Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
11/05/2026, 07:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
150 seconds
General
- Target 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe
- Size 544KB
- Sample260511-h26fssf19k
- SHA256 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00
- MD5 03177595674f178c31b50208dd208f12
- SHA1 9a810ef7d5beb0b5beadf6a358ce1b68841f4b7a
- SHA512 9d25dca4bbda3f512decc84a66e0cbfe9e879c84efa665abac2de7cebb6961fbfac49c78ce02e9adefd46c78bf2f084a38c03829633ab1c101922f3b0e64688a
- SSDEEP 6144:NboieLrXDGyRTbGsk0kcC3NLKDOLudPZj+x3ZRIir9Hg7FThpt6mMY:N1uTbGsX01KDUudEvIO9HgNMY
- TLSH T186C439017BF8563AE19E9775E4764C1D93F5B427A28BAB8E8980FCFB38537509801723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Program Files directory 30 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\RCX57FF.tmp 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX63FF.tmp 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX648D.tmp 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX639E.tmp 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX63EE.tmp 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX644E.tmp 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX5A36.tmp 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCX67CD.tmp 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\RCX5A66.tmp 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX63BE.tmp 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX5969.tmp 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX5979.tmp 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCX679C.tmp 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX5810.tmp 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCX67AC.tmp 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe"C:\Users\Admin\AppData\Local\Temp\792c197d405df6b12320b1a2048f1da7db34a5c8bb4a5f7244324ab5dfc4ae00.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5920
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe
- Size 618KB
- SHA256 ae990e75c065012840a06a7c3e17a5b102bbffca10fd4377d57443ad96c97396
- MD5 ba3fc741041e54b8810a3250760ed220
- SHA1 d4591d509e1a1ee3a37791a76b4fb195e5775e09
- SHA512 75ef7a55a47e17655b508cd95fc774fb9d3979614d35351a20c3f0cfe7b5f43702228d11fb836ef9be4fb2d8f5f3663559a1e0a7ace10e6a46f38fb62abe588e
- SSDEEP 6144:NvQLO76tlVr1Il5HlrJHU7kfLeeHVlK8SQBJ9LBKJwgdAmKa5rL:N4S86nHrUA9HVlK8SQBJ9t4f15rL
- TLSH T166D46C41B3D847E9E06AC5348A528D46EA717C970B63A6DF02A05E7B3F376E14F3A311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.3MB
- SHA256 190298977c18fd9dd73700453ccbd1c704f7f804c8cc31a924ac2bd148636259
- MD5 79bc98b236b5fcdaba48bfc758358690
- SHA1 456f515216becff8f1f792501a3cc9ddfe3307ab
- SHA512 184ab55b6b2222bf5fc3155c5a192cf5130dd60fa96f35af3f9f6035d64936c0e64eb249bdbe621cc96384215361cd035d5484f5aba1f21b5f9e8dcc75a298ce
- SSDEEP 49152:6b+632BuPkFKRrdE6oh2stBhuXjfS4LWxnM:s3q6DjBf
- TLSH T134B56B03F29900D8E069D178D7469932E9A1BC8B0B26B6DF0780BA573E77EE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe
- Size 1.5MB
- SHA256 f9d4c4eee46e6a34f414771e7d10847d63ec11f0488c4ff1fddf53a72053e3ba
- MD5 15b5658c8429bbcd339f1d230e4e776b
- SHA1 996facfb55b0c36cd2739032bde93ef289a17807
- SHA512 bb69e0fa3b9d9cf9cd8c773c7fb52f5fa96a22bb5ca81943f70e18afe18fa44c2861bbd746fd1d592ef1c84ac49ddb7cfdcf381fe0f7c2c2a9481c8ebf94ca65
- SSDEEP 24576:BZGY26UEU3RyRPW+uSmS86IU8Gc7QGsVa4i6h27d3WlN:eY2fF8FhmS86IUJWQn+6h27d6
- TLSH T11F656B03B29940D8D059D0B4C7568D26EAA27C470B27A6EF0B90BE573E77EE45B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\0e585772.tmp
- Size 2.8MB
- SHA256 aa0a34300a93a2882b241b7fbf23e590f594f811fabfb8fccbc789796b7fa80e
- MD5 5fb303dcaf8de9324c9e4824718c0195
- SHA1 068710eaefe9da6aac750553546c08d2ad723b3e
- SHA512 1b117e044862a9a6bfc55984e6fd5093e0baa413507ca3055becd321ee602dbd5fb41c1bfa5e21327390e83ed50f6d1dabfea6e84896c11bb284578df8e7e7ee
- SSDEEP 49152:jY2fF8FhmS86IUJWQn+6h27d+Y2fF8FhmS86IUJWQn+6h27d6:jbOjjst4bOjjsts
- TLSH T1B6D57B03F69900E8D059D1B4CB56853AEAB2BC450B34A6EF0B90B7552F7BEE45B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH