File name:

MicrosoftEdgeSetup.exe

Full analysis: https://app.any.run/tasks/0c9ed50a-c1a6-406b-b5fa-c3dfa12f8058
Verdict: Malicious activity
Analysis date: July 18, 2024, 12:56:13
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

1C4A0ABD5C6D501A6964E65A0AD3C924

SHA1:

4D43C443FC747927F10CC9F5A97C7B815C87B910

SHA256:

9EE508D6E739C6DEF5E6296E2BCA699230152EA288FBC905E0CC41A7B9D82156

SSDEEP:

49152:STKFeRrDnX1sf/R3bG7XIlh/ABX3omDzwgNdFytxmtjBb3Cu8nKkFohZqGW0QPWn:SRRrDnX1sfZ3bG7XILYBnvg2jl3b8KkK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • MicrosoftEdgeUpdateSetup.exe (PID: 7580)
      • MicrosoftEdgeSetup.exe (PID: 5272)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • MicrosoftEdgeSetup.exe (PID: 5272)
      • MicrosoftEdgeUpdateSetup.exe (PID: 7580)
      • MicrosoftEdgeUpdate.exe (PID: 8052)

    • Executable content was dropped or overwritten

      • MicrosoftEdgeSetup.exe (PID: 5272)
      • MicrosoftEdgeUpdateSetup.exe (PID: 7580)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeUpdate.exe (PID: 7900)
      • MicrosoftEdgeSetup.exe (PID: 5272)
      • MicrosoftEdgeUpdate.exe (PID: 8052)
      • MicrosoftEdgeUpdateSetup.exe (PID: 7580)

    • Reads the date of Windows installation

      • MicrosoftEdgeUpdate.exe (PID: 7900)
      • MicrosoftEdgeUpdate.exe (PID: 8052)

    • Reads security settings of Internet Explorer

      • MicrosoftEdgeUpdate.exe (PID: 7900)
      • MicrosoftEdgeUpdate.exe (PID: 8052)

    • Disables SEHOP

      • MicrosoftEdgeUpdate.exe (PID: 8052)

    • Creates a software uninstall entry

      • MicrosoftEdgeUpdate.exe (PID: 8052)

  • INFO

    • Checks supported languages

      • MicrosoftEdgeSetup.exe (PID: 5272)
      • MicrosoftEdgeUpdate.exe (PID: 7900)
      • MicrosoftEdgeUpdateSetup.exe (PID: 7580)
      • MicrosoftEdgeUpdate.exe (PID: 8052)

    • Create files in a temporary directory

      • MicrosoftEdgeUpdate.exe (PID: 7900)
      • MicrosoftEdgeSetup.exe (PID: 5272)

    • Reads the computer name

      • MicrosoftEdgeUpdate.exe (PID: 7900)
      • MicrosoftEdgeUpdate.exe (PID: 8052)

    • Creates files in the program directory

      • MicrosoftEdgeUpdateSetup.exe (PID: 7580)

    • Checks proxy server information

      • MicrosoftEdgeUpdate.exe (PID: 8052)

    • Reads Environment values

      • MicrosoftEdgeUpdate.exe (PID: 8052)

    • Reads the software policy settings

      • MicrosoftEdgeUpdate.exe (PID: 8052)

    • Process checks computer location settings

      • MicrosoftEdgeUpdate.exe (PID: 8052)
      • MicrosoftEdgeUpdate.exe (PID: 7900)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:07:03 17:47:25+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.31
CodeSize: 110592
InitializedDataSize: 1523200
UninitializedDataSize: -
EntryPoint: 0x83f0
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 1.3.193.5
ProductVersionNumber: 1.3.193.5
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Microsoft Edge Update Setup
FileVersion: 1.3.193.5
InternalName: Microsoft Edge Update Setup
LegalCopyright: Copyright Microsoft Corporation
OriginalFileName: MicrosoftEdgeUpdateSetup.exe
ProductName: Microsoft Edge Update
ProductVersion: 1.3.193.5
UpstreamVersion: 1.3.99.0
LanguageId: en
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
122
Monitored processes
5
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start microsoftedgesetup.exe microsoftedgeupdate.exe no specs microsoftedgeupdatesetup.exe microsoftedgeupdate.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
5272"C:\Users\admin\AppData\Local\Temp\MicrosoftEdgeSetup.exe" C:\Users\admin\AppData\Local\Temp\MicrosoftEdgeSetup.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update Setup
Version:
1.3.193.5
Modules
Images
c:\users\admin\appdata\local\temp\microsoftedgesetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
7580"C:\Users\admin\AppData\Local\Temp\EUA1FB.tmp\MicrosoftEdgeUpdateSetup.exe" /installsource taggedmi /install "appguid={56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}&appname=Microsoft%20Edge&needsadmin=prefers&usagestats=0" /installelevated /nomitagC:\Users\admin\AppData\Local\Temp\EUA1FB.tmp\MicrosoftEdgeUpdateSetup.exe
MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Update Setup
Version:
1.3.193.5
Modules
Images
c:\users\admin\appdata\local\temp\eua1fb.tmp\microsoftedgeupdatesetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
7900C:\Users\admin\AppData\Local\Temp\EUA1FB.tmp\MicrosoftEdgeUpdate.exe /installsource taggedmi /install "appguid={56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}&appname=Microsoft%20Edge&needsadmin=prefers&usagestats=0"C:\Users\admin\AppData\Local\Temp\EUA1FB.tmp\MicrosoftEdgeUpdate.exe—MicrosoftEdgeSetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Version:
1.3.193.5
Modules
Images
c:\users\admin\appdata\local\temp\eua1fb.tmp\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
7976C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
8052"C:\Program Files (x86)\Microsoft\Temp\EUADB3.tmp\MicrosoftEdgeUpdate.exe" /installsource taggedmi /install "appguid={56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}&appname=Microsoft%20Edge&needsadmin=prefers&usagestats=0" /installelevatedC:\Program Files (x86)\Microsoft\Temp\EUADB3.tmp\MicrosoftEdgeUpdate.exe
MicrosoftEdgeUpdateSetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Update
Version:
1.3.193.5
Modules
Images
c:\program files (x86)\microsoft\temp\euadb3.tmp\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
Total events
5 762
Read events
5 731
Write events
21
Delete events
10

Modification events

(PID) Process:(8052) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:writeName:consentcommunicated
Value:
0
(PID) Process:(8052) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:writeName:usagestats
Value:
0
(PID) Process:(8052) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:writeName:urlstats
Value:
0
(PID) Process:(8052) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:delete valueName:usagestats
Value:
(PID) Process:(8052) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:delete valueName:urlstats
Value:
(PID) Process:(8052) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate
Operation:delete valueName:eulaaccepted
Value:
(PID) Process:(8052) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate
Operation:writeName:path
Value:
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
(PID) Process:(8052) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate
Operation:writeName:UninstallCmdLine
Value:
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /uninstall
(PID) Process:(8052) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
Operation:writeName:pv
Value:
1.3.193.5
(PID) Process:(8052) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
Operation:writeName:name
Value:
Microsoft Edge Update
Executable files
300
Suspicious files
3
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
5272MicrosoftEdgeSetup.exeC:\Users\admin\AppData\Local\Temp\EUA1FB.tmp\MicrosoftEdgeComRegisterShellARM64.exeexecutable
MD5:5679308B2E276BD371798AC8D579B1F9
SHA256:C9AEF2D24F1C77A366B327B869E4103ED8276EA83B2B40942718CC134A1E122F
5272MicrosoftEdgeSetup.exeC:\Users\admin\AppData\Local\Temp\EUA1FB.tmp\psuser_64.dllexecutable
MD5:A89808BFD9091ED531EA5F5C5C2FC232
SHA256:D801F2ABD497EF3B03A32B1FA06B397C81CBA71BE7A5C6FBDB183D922E237924
5272MicrosoftEdgeSetup.exeC:\Users\admin\AppData\Local\Temp\EUA1FB.tmp\NOTICE.TXTtext
MD5:6DD5BF0743F2366A0BDD37E302783BCD
SHA256:91D3FC490565DED7621FF5198960E501B6DB857D5DD45AF2FE7C3ECD141145F5
5272MicrosoftEdgeSetup.exeC:\Users\admin\AppData\Local\Temp\EUA1FB.tmp\psuser_arm64.dllexecutable
MD5:3B226A2484899AFA6DE93A82D9FBCC4F
SHA256:6D64BDADFF5F3216753E737D4E19A09A00B19D80403172675041E903EA5C2DF4
5272MicrosoftEdgeSetup.exeC:\Users\admin\AppData\Local\Temp\EUA1FB.tmp\psmachine_64.dllexecutable
MD5:447D4FD7B37ABB43501AA13F7FD25750
SHA256:3A84348804AEFBE6172F53EAFBE0D87D29DC6F42EA050E68F1D31385384BD72C
5272MicrosoftEdgeSetup.exeC:\Users\admin\AppData\Local\Temp\EUA1FB.tmp\MicrosoftEdgeUpdateBroker.exeexecutable
MD5:4E1BED27BAFAA6F0A9B6B6B1481A76AE
SHA256:868D178EF15F87DF290A4D06DBD7B72F3A1B6E0F2C680D67045AD6051C7DC1E6
5272MicrosoftEdgeSetup.exeC:\Users\admin\AppData\Local\Temp\EUA1FB.tmp\MicrosoftEdgeUpdate.exeexecutable
MD5:090901EBEFC233CC46D016AF98BE6D53
SHA256:7864BB95EB14E0AE1C249759CB44AD746E448007563B7430911755CF17EA5A77
5272MicrosoftEdgeSetup.exeC:\Users\admin\AppData\Local\Temp\EUA1FB.tmp\MicrosoftEdgeUpdateComRegisterShell64.exeexecutable
MD5:8428E306E866FE7972F05B6BE814C1CF
SHA256:855E2F2FAB4968261704CAB9BAE294FB7EC8B9C26E4D1708E29E26C454C7B0AF
5272MicrosoftEdgeSetup.exeC:\Users\admin\AppData\Local\Temp\EUA1FB.tmp\MicrosoftEdgeUpdateOnDemand.exeexecutable
MD5:1ECF8A13497BBC34FC1CF2C7C2DAC9B0
SHA256:8BC7B53FFF82E9BE925BD28FE4F093039CAE5990F203B2EDB4F3C072408412F6
5272MicrosoftEdgeSetup.exeC:\Users\admin\AppData\Local\Temp\EUA1FB.tmp\msedgeupdateres_ar.dllexecutable
MD5:61C48F913B2502E56168CDF475D4766A
SHA256:8FD703A50D9CB19E9249CF4A4409DA71104C6A16475B9725306CD13C260CEFD1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
13
DNS requests
6
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4716
svchost.exe
20.190.159.68:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5460
backgroundTaskHost.exe
20.223.36.55:443
fd.api.iris.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7856
svchost.exe
4.209.32.67:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
2760
svchost.exe
40.113.110.67:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
8052
MicrosoftEdgeUpdate.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3352
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4716
svchost.exe
20.190.159.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
login.live.com
  • 20.190.159.68
  • 20.190.159.0
  • 40.126.31.67
  • 40.126.31.71
  • 20.190.159.64
  • 20.190.159.4
  • 20.190.159.23
  • 20.190.159.2
whitelisted
google.com
  • 172.217.18.14
whitelisted
fd.api.iris.microsoft.com
  • 20.223.36.55
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted
licensing.mp.microsoft.com
  • 4.209.32.198
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
MicrosoftEdgeSetup.exe