Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/05/2026, 07:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
150 seconds
General
- Target 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe
- Size 544KB
- Sample260511-h26fssf19k
- SHA256 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00
- MD5 03177595674f178c31b50208dd208f12
- SHA1 9a810ef7d5beb0b5beadf6a358ce1b68841f4b7a
- SHA512 9d25dca4bbda3f512decc84a66e0cbfe9e879c84efa665abac2de7cebb6961fbfac49c78ce02e9adefd46c78bf2f084a38c03829633ab1c101922f3b0e64688a
- SSDEEP 6144:NboieLrXDGyRTbGsk0kcC3NLKDOLudPZj+x3ZRIir9Hg7FThpt6mMY:N1uTbGsX01KDUudEvIO9HgNMY
- TLSH T186C439017BF8563AE19E9775E4764C1D93F5B427A28BAB8E8980FCFB38537509801723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Program Files directory 30 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCX4253.tmp 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX3E65.tmp 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX3F14.tmp 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCX4222.tmp 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX33A3.tmp 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCX4242.tmp 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX3E15.tmp 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX3E35.tmp 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\RCX31AB.tmp 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX3324.tmp 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX3E85.tmp 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX3344.tmp 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\RCX3402.tmp 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX3ED4.tmp 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX31BB.tmp 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe"C:\Users\Admin\AppData\Local\Temp\792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:696
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe
- Size 96KB
- SHA256 6f1d3e11a2636b971c0c99ebcd95961e93be7761f95ce436b8a28f3ded293ab3
- MD5 b8d4a1ad1fb7d6ad3a3ca285af535c25
- SHA1 a2ccf9b648718a33bccff50dc90d39156196c138
- SHA512 d6489c283d32a1eff096630e9dc56604b4564000c1e7da512ee7aaa8ee77c65d2d9d1217da17e5ec7f30b3323915938d1822f372d689a4053b234b4bea0e1fea
- SSDEEP 384:Wu9xD0sO20SeBcV5fxZ2/AGbzx4fbIot3qnd9ZOxaefMlN+DW6HM72VlLkKmX:WuLv0SpxeAidabHtydtZlNojY2VFTI
- TLSH T14EA3B48DA9C6F156E02049BE2FFAEEA547667C272743732FA7C0BD1B7B715810D46202
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
- Size 1.5MB
- SHA256 ff285dde40ce7c4b832dd31fd51972754707575b405f1e048830213e969d9ccd
- MD5 5a39c24cf65fdd7eafaa54362795c41d
- SHA1 7a07fbeba3ba62d7519bd99a045cc6c07da01632
- SHA512 25f56fb6f4be534beca4c2201e190b65762969442042618e278df54b4906668782bbb99f72f74cc5d65fa8f9a725765ca48b7d6362ad2fa581e4595cefff2f42
- SSDEEP 24576:emjDvw6qZ04SuTjPn68TQuD3g9gZLfChjyosZ9HT1zYeHNrk9NrfZB:PDvwZ2XuTjPb33g9gZLfCdW9HTlXrk9l
- TLSH T1FD755A03A29900E9D059D1B4C7568D26EAB27C470B27A6EF0790BE173E37BE45B3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\0e5830fe.tmp
- Size 1.4MB
- SHA256 d3b78e7ed236350a7647030fcb7dfcef8a154aa67363741b13f53268a23ae01c
- MD5 8a74abcf6ab1f04e308431cd87cf3e98
- SHA1 edbcdf9a1ef1def591b6b51749a277f18519cace
- SHA512 c64c45f4943d88aad4ee274c2b0ad76096a92a8ea184fbabad0de3e52c0c93a9ad3848a7ace398193a95937949220a30234c31e92bcabc1ad07d1b83a2dfc25d
- SSDEEP 24576:YZGY26UEU3RyRPW+uSmS86IU8Gc7QGsVa4i6h27d3WlN:jY2fF8FhmS86IUJWQn+6h27d6
- TLSH T1AE657B03F69900E8D059D1B4CB56853AEAB2BC450B34A6EF0B90B7552F7BEE45B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH