Analysis
- max time kernel
149s - max time network
116s - platform
windows10-2004_x64 - resource
win10v2004-20250619-en - resource tags
arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system - submitted
10/05/2026, 09:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe
Resource
win10v2004-20250619-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
150 seconds
General
- Target 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe
- Size 251KB
- Sample260510-lef46scx21
- SHA256 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541
- MD5 103a1332d85f2cf517aae3224dd9a417
- SHA1 fcc9d05a4afacb387cfdf117e5799077897585db
- SHA512 2e2b106400c73d00b2fac54d4a2b4ecc9819a7e53d85c93656559892997cb739da296a1a730cd87f51e16ff99852b50183c30c2fefd1a88cee2e16c8c497ffd6
- SSDEEP 3072:izE4B4bEoI4zdK4jYNfZx30oeK5fwXY4xdqEtoQEwczQz55z4hPPC3jgNcchZHAK:igVbVBjYNoo/Bwo0vEH0NMsjfchZ
- TLSH T12D443910F989D501DD645A7BADBAF165027F9C112E108A5FAF883FD90877E83F532A32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Program Files directory 30 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\pwahelper.exe 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\BHO\RCX7187.tmp 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\RCX8108.tmp 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\RCX8189.tmp 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\RCX7333.tmp 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\BHO\ie_to_edge_stub.exe 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\msedgewebview2.exe 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCX8575.tmp 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\RCX7312.tmp 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\RCX81DA.tmp 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\RCX7199.tmp 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\RCX73C2.tmp 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\msedge.exe 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\RCX811A.tmp 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCX8599.tmp 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\RCX80D8.tmp 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\msedge_proxy.exe 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\msedge_pwa_launcher.exe 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\notification_click_helper.exe 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCX8587.tmp 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\RCX80B6.tmp 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevated_tracing_service.exe 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\RCX7402.tmp 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe"C:\Users\Admin\AppData\Local\Temp\08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5240
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\BHO\ie_to_edge_stub.exe
- Size 714KB
- SHA256 479f28758615a0fb6f82291770a75362a64cf7e6a0e073cc54158f73dcadceab
- MD5 a4d2fe918e279f23df561574e6cc152e
- SHA1 e0d7aa7acb3f9246b2225cebe726bada0d9cd879
- SHA512 1d04692472a23150ddcd9be4d83f21fc2b6418b8f6642ab9d56540d51f79f59e5df8bbc44ecfc1fb6b60156ec4692557be5e9d8e9e10c27078309a52e4ae4c21
- SSDEEP 12288:DTzo0vEUNMJeOVJ5FTyjr5APlch3pPTlqIT/DopL/g:D9NiVJ5FTym9AvopL/g
- TLSH T183F48C01F69885E4E069C5358E56C142DA7BB8510F20A6DF03D47BB92F37ED6AF3A720
- MD5 SHA1 SHA512 SSDEEP TLSH