893dda821577ff29094bee88e418cde19ebc85d5127234083a2163c3eb9dc619

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/06/2026, 13:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
msedge_elf.dll
Size 492KB
Sample260605-p9tkjaf14x
SHA256 893dda821577ff29094bee88e418cde19ebc85d5127234083a2163c3eb9dc619
MD5 267ff522c58341a7fe4bdbd5383c8b5c
SHA1 ef96e6cfac620643dac6d33a13fe9c76b3e4c22c
SHA512 b972543894a84d1255d7dcd865abeec48b8ba3c4237615d742cccd4468aee4899cafb9d20c06badd49c691ef478ef8ca19375b862955d896e95f9ca9bc24cdc8
SSDEEP 6144:KNEgz2i1ESxK99+zkrh6RN++bZWNne6UGXUaL53SSJgj:6En99h6RNBbZGe6UGE2hY
TLSH
T1A0B4AE06B7A449A9E0ABC5788A538547DB7578520F60E6CF03E0E2393E77BE05B3E315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	2008	rundll32.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
364	Mixed Reality.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Media Player\msedge_elf.dll	rundll32.exe
File created	C:\Program Files\Windows Media Player\Mixed Reality.exe	rundll32.exe
File opened for modification	C:\Program Files\Windows Media Player\Mixed Reality.exe	rundll32.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	\??\c:\windows\background.jpg	rundll32.exe
File opened for modification	\??\c:\windows\background.jpg	rundll32.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2880	sc.exe
4596	sc.exe
4268	sc.exe
4404	sc.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1432	2008	rundll32.exe	89
PID 1432 wrote to memory of 2880	1432	cmd.exe	91
PID 2008 wrote to memory of 3296	2008	rundll32.exe	92
PID 3296 wrote to memory of 4596	3296	cmd.exe	94
PID 2008 wrote to memory of 4984	2008	rundll32.exe	95
PID 4984 wrote to memory of 4268	4984	cmd.exe	97
PID 2008 wrote to memory of 1112	2008	rundll32.exe	98
PID 1112 wrote to memory of 4404	1112	cmd.exe	102

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\msedge_elf.dll,#1
1⤵
- Badlisted process makes network request
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2008
- \??\c:\windows\system32\cmd.exe
  cmd /c sc delete mixedsvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1432
- - C:\Windows\system32\sc.exe
    sc delete mixedsvc
    3⤵
    - Launches sc.exe
    PID:2880
- \??\c:\windows\system32\cmd.exe
  cmd /c sc create MixedSvc binPath= "C:\Program Files\Windows Media Player\Mixed Reality.exe" start= auto displayname= "Windows Mixed Reality Service"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3296
- - C:\Windows\system32\sc.exe
    sc create MixedSvc binPath= "C:\Program Files\Windows Media Player\Mixed Reality.exe" start= auto displayname= "Windows Mixed Reality Service"
    3⤵
    - Launches sc.exe
    PID:4596
- \??\c:\windows\system32\cmd.exe
  cmd /c sc description MixedSvc "Manager the Mixed Reality functionality"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Windows\system32\sc.exe
    sc description MixedSvc "Manager the Mixed Reality functionality"
    3⤵
    - Launches sc.exe
    PID:4268
- \??\c:\windows\system32\cmd.exe
  cmd /c sc start MixedSvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1112
- - C:\Windows\system32\sc.exe
    sc start MixedSvc
    3⤵
    - Launches sc.exe
    PID:4404

C:\Program Files\Windows Media Player\Mixed Reality.exe
"C:\Program Files\Windows Media Player\Mixed Reality.exe"
1⤵
- Executes dropped EXE
PID:364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

Mixed Reality.exe

Path C:\Program Files\Windows Media Player\Mixed Reality.exe
Size 70KB
SHA256 b53f3c0cd32d7f20849850768da6431e5f876b7bfa61db0aa0700b02873393fa
MD5 ef3179d498793bf4234f708d3be28633
SHA1 dd399ae46303343f9f0da189aee11c67bd868222
SHA512 02aff154762d7e53e37754f878ce6aa3f4df5a1eb167e27f13d9762dced32bec892bfa3f3314e3c6dce5998f7d3c400d7d0314b9326eedcab72207c60b3d332e
SSDEEP 1536:J8qpnO/qRUNReI3fu6Uw2mTARPw2cm+YRQln5IUmDjoX:C/YUNRBfukTreXRQln5I
TLSH
T16B630BC9A66460F4E077953444734E099272BC22D7625ADF54F0F17C0FF36E0A93AAAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background.jpg

Path C:\Windows\background.jpg
Size 3.0MB
SHA256 ce2cccb3e3a7ccf3c468234b7d2b56c16047f9cb6e466d06eed66803e7a669ae
MD5 f1cc44b77440955677f24fcb7653848b
SHA1 dd270cb572a59426e62adadd06c3cb408c6ae6f1
SHA512 11c443cd1a519aace42d2fcb1979a98fe59f87dd062ee7686abc438f044f7745538afaa22f684fb4c8996f86f0619ab6910e8fbff1527e66e40ccf4950e81813
SSDEEP 49152:PbyrWaL8o/+gsmvnQTkKoMSqUPi5x9wHMJGgylpynSJaTw/Ur:PbyrWal+g94oLqUK5TwHMJ4YTw/U
TLSH
T13FE5239E7192985EFCCAD07204BD1B07D7994AFDA72A23102C02BD473EB92B1467C46F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2008-4-0x0000019D0AA30000-0x0000019D0AA55000-memory.dmp

Download

memory/2008-3-0x0000019D0AA30000-0x0000019D0AA55000-memory.dmp

Download

memory/2008-2-0x0000019D0AA30000-0x0000019D0AA55000-memory.dmp

Download

memory/2008-6-0x0000019D0AA30000-0x0000019D0AA55000-memory.dmp

Download

memory/2008-1-0x0000019D0AA30000-0x0000019D0AA55000-memory.dmp

Download

memory/2008-7-0x00007FFF685B0000-0x00007FFF68879000-memory.dmp

Download

memory/2008-0-0x0000019D0AA30000-0x0000019D0AA55000-memory.dmp

Download

memory/2008-16-0x0000019D0AA30000-0x0000019D0AA55000-memory.dmp

Download

memory/2008-18-0x00007FFF685B0000-0x00007FFF68879000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads