| File name: | MicrosoftEdgeSetup.exe |
| Full analysis: | https://app.any.run/tasks/8a10827e-e00a-4715-8a90-3774d1ce74a5 |
| Verdict: | Malicious activity |
| Analysis date: | December 31, 2024, 09:29:43 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections |
| MD5: | F1FE3E60229CEDB3701159A5A296ABC9 |
| SHA1: | BF77EDDE7C16D0AF3CF75612DBC2023BB49FE52F |
| SHA256: | 3E47FBC7E0BE6662F8E53FF4E3818E9DDF7330E90B1C37CB1AA7D9087559EA8E |
| SSDEEP: | 49152:vTOFoz6EUfZ/Oyvib0ecH8gMytm4Wo0khNsWlEF5CTOmBG2KPtjJb8wDyzHHCm/p:vhznUh/c0eq3Mytm4WoNY+AoOUGjXmiC |
MALICIOUS
No malicious indicators.SUSPICIOUS
Starts a Microsoft application from unusual location
- MicrosoftEdgeSetup.exe (PID: 5540)
- MicrosoftEdgeUpdate.exe (PID: 6212)
- MicrosoftEdgeUpdateSetup.exe (PID: 6400)
Reads security settings of Internet Explorer
- MicrosoftEdgeUpdate.exe (PID: 6212)
- MicrosoftEdgeUpdate.exe (PID: 6492)
Disables SEHOP
- MicrosoftEdgeUpdate.exe (PID: 6492)
Executable content was dropped or overwritten
- MicrosoftEdgeSetup.exe (PID: 5540)
- MicrosoftEdgeUpdateSetup.exe (PID: 6400)
Process drops legitimate windows executable
- MicrosoftEdgeSetup.exe (PID: 5540)
- MicrosoftEdgeUpdateSetup.exe (PID: 6400)
- MicrosoftEdgeUpdate.exe (PID: 6492)
INFO
The sample compiled with english language support
- MicrosoftEdgeSetup.exe (PID: 5540)
- MicrosoftEdgeUpdate.exe (PID: 6492)
- MicrosoftEdgeUpdateSetup.exe (PID: 6400)
Checks supported languages
- MicrosoftEdgeSetup.exe (PID: 5540)
- MicrosoftEdgeUpdate.exe (PID: 6212)
- MicrosoftEdgeUpdate.exe (PID: 6492)
- MicrosoftEdgeUpdateSetup.exe (PID: 6400)
Create files in a temporary directory
- MicrosoftEdgeUpdate.exe (PID: 6212)
- MicrosoftEdgeSetup.exe (PID: 5540)
Process checks computer location settings
- MicrosoftEdgeUpdate.exe (PID: 6212)
- MicrosoftEdgeUpdate.exe (PID: 6492)
Checks proxy server information
- MicrosoftEdgeUpdate.exe (PID: 6492)
Reads Environment values
- MicrosoftEdgeUpdate.exe (PID: 6492)
Reads the computer name
- MicrosoftEdgeUpdate.exe (PID: 6212)
- MicrosoftEdgeUpdate.exe (PID: 6492)
Creates files in the program directory
- MicrosoftEdgeUpdateSetup.exe (PID: 6400)
Reads the software policy settings
- MicrosoftEdgeUpdate.exe (PID: 6492)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win64 Executable (generic) (76.4) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (12.4) |
| .exe | | | Generic Win/DOS Executable (5.5) |
| .exe | | | DOS Executable Generic (5.5) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2024:12:17 19:06:15+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 14.31 |
| CodeSize: | 110592 |
| InitializedDataSize: | 1532416 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x83f0 |
| OSVersion: | 5.1 |
| ImageVersion: | - |
| SubsystemVersion: | 5.1 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.3.195.43 |
| ProductVersionNumber: | 1.3.195.43 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Windows NT 32-bit |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Unicode |
| CompanyName: | Microsoft Corporation |
| FileDescription: | Microsoft Edge Update Setup |
| FileVersion: | 1.3.195.43 |
| InternalName: | Microsoft Edge Update Setup |
| LegalCopyright: | Copyright Microsoft Corporation |
| OriginalFileName: | MicrosoftEdgeUpdateSetup.exe |
| ProductName: | Microsoft Edge Update |
| ProductVersion: | 1.3.195.43 |
| UpstreamVersion: | 1.3.99.0 |
| LanguageId: | en |
Total processes
132
Monitored processes
4
Malicious processes
4
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 5540 | "C:\Users\admin\AppData\Local\Temp\MicrosoftEdgeSetup.exe" | C:\Users\admin\AppData\Local\Temp\MicrosoftEdgeSetup.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Update Setup Version: 1.3.195.43 Modules
| |||||||||||||||
| 6212 | C:\Users\admin\AppData\Local\Temp\EU5305.tmp\MicrosoftEdgeUpdate.exe /installsource taggedmi /install "appguid={56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}&appname=Microsoft%20Edge&needsadmin=prefers&lang=pl&brand=M100" | C:\Users\admin\AppData\Local\Temp\EU5305.tmp\MicrosoftEdgeUpdate.exe | — | MicrosoftEdgeSetup.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Update Version: 1.3.195.43 Modules
| |||||||||||||||
| 6400 | "C:\Users\admin\AppData\Local\Temp\EU5305.tmp\MicrosoftEdgeUpdateSetup.exe" /installsource taggedmi /install "appguid={56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}&appname=Microsoft%20Edge&needsadmin=prefers&lang=pl&brand=M100" /installelevated /nomitag | C:\Users\admin\AppData\Local\Temp\EU5305.tmp\MicrosoftEdgeUpdateSetup.exe | MicrosoftEdgeUpdate.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft Edge Update Setup Version: 1.3.195.43 Modules
| |||||||||||||||
| 6492 | "C:\Program Files (x86)\Microsoft\Temp\EU5B81.tmp\MicrosoftEdgeUpdate.exe" /installsource taggedmi /install "appguid={56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}&appname=Microsoft%20Edge&needsadmin=prefers&lang=pl&brand=M100" /installelevated | C:\Program Files (x86)\Microsoft\Temp\EU5B81.tmp\MicrosoftEdgeUpdate.exe | MicrosoftEdgeUpdateSetup.exe | ||||||||||||
User: admin Integrity Level: HIGH Modules
| |||||||||||||||
Total events
1 198
Read events
1 193
Write events
4
Delete events
1
Modification events
| (PID) Process: | (6492) MicrosoftEdgeUpdate.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\PersistedPings\{5FFBD15E-7A8D-4683-9518-3C6997E602E3} |
| Operation: | write | Name: | PersistedPingString |
Value: <?xml version="1.0" encoding="UTF-8"?><request protocol="3.0" updater="Omaha" updaterversion="1.3.195.43" shell_version="1.3.147.37" ismachine="1" sessionid="{8412EC25-FC38-4C5F-859C-BE3E02DCC275}" userid="{FD984739-A122-4DB0-BE5B-46E3E09D84E4}" installsource="taggedmi" requestid="{5FFBD15E-7A8D-4683-9518-3C6997E602E3}" dedup="cr" domainjoined="0"><hw logical_cpus="4" physmemory="4" disk_type="2" sse="1" sse2="1" sse3="1" ssse3="1" sse41="1" sse42="1" avx="1"/><os platform="win" version="10.0.19045.4046" sp="" arch="x64" product_type="48" is_wip="0" is_in_lockdown_mode="0"/><oem product_manufacturer="DELL" product_name="DELL"/><exp etag=""r452t1+k2Tgq/HXzjvFNBRhopBWR9sbjXxqeUDH9uX0=""/><app appid="{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" version="1.3.185.17" nextversion="1.3.195.43" lang="pl" brand="M100" client=""><event eventtype="2" eventresult="1" errorcode="0" extracode1="0" system_uptime_ticks="12708085024" install_time_ms="766"/></app></request> | |||
| (PID) Process: | (6492) MicrosoftEdgeUpdate.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\PersistedPings\{5FFBD15E-7A8D-4683-9518-3C6997E602E3} |
| Operation: | write | Name: | PersistedPingTime |
Value: 133801109930874814 | |||
| (PID) Process: | (6492) MicrosoftEdgeUpdate.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe |
| Operation: | write | Name: | DisableExceptionChainValidation |
Value: 0 | |||
| (PID) Process: | (6492) MicrosoftEdgeUpdate.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\PersistedPings\{5FFBD15E-7A8D-4683-9518-3C6997E602E3} |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (6492) MicrosoftEdgeUpdate.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\proxy |
| Operation: | write | Name: | source |
Value: auto | |||
Executable files
300
Suspicious files
0
Text files
3
Unknown types
3
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5540 | MicrosoftEdgeSetup.exe | C:\Users\admin\AppData\Local\Temp\EU5305.tmp\msedgeupdate.dll | executable | |
MD5:40CD707DD3011A9845FF9C42256EA7E3 | SHA256:9F4C7072716E0BE1BE08207A7024A5E41162E288E677D805BE8E5469A8BD4909 | |||
| 5540 | MicrosoftEdgeSetup.exe | C:\Users\admin\AppData\Local\Temp\EU5305.tmp\psmachine.dll | executable | |
MD5:6708BC8A0A25C258EC65FCA66D7B64CE | SHA256:810796F10921B714F9AE42F97B3E601DCCB1F9B27E0C5CF59C7BA46C2FAACF19 | |||
| 5540 | MicrosoftEdgeSetup.exe | C:\Users\admin\AppData\Local\Temp\EU5305.tmp\MicrosoftEdgeUpdateBroker.exe | executable | |
MD5:E5DE2B67B2B629859949DB28D614FAAB | SHA256:8C86A415557DA686214675A02A94964F07C2166C811C61542776F4BF920555CA | |||
| 5540 | MicrosoftEdgeSetup.exe | C:\Users\admin\AppData\Local\Temp\EU5305.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe | executable | |
MD5:714C34FE6098B45A3303C611C4323EAE | SHA256:FBF495968C4A385FF0790E6B65D26610EF917A2B36A5387EFF7AE79D7A980AC5 | |||
| 5540 | MicrosoftEdgeSetup.exe | C:\Users\admin\AppData\Local\Temp\EU5305.tmp\MicrosoftEdgeComRegisterShellARM64.exe | executable | |
MD5:8F7C44E937ECC243D05EAB5BB218440B | SHA256:BC3CDD57A892CE1841787061E23E526AD46575460CD66C1DC6DCF0F811563D59 | |||
| 5540 | MicrosoftEdgeSetup.exe | C:\Users\admin\AppData\Local\Temp\EU5305.tmp\MicrosoftEdgeUpdateOnDemand.exe | executable | |
MD5:A8652F75AD0579D14FB45BB5A6C98D23 | SHA256:E41E92F37BFDE77799E947FCE1D6E9378B4C53FB4B86905F64622691C30AD1E5 | |||
| 5540 | MicrosoftEdgeSetup.exe | C:\Users\admin\AppData\Local\Temp\EU5305.tmp\psmachine_64.dll | executable | |
MD5:886D71AA7EA1C34644AA759FB5A09B5F | SHA256:95D1B924759B36FBD2A20682E919392D64DC8C1B153F909F921DA7E57825A04C | |||
| 5540 | MicrosoftEdgeSetup.exe | C:\Users\admin\AppData\Local\Temp\EU5305.tmp\psmachine_arm64.dll | executable | |
MD5:EC69BFAF00836707975CC8ADB1E8F000 | SHA256:744860280846486104FFFECF012F1502F024B142FC3FCE17BCA581B7D50DAAF0 | |||
| 5540 | MicrosoftEdgeSetup.exe | C:\Users\admin\AppData\Local\Temp\EU5305.tmp\psuser_arm64.dll | executable | |
MD5:468C6DAED548F7D1D446F84ABCE85BBA | SHA256:01E37D6A07318D67CE22A898B52E3EED6AE990520303D2E36446B34255D298B0 | |||
| 5540 | MicrosoftEdgeSetup.exe | C:\Users\admin\AppData\Local\Temp\EU5305.tmp\psuser.dll | executable | |
MD5:4D098B6708E7541822F5D86850123184 | SHA256:268A400839417FB510D79DD0B6ED665AFD27493963F9DD36A306D14180BEA872 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
34
DNS requests
20
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 2.23.181.156:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.32.238.112:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
1176 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
3552 | SIHClient.exe | GET | 200 | 2.23.181.156:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
5604 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
3552 | SIHClient.exe | GET | 200 | 2.23.181.156:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 192.168.100.255:137 | — | — | — | whitelisted |
5448 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4712 | MoUsoCoreWorker.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 23.32.238.112:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
— | — | 2.23.181.156:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
5064 | SearchApp.exe | 2.21.110.146:443 | www.bing.com | AKAMAI-AS | DE | whitelisted |
— | — | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1176 | svchost.exe | 20.190.159.64:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
www.bing.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
login.live.com |
| whitelisted |
go.microsoft.com |
| whitelisted |
config.edge.skype.com |
| whitelisted |
arc.msn.com |
| whitelisted |