General
- Target Remove-EdgeOnly.exe
- Size 7.7MB
- Sample240404-cl7e9scd25
- SHA256 a9272268e017eced810788b465dd4ce90e4b58e9500a84b382956146b3ff07d3
- MD5 617d4acc4a59d7b042276eff21c8f637
- SHA1 f6558807cb58ade6d024b34f45e8b5680a23dc81
- SHA512 e473e0a962deb1630b0824b2578336bbb297b4db0f03a81fc239c88067181d3b2026e12bd4d3aaab0a3057fc98a80780de08a7ada39b96d299d3bf654d38f1fc
- SSDEEP 196608:B/8Olb2w9+L0YFqQxA10++MvJHDO6D3U/7F1g:Bplq5L0HQK1HnEzFa
- MD5 SHA1 SHA512 SSDEEP
Behavioral task
behavioral1
Sample
Remove-EdgeOnly.exe
Resource
win7-20240221-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Remove-EdgeOnly.exe
Resource
win10v2004-20240226-en
21 signatures
150 seconds
Behavioral task
behavioral3
Sample
edge.ps1
Resource
win7-20240221-en
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
edge.ps1
Resource
win10v2004-20240226-en
2 signatures
150 seconds
Malware Config
Targets
-
- Target Remove-EdgeOnly.exe
- Size 7.7MB
- SHA256 a9272268e017eced810788b465dd4ce90e4b58e9500a84b382956146b3ff07d3
- MD5 617d4acc4a59d7b042276eff21c8f637
- SHA1 f6558807cb58ade6d024b34f45e8b5680a23dc81
- SHA512 e473e0a962deb1630b0824b2578336bbb297b4db0f03a81fc239c88067181d3b2026e12bd4d3aaab0a3057fc98a80780de08a7ada39b96d299d3bf654d38f1fc
- SSDEEP 196608:B/8Olb2w9+L0YFqQxA10++MvJHDO6D3U/7F1g:Bplq5L0HQK1HnEzFa
- MD5 SHA1 SHA512 SSDEEP
-
Modifies Installed Components in the registry
-
Possible privilege escalation attempt
-
Stops running service(s)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Registers COM server for autorun
-
- Target edge.pyc
- Size 10KB
- SHA256 a2038c97e463e99094a4e3738fa58377c8fab53f7c481743bcc7e9ca5f0f58ca
- MD5 53dbfb8bc37cff2a6ff17fabcd3e1662
- SHA1 c53ba7292e7759a87405007aadb55a74ffa61455
- SHA512 f35f07bc6b11ea7c9754557e187beab62b1b45cbd5896a2e589645a23a1f68420f3a96b1a0898e53eda8f0e7c80f921824d3aefd246b5dca7829270290557496
- SSDEEP 192:Eqqf6cmxDfptl9WgVLdIlDOTwSDXWIozSCXaUbh+v68iT:c6nzl9WgVKUbxozPXJa6zT
- MD5 SHA1 SHA512 SSDEEP
Score1/10
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Browser Extensions
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1