38edfd7aa66f3ae1f376b9cdce558befd877d749e38306f412e8db436cb56713 | Triage

Sharing

General

Target

MicrosoftEdgeUpdater.exe
Size

2.7MB
Sample

240528-v1626adc5s
MD5

19c095e1c399bdaa0663caa9162f0b0e
SHA1

cb5504712ec965f7c43883f2f251823755b1e37e
SHA256

38edfd7aa66f3ae1f376b9cdce558befd877d749e38306f412e8db436cb56713
SHA512

a2a8e9e5140d7b306ba98d3674aa89b3e287cdf39bcf4b326148d963c38052fc65e99a17c0bf846150d71ff3efbd2c9d4b61b4c2d5847f8c9afa222af4c946d9
SSDEEP

49152:9fYIxVYU98IqK6VW6tE1ZWD4Zs52YeycKk4BVhGJneLriO:VYIxVZ98I71/ZsQIcKDoYr

Score

8^/10

evasion execution persistence

Malware Config

Targets

- Target
  
  MicrosoftEdgeUpdater.exe
- Size
  
  2.7MB
- MD5
  
  19c095e1c399bdaa0663caa9162f0b0e
- SHA1
  
  cb5504712ec965f7c43883f2f251823755b1e37e
- SHA256
  
  38edfd7aa66f3ae1f376b9cdce558befd877d749e38306f412e8db436cb56713
- SHA512
  
  a2a8e9e5140d7b306ba98d3674aa89b3e287cdf39bcf4b326148d963c38052fc65e99a17c0bf846150d71ff3efbd2c9d4b61b4c2d5847f8c9afa222af4c946d9
- SSDEEP
  
  49152:9fYIxVYU98IqK6VW6tE1ZWD4Zs52YeycKk4BVhGJneLriO:VYIxVZ98I71/ZsQIcKDoYr
Score

8^/10

evasion execution persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Creates new service(s)
  persistence execution
- Stops running service(s)
  evasion execution
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

evasionexecutionpersistence