8f8e92853f2d89276bca1c674c222cf06afd63570009370002b60b11dfc9
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download