Analysis
- max time kernel
1799s - max time network
1488s - platform
windows11-21h2_x64 - resource
win11-20240802-en - resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system - submitted
09/08/2024, 12:48
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
MSEdgeRedirect.exe
Resource
win7-20240705-en
windows7-x64
15 signatures
1800 seconds
Behavioral task
behavioral2
Sample
MSEdgeRedirect.exe
Resource
win10-20240404-en
windows10-1703-x64
46 signatures
1800 seconds
Behavioral task
behavioral3
Sample
MSEdgeRedirect.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
4 signatures
1800 seconds
Behavioral task
behavioral4
Sample
MSEdgeRedirect.exe
Resource
win11-20240802-en
windows11-21h2-x64
4 signatures
1800 seconds
General
- Target MSEdgeRedirect.exe
- Size 1.1MB
- Sample240809-p18m4avbph
- SHA256 5c52dbabaa238202ddc0326d33edf8e48ae90f7f29490fde236f334769ab86d2
- MD5 9d530a6008ad6fb341350ef422c5dce9
- SHA1 91a24c8e96b8766f3ae6b4090233de5a3df359e3
- SHA512 d08a560e809416cbe479920c6f59fd73b9a318420f5fe4c68530580f2932db43a0488f4c3b515a73b8797fede260ec394d47802d6aeec451a0d5b83021cde526
- SSDEEP 24576:CrORE29TTVx8aBRd1h1orq+GWE0Jc5bDTj1Vyv9Tva1EOvPMm8:C2EYTb8atv1orq+pEiSDTj1VyvBa+OvL
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Control Panel\International\Geo\Nation MSEdgeRedirect.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3420 MSEdgeRedirect.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe 3420 MSEdgeRedirect.exe