Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
10/05/2026, 09:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe
Resource
win10v2004-20250619-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
150 seconds
General
- Target 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe
- Size 251KB
- Sample260510-lef46scx21
- SHA256 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541
- MD5 103a1332d85f2cf517aae3224dd9a417
- SHA1 fcc9d05a4afacb387cfdf117e5799077897585db
- SHA512 2e2b106400c73d00b2fac54d4a2b4ecc9819a7e53d85c93656559892997cb739da296a1a730cd87f51e16ff99852b50183c30c2fefd1a88cee2e16c8c497ffd6
- SSDEEP 3072:izE4B4bEoI4zdK4jYNfZx30oeK5fwXY4xdqEtoQEwczQz55z4hPPC3jgNcchZHAK:igVbVBjYNoo/Bwo0vEH0NMsjfchZ
- TLSH T12D443910F989D501DD645A7BADBAF165027F9C112E108A5FAF883FD90877E83F532A32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Program Files directory 30 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\RCXF916.tmp 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\RCXFB53.tmp 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX7C3.tmp 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCXB20.tmp 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX680.tmp 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX6A2.tmp 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX6E2.tmp 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX6F4.tmp 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXF938.tmp 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXFAA1.tmp 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXFAC2.tmp 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXFB22.tmp 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCXB32.tmp 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX753.tmp 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCXB43.tmp 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe"C:\Users\Admin\AppData\Local\Temp\08b7a1d5ef310532b540a6f99dcaddcc0e0cd9666c9339feaafd4dcb2bf72541.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4688
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe
- Size 722KB
- SHA256 aa20aa3d2a61eeee6dd9aa21c6d76292016d396912cd24da7045630b850c7622
- MD5 a50c431bc2da153d0d158446d9a15c10
- SHA1 53a0e103a0132a5e9a33b2dc1415eda2afb013b7
- SHA512 377413edf923a812ea96976731ca701880ddd13273dbda178befb15fc2d3fa013ee2ad361935e39769fd0682cf13fbf51e7f43b696c16b5ccf36b0384d53fd6b
- SSDEEP 12288:DTzo0vEUNM/S86nHrUA9HVlK8SQBJ9t4f15rL:D9Nf86n9kAJ9tA3L
- TLSH T11BF48C41F69886D4E06AC535CE56D142D97BBC910F20A6DF03943BA92F37DD3AE3A720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe
- Size 1.5MB
- SHA256 fd5284c6a925b4db11ff7e2ca47c0461361731cc236b487f90e9d339670ccc2d
- MD5 6adce78f8ac6a0335b151a7ad6b3007a
- SHA1 092292ad9e35c63ea6446879be5481e4e95fc80b
- SHA512 f2cd383c99ff845b8c6787493c1fbd5ade56775550be594174b1bf74016546a384dcc57cddce71e4d99c5f56c85862792c837738bf42148653b5811b75ebb256
- SSDEEP 24576:2yoteh6euUHmEhK7eTuNdfxINakEtv9kWG2L1oaedpEukUoygGmq/Sl:2fehjvHHKTdfxINPEt99G2Bo7EukU1a
- TLSH T11E657B03B2D900E8D06AD1B8C7568536EAB2BC450B24A6EF0B90B7551F7BFE45B3E711
- MD5 SHA1 SHA512 SSDEEP TLSH