6b3564276a94f3f1bcd097659ba54fc5adda8364ddc56cf68939061a693e9fa9

Analysis

user interaction
yes
max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/04/2026, 01:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
External.exe
Size 430KB
Sample260422-b96cfaa141
SHA256 6b3564276a94f3f1bcd097659ba54fc5adda8364ddc56cf68939061a693e9fa9
MD5 cd2f13d39d702dafe17ba9d05e1de551
SHA1 713b23561a3f59f2feee3cf6489ee61694a06c20
SHA512 a3fa491124aad2cc8c4e6247d4fefcd0c16434065c7fdceb42164091bf902ccb401a91f60dfef4b36a754b520771ce9ce07dc5b15c1c4016cea0296f0dfcd1c7
SSDEEP 6144:Oow74sNZfiU5vY5SQRJvVhqTfZvNmrAQnU0pavY9gBnd17ZyhQDrv1nDYY:4744ZfXRtQLNa4nUVg9c17EQP1n
TLSH
T1F3949E41F1B544E9F027A478D5ABBA1BFA353888071096C773E4D9681FF27E05BBA312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4796	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3216	External.exe
3216	External.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3288	msedge.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 1720	3216	External.exe	84
PID 1248 wrote to memory of 3288	1248	msedge.exe	103
PID 3288 wrote to memory of 3628	3288	msedge.exe	104
PID 3288 wrote to memory of 4796	3288	msedge.exe	105
PID 3288 wrote to memory of 1720	3288	msedge.exe	106
PID 3288 wrote to memory of 3064	3288	msedge.exe	107
PID 3288 wrote to memory of 1720	3288	msedge.exe	106
PID 3288 wrote to memory of 1720	3288	msedge.exe	106
PID 3288 wrote to memory of 3064	3288	msedge.exe	107
PID 3288 wrote to memory of 4656	3288	msedge.exe	108
PID 3288 wrote to memory of 4656	3288	msedge.exe	108
PID 3288 wrote to memory of 4656	3288	msedge.exe	108

C:\Users\Admin\AppData\Local\Temp\External.exe
"C:\Users\Admin\AppData\Local\Temp\External.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:1720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaulta63191abhe07eh49d2h9d97h7830527336f5
1⤵
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaulta63191abhe07eh49d2h9d97h7830527336f5 --edge-skip-compat-layer-relaunch
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2b0,0x7ffa48eec188,0x7ffa48eec194,0x7ffa48eec1a0
    3⤵
    PID:3628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,16280132046764947432,3775149321775547882,524288 --field-trial-handle=2592,i,11350044020001600312,7292822524611564852,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1760,i,11087424633859523031,353809570249749103,262144 --field-trial-handle=2592,i,11350044020001600312,7292822524611564852,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:2
    3⤵
    PID:1720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2336,i,653187325547673983,16904525982650454483,524288 --field-trial-handle=2592,i,11350044020001600312,7292822524611564852,262144 --variations-seed-version --mojo-platform-channel-handle=2776 /prefetch:8
    3⤵
    PID:3064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=2908,i,16507717117108303414,4923833859136760998,2097152 --field-trial-handle=2592,i,11350044020001600312,7292822524611564852,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:2
    3⤵
    PID:4656

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 d0cf8615ae91b9d697091fbd17bd481824fb73643f700e559895bb3a94a5805d
MD5 4375edcbe672dd7894a02c76ad6b47be
SHA1 af62da92e6c80857e125adfe7e3e87eb563e35ec
SHA512 17c94a8588834b6582244496c203ac0557593d531a554c59fd50781e064fdd33f37fde1d6189319482b313999cc21c632b51cf8b5b4098298a651c484beac791
SSDEEP 96:sa2jbiEDWTdIsc2b9fbidHW+i046W6hfuH9EOx+WVoMfm+uecpYQjst167gwUhgF:sxfuCsZ0rpMHW6+WNGYBxhgF
TLSH
T114F1B9566E28697B4CCBE11DBA25BB43E2F5502265C51D48EBFC8B5C08DA6CD230B81F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 26KB
SHA256 a5c54841284a3fbc9c6b7ae42eaac39f212e951e36e592af21dc12d67148c2f1
MD5 796983d46bd453f7d80283fca59c768d
SHA1 d52811afe72e3eee805258ed0276a109860338f6
SHA512 8e19fd1853130c008d59fcda76c62a89cf64e5550fcfb4da263c0444a68a5d79376adfb6b1e4dced1332d62f363ebb3a76cae76584f3fd5c2f8fc171ed5d6f99
SSDEEP 768:9wOGLfJWvFnjP8F1+UoAYDCx9Tuqh0VfUC9xbog/OVY8LlSMdjerowuYj:9wOGLfJWvFnjPu1jat8LcEj1w5
TLSH
T115C2EB3B640CCB7E5FC01E9DDC5A6F9B2EA802C796988D4047FA954C02C77EE512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d9e55a52e16af50a28bba56cf23faf1e65fc9c8a46fa19d1913c8809c278b63c
MD5 f043905ca967a39f5f8f99906672e689
SHA1 328691f4aa9af449601653197a9b6276793b66eb
SHA512 b631434cd0e0556dfd5025425f1f90a9ed0bf314003922c1f21eae48436c8d01a3220c9d4a5d49fe0b6d1035b47fb9ca62d92f77f03aab69bc2ffb4bfe2be213
SSDEEP 192:YONDR6TZ0qQmiUyM1lab+jeOVTrYo8IEU6:YONDR6TCmnlg+yOlrYpU6
TLSH
T177020A3569286CAB8EE2AE45F44B37275FE4106BE9952B88D6D81F1C00D779C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 1b44f8c8d246fa6aaffcb0452e1ff574f6587dc33fdf167cafa7a67a0d30e0d4
MD5 bf5686a5d5861ca3172d367745ee30d1
SHA1 d80c87ca93200e960d0caa5219b588f31957a766
SHA512 3bb038c1858fa24d161bab07015d6a551d5106978f8730afc0094c9b1a856837da07433a10154d4b14c6143dfcb4097a498223ce36876a6ada31f37bd9b0159b
SSDEEP 192:zssNA6TZ0Z+QmiUyH2c7b+jeOVTr7HEOPcSmq7dUO:zssNA6TCZ6xcX+yOlr7kOz9UO
TLSH
T15212083669689C6B4D96A146F48B36635FE41077DC896F85E6C84F0C00C779C370B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 191651a23928b6126016e0345b51b0321fab6a2c0dd7e57abc69885db1aff55f
MD5 3b2baedc7a63530e70b4e722a4dcb493
SHA1 15eb25e90b1ee53608130bafdb9c6e2f99cd138c
SHA512 65722a63bf70839c4eeaba70cd30e9b0517fb0b582fd220aab8be2080ed12f4624ce78cb33fa021243eb8c590c94b5d0648d9a9e8d345238b7a5ae35daf0a2ce
SSDEEP 192:kONP6TZ0IQmiUyL1cab+jeOVTr7HEOPcXvq7dU6:kONP6TCoecg+yOlr7kOKWU6
TLSH
T13B12083569789C6B4E96A146F48732A39FE4107BDC866F85E6D84F0C04D779C3B0F82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 a3930ed243e3aa825241cf1a29683694052b07f9762a84608c70f2b00480df9d
MD5 dd31501d4ac46fafdd089dd2aa1ec542
SHA1 d49ece72199642daec62f9d35c056d1e7394ee27
SHA512 621d7b71f7adcfce8ae3c4db55e9bc1bf117e32d9de66bbf85727b7fcc63c98d67fa1f63142ef0326cff4ed9240c22dd193aeba75905c501d205174a81b6101d
SSDEEP 192:zssNA6TZ0Z+QmiUyC2c7b+jeOVTr7HEOPcSmq7dUO:zssNA6TCZ6YcX+yOlr7kOz9UO
TLSH
T14612083669689C6B4D96A146F48B36A35FE41077DC8A6F85E6C84F0C00C779C370B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3216-0-0x000001BE0D960000-0x000001BE0D990000-memory.dmp

Download