Analysis
- max time kernel
149s - max time network
142s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/06/2026, 11:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
N0.R.B7B435CAF5E43F674C5.jPf.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
N0.R.B7B435CAF5E43F674C5.jPf.exe
Resource
win11-20260513-en
windows11-21h2-x64
13 signatures
150 seconds
General
- Target N0.R.B7B435CAF5E43F674C5.jPf.exe
- Size 5.8MB
- Sample260604-nenv5ad17p
- SHA256 f4d85aaa2236a70daa016853c754f0a3378f4873f8d10047b890580a328f6d07
- MD5 8ea84a4590c215be1b30221b7f9d6fa4
- SHA1 93fc4d4d06b5209df440f06cd1a851e8396fc551
- SHA512 6d199594e35929a6c8ec25e05916c633e23e711e8dc83132a22736f330e937eef65a190781c8c211360ea80031b39df397cbcb0a97f3971f60915df112181464
- SSDEEP 98304:F39O2seZ/7UvCOSau23EmDBNCeuPkkJRKRDTtTF24OiZrq1DfPHNADtV6v+S:F39O2P2uVHPkkJRKRD5TF24O7NADtV6L
- TLSH T14156BFD13D544079C5B302328E9EF278A1BE6D6F173E85A7295CBA1F6F316838927027
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 5112 MicrosoftEdgeUpdate.exe 3368 MicrosoftEdgeUpdate.exe - Loads dropped DLL 2 IoCs
pid Process 5112 MicrosoftEdgeUpdate.exe 3368 MicrosoftEdgeUpdate.exe - Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: MicrosoftEdgeUpdate.exe File opened (read-only) \??\N: MicrosoftEdgeUpdate.exe File opened (read-only) \??\O: MicrosoftEdgeUpdate.exe File opened (read-only) \??\S: MicrosoftEdgeUpdate.exe File opened (read-only) \??\U: MicrosoftEdgeUpdate.exe File opened (read-only) \??\X: MicrosoftEdgeUpdate.exe File opened (read-only) \??\Z: MicrosoftEdgeUpdate.exe File opened (read-only) \??\K: MicrosoftEdgeUpdate.exe File opened (read-only) \??\T: MicrosoftEdgeUpdate.exe File opened (read-only) \??\Y: MicrosoftEdgeUpdate.exe File opened (read-only) \??\B: MicrosoftEdgeUpdate.exe File opened (read-only) \??\E: MicrosoftEdgeUpdate.exe File opened (read-only) \??\G: MicrosoftEdgeUpdate.exe File opened (read-only) \??\I: MicrosoftEdgeUpdate.exe File opened (read-only) \??\J: MicrosoftEdgeUpdate.exe File opened (read-only) \??\M: MicrosoftEdgeUpdate.exe File opened (read-only) \??\P: MicrosoftEdgeUpdate.exe File opened (read-only) \??\Q: MicrosoftEdgeUpdate.exe File opened (read-only) \??\L: MicrosoftEdgeUpdate.exe File opened (read-only) \??\R: MicrosoftEdgeUpdate.exe File opened (read-only) \??\V: MicrosoftEdgeUpdate.exe File opened (read-only) \??\W: MicrosoftEdgeUpdate.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 api.ipify.org 54 api.ipify.org - Enumerates processes with tasklist 1 TTPs 3 IoCs
pid Process 1756 tasklist.exe 1824 tasklist.exe 4708 tasklist.exe - Program crash 1 IoCs
pid pid_target Process procid_target 1364 3368 WerFault.exe 102 - System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N0.R.B7B435CAF5E43F674C5.jPf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe - Delays execution with timeout.exe 3 IoCs
pid Process 4624 timeout.exe 3160 timeout.exe 4248 timeout.exe - Kills process with taskkill 1 IoCs
pid Process 4796 taskkill.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe - Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeDebugPrivilege 5112 MicrosoftEdgeUpdate.exe Token: SeIncBasePriorityPrivilege 5112 MicrosoftEdgeUpdate.exe Token: SeLoadDriverPrivilege 5112 MicrosoftEdgeUpdate.exe Token: SeTakeOwnershipPrivilege 5112 MicrosoftEdgeUpdate.exe Token: SeTcbPrivilege 5112 MicrosoftEdgeUpdate.exe Token: SeDebugPrivilege 4796 taskkill.exe Token: SeDebugPrivilege 1824 tasklist.exe Token: SeDebugPrivilege 5112 MicrosoftEdgeUpdate.exe Token: SeCreateTokenPrivilege 5112 MicrosoftEdgeUpdate.exe Token: SeAssignPrimaryTokenPrivilege 5112 MicrosoftEdgeUpdate.exe Token: SeLockMemoryPrivilege 5112 MicrosoftEdgeUpdate.exe Token: SeIncreaseQuotaPrivilege 5112 MicrosoftEdgeUpdate.exe Token: SeMachineAccountPrivilege 5112 MicrosoftEdgeUpdate.exe Token: SeTcbPrivilege 5112 MicrosoftEdgeUpdate.exe Token: SeSecurityPrivilege 5112 MicrosoftEdgeUpdate.exe Token: SeTakeOwnershipPrivilege 5112 MicrosoftEdgeUpdate.exe Token: SeLoadDriverPrivilege 5112 MicrosoftEdgeUpdate.exe Token: SeSystemProfilePrivilege 5112 MicrosoftEdgeUpdate.exe Token: SeSystemtimePrivilege 5112 MicrosoftEdgeUpdate.exe Token: SeProfSingleProcessPrivilege 5112 MicrosoftEdgeUpdate.exe Token: SeIncBasePriorityPrivilege 5112 MicrosoftEdgeUpdate.exe Token: SeCreatePagefilePrivilege 5112 MicrosoftEdgeUpdate.exe Token: SeCreatePermanentPrivilege 5112 MicrosoftEdgeUpdate.exe Token: SeBackupPrivilege 5112 MicrosoftEdgeUpdate.exe Token: SeRestorePrivilege 5112 MicrosoftEdgeUpdate.exe Token: SeShutdownPrivilege 5112 MicrosoftEdgeUpdate.exe Token: SeDebugPrivilege 5112 MicrosoftEdgeUpdate.exe Token: SeAuditPrivilege 5112 MicrosoftEdgeUpdate.exe Token: SeSystemEnvironmentPrivilege 5112 MicrosoftEdgeUpdate.exe Token: SeChangeNotifyPrivilege 5112 MicrosoftEdgeUpdate.exe Token: SeRemoteShutdownPrivilege 5112 MicrosoftEdgeUpdate.exe Token: SeUndockPrivilege 5112 MicrosoftEdgeUpdate.exe Token: SeSyncAgentPrivilege 5112 MicrosoftEdgeUpdate.exe Token: SeEnableDelegationPrivilege 5112 MicrosoftEdgeUpdate.exe Token: SeManageVolumePrivilege 5112 MicrosoftEdgeUpdate.exe Token: SeImpersonatePrivilege 5112 MicrosoftEdgeUpdate.exe Token: SeCreateGlobalPrivilege 5112 MicrosoftEdgeUpdate.exe Token: 31 5112 MicrosoftEdgeUpdate.exe Token: 32 5112 MicrosoftEdgeUpdate.exe Token: 33 5112 MicrosoftEdgeUpdate.exe Token: 34 5112 MicrosoftEdgeUpdate.exe Token: 35 5112 MicrosoftEdgeUpdate.exe Token: SeDebugPrivilege 4708 tasklist.exe Token: SeDebugPrivilege 1756 tasklist.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 2120 N0.R.B7B435CAF5E43F674C5.jPf.exe 2120 N0.R.B7B435CAF5E43F674C5.jPf.exe 2120 N0.R.B7B435CAF5E43F674C5.jPf.exe 2120 N0.R.B7B435CAF5E43F674C5.jPf.exe 5112 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 3368 MicrosoftEdgeUpdate.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2120 wrote to memory of 5112 2120 N0.R.B7B435CAF5E43F674C5.jPf.exe 91 PID 5112 wrote to memory of 4796 5112 MicrosoftEdgeUpdate.exe 92 PID 5112 wrote to memory of 4516 5112 MicrosoftEdgeUpdate.exe 95 PID 4516 wrote to memory of 3104 4516 cmd.exe 97 PID 3104 wrote to memory of 1824 3104 cmd.exe 98 PID 3104 wrote to memory of 1868 3104 cmd.exe 99 PID 3104 wrote to memory of 4624 3104 cmd.exe 100 PID 3104 wrote to memory of 4708 3104 cmd.exe 107 PID 3104 wrote to memory of 3540 3104 cmd.exe 108 PID 3104 wrote to memory of 3160 3104 cmd.exe 109 PID 3104 wrote to memory of 1756 3104 cmd.exe 110 PID 3104 wrote to memory of 3944 3104 cmd.exe 111 PID 3104 wrote to memory of 4248 3104 cmd.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\N0.R.B7B435CAF5E43F674C5.jPf.exe"C:\Users\Admin\AppData\Local\Temp\N0.R.B7B435CAF5E43F674C5.jPf.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\msedgeedge_BITS_6397_8828136983\MicrosoftEdgeUpdate.exe"C:\Users\Admin\AppData\Local\Temp\msedgeedge_BITS_6397_8828136983\MicrosoftEdgeUpdate.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im cmd.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4796
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start "" /B cmd /C C:\Users\Admin\AppData\Local\Temp\5C476F34E5FAC534B7B.BAT3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Windows\SysWOW64\cmd.execmd /C C:\Users\Admin\AppData\Local\Temp\5C476F34E5FAC534B7B.BAT4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq MicrosoftEdgeUpdate.exe"5⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1824
-
-
C:\Windows\SysWOW64\find.exefind /I "MicrosoftEdgeUpdate.exe"5⤵
- System Location Discovery: System Language Discovery
PID:1868
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak5⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4624
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq MicrosoftEdgeUpdate.exe"5⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4708
-
-
C:\Windows\SysWOW64\find.exefind /I "MicrosoftEdgeUpdate.exe"5⤵
- System Location Discovery: System Language Discovery
PID:3540
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak5⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3160
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq MicrosoftEdgeUpdate.exe"5⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1756
-
-
C:\Windows\SysWOW64\find.exefind /I "MicrosoftEdgeUpdate.exe"5⤵
- System Location Discovery: System Language Discovery
PID:3944
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak5⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4248
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\msedgeedge_BITS_6397_8828136983\MicrosoftEdgeUpdate.exeC:\Users\Admin\AppData\Local\Temp\msedgeedge_BITS_6397_8828136983\MicrosoftEdgeUpdate.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3368 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 6922⤵
- Program crash
PID:1364
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3368 -ip 33681⤵PID:4860
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\5C476F34E5FAC534B7B.BAT
- Size 868B
- SHA256 b72543a67ed135c51f620dd56a434e7a120313aa5c66d69d37414699ef85e55f
- MD5 4f5374d030707610b47d5155bccf0272
- SHA1 8c492f3f4a9054314c30ffdb69e02b2a60554bde
- SHA512 2ce9d851b52762a7827d5b1a0f13e93658d1f6a2c9b9cbec133dca143b1e6c489d08b56da82eb9e2d5c04e991d7177be61f6d96d2097b60a63a23aa251e4994b
- TLSH T15511244F920B286C07F482B778514E461B99D087E73BA2DC7404DB046F6A94F94C625C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\msedgeedge_BITS_6397_8828136983\MicrosoftEdgeUpdate.exe
- Size 3.3MB
- SHA256 21cf7a17569852a7a4c93ea9faf1478b0a08b9695acf56f10d597e86cac8aed9
- MD5 2a04b878b7aed23b6f4f57edadd05640
- SHA1 08ae250c727837d053ac885af8e50aba3ecfb3eb
- SHA512 b1f3dacfe5c6275b784041dffa5cdff01c5c5cae096c40d1d053fbb6aad0fafb82075547bfe01e9d5715270c6a7e24bdfe10d1d5bb3de30356c07cc72a1a43bc
- SSDEEP 98304:Qk9yOBk37FkF8V7LtHDasmr5SjmPvh3C1m6rxZ3v4uW+iY:QyuCsxy53gmWZ3v4uW+iY
- TLSH T18CF59D21B6C29077D97226304D5AA739A2BEEE702B3542C752943F783D346D229353BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\msedgeedge_BITS_6397_8828136983\PDFCore8.dll
- Size 3.2MB
- SHA256 e5a5f76a2176371dc4e354a3aba5bbb552ed7d97601f66a705ca307c6e6b1c44
- MD5 2ef323a3b4577637ecd726353494df90
- SHA1 e0c6628ed46d687f92ee903758b3ca92520053bb
- SHA512 f29cb608017adcdea1159a2b07191106b534a3da484a22f86df7c49b76553dd8c1b77ec4230ac48dfb84f583b988ad7b26af30bf62590da5781ee8507e345a9c
- SSDEEP 98304:FTg4I76SwIlEk7QiEFDriAPEHwBVjBRnIO6glF+npe:FTA6IlKNFDriAPNB6TglFV
- TLSH T18EF5CF11BA9C407BE16F06705A09B6AAF2FCB92007F580D7F2D0D62C797E48259257EF
- MD5 SHA1 SHA512 SSDEEP TLSH