| File name: | updater.exe |
| Full analysis: | https://app.any.run/tasks/1768ffcc-718d-4bd6-968f-33bd2ab63f06 |
| Verdict: | Malicious activity |
| Analysis date: | September 02, 2024, 23:16:05 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows |
| MD5: | 75E19AFDB259257CB7C02AD30499B796 |
| SHA1: | 92873A08A79556E4E0DFC8C2DD7F74344E8F7A54 |
| SHA256: | A3C7B289054635F5239D453FB4BE718298037EA6C1F4BF16954AF1E9DA2A53E2 |
| SSDEEP: | 196608:3GQczpIn4hFYBWNsPxbVMPzxOuUtZlbUidWHS:3GbzpILWaJOzxOuO |
MALICIOUS
No malicious indicators.SUSPICIOUS
Starts a Microsoft application from unusual location
- MicrosoftEdgeWebview2Setup.exe (PID: 6016)
- MicrosoftEdgeUpdate.exe (PID: 7100)
- MicrosoftEdgeUpdate.exe (PID: 4276)
- MicrosoftEdgeUpdateSetup.exe (PID: 2028)
Process drops legitimate windows executable
- updater.exe (PID: 2580)
- MicrosoftEdgeWebview2Setup.exe (PID: 6016)
- MicrosoftEdgeUpdateSetup.exe (PID: 2028)
- MicrosoftEdgeUpdate.exe (PID: 4276)
Executable content was dropped or overwritten
- updater.exe (PID: 2580)
- MicrosoftEdgeWebview2Setup.exe (PID: 6016)
- MicrosoftEdgeUpdateSetup.exe (PID: 2028)
Reads the date of Windows installation
- MicrosoftEdgeUpdate.exe (PID: 7100)
- MicrosoftEdgeUpdate.exe (PID: 4276)
Reads security settings of Internet Explorer
- MicrosoftEdgeUpdate.exe (PID: 4276)
- MicrosoftEdgeUpdate.exe (PID: 7100)
Disables SEHOP
- MicrosoftEdgeUpdate.exe (PID: 4276)
Creates a software uninstall entry
- MicrosoftEdgeUpdate.exe (PID: 4276)
There is functionality for VM detection (antiVM strings)
- updater.exe (PID: 2580)
INFO
Reads Environment values
- updater.exe (PID: 2580)
- MicrosoftEdgeUpdate.exe (PID: 4276)
- MicrosoftEdgeUpdate.exe (PID: 7100)
Create files in a temporary directory
- updater.exe (PID: 2580)
- MicrosoftEdgeUpdate.exe (PID: 7100)
- MicrosoftEdgeUpdate.exe (PID: 4276)
- MicrosoftEdgeWebview2Setup.exe (PID: 6016)
Reads the machine GUID from the registry
- updater.exe (PID: 2580)
- MicrosoftEdgeUpdate.exe (PID: 7100)
Reads the computer name
- updater.exe (PID: 2580)
- MicrosoftEdgeUpdate.exe (PID: 7100)
- MicrosoftEdgeUpdate.exe (PID: 4276)
Checks supported languages
- MicrosoftEdgeUpdate.exe (PID: 7100)
- MicrosoftEdgeWebview2Setup.exe (PID: 6016)
- MicrosoftEdgeUpdateSetup.exe (PID: 2028)
- MicrosoftEdgeUpdate.exe (PID: 4276)
- updater.exe (PID: 2580)
Process checks computer location settings
- MicrosoftEdgeUpdate.exe (PID: 7100)
- MicrosoftEdgeUpdate.exe (PID: 4276)
Reads the software policy settings
- wermgr.exe (PID: 6832)
- wermgr.exe (PID: 5732)
Creates files in the program directory
- MicrosoftEdgeUpdateSetup.exe (PID: 2028)
- MicrosoftEdgeUpdate.exe (PID: 7100)
Checks proxy server information
- wermgr.exe (PID: 6832)
- wermgr.exe (PID: 5732)
UPX packer has been detected
- updater.exe (PID: 2580)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win64 Executable (generic) (87.3) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (6.3) |
| .exe | | | DOS Executable Generic (6.3) |
EXIF
EXE
| MachineType: | AMD AMD64 |
|---|---|
| TimeStamp: | 0000:00:00 00:00:00 |
| ImageFileCharacteristics: | Executable, No line numbers, No symbols, Large address aware, No debug |
| PEType: | PE32+ |
| LinkerVersion: | 2.41 |
| CodeSize: | 28923392 |
| InitializedDataSize: | 81634304 |
| UninitializedDataSize: | 722944 |
| EntryPoint: | 0x13e0 |
| OSVersion: | 6.1 |
| ImageVersion: | - |
| SubsystemVersion: | 6.1 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 2.4.5.0 |
| ProductVersionNumber: | 2.4.5.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Windows NT 32-bit |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Unicode |
| Comments: | Tool that helps update your browser |
| CompanyName: | Browser Update Tool |
| FileDescription: | Tool that helps update your browser |
| FileVersion: | 2.4.5.0 |
| InternalName: | Browser Update Tool |
| LegalCopyright: | All rights reserved |
| LegalTrademarks: | Browser Update Tool LLC |
| OriginalFileName: | update.exe |
| PrivateBuild: | update.exe |
| ProductName: | Browser Update Tool |
| ProductVersion: | 2.4.5.0 |
| SpecialBuild: | update.exe |
Total processes
130
Monitored processes
7
Malicious processes
5
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2028 | "C:\Users\admin\AppData\Local\Temp\EUE373.tmp\MicrosoftEdgeUpdateSetup.exe" /installsource taggedmi /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=true" /installelevated /nomitag | C:\Users\admin\AppData\Local\Temp\EUE373.tmp\MicrosoftEdgeUpdateSetup.exe | MicrosoftEdgeUpdate.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft Edge Update Setup Exit code: 2147747592 Version: 1.3.143.57 Modules
| |||||||||||||||
| 2580 | "C:\Users\admin\AppData\Local\Temp\updater.exe" | C:\Users\admin\AppData\Local\Temp\updater.exe | explorer.exe | ||||||||||||
User: admin Company: Browser Update Tool Integrity Level: MEDIUM Description: Tool that helps update your browser Exit code: 2 Version: 2.4.5.0 Modules
| |||||||||||||||
| 4276 | "C:\Program Files (x86)\Microsoft\Temp\EUEBCF.tmp\MicrosoftEdgeUpdate.exe" /installsource taggedmi /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=true" /installelevated | C:\Program Files (x86)\Microsoft\Temp\EUEBCF.tmp\MicrosoftEdgeUpdate.exe | — | MicrosoftEdgeUpdateSetup.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft Edge Update Exit code: 2147747592 Version: 1.3.143.57 Modules
| |||||||||||||||
| 5732 | "C:\WINDOWS\system32\wermgr.exe" "-outproc" "0" "7100" "1260" "1576" "768" "0" "0" "0" "0" "0" "0" "0" "0" | C:\Windows\SysWOW64\wermgr.exe | MicrosoftEdgeUpdate.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Problem Reporting Exit code: 0 Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6016 | C:\Users\admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe | C:\Users\admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe | updater.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Update Setup Exit code: 2147747592 Version: 1.3.143.57 Modules
| |||||||||||||||
| 6832 | "C:\WINDOWS\system32\wermgr.exe" "-outproc" "0" "4276" "728" "1404" "1408" "0" "0" "0" "0" "0" "0" "0" "0" | C:\Windows\SysWOW64\wermgr.exe | MicrosoftEdgeUpdate.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Problem Reporting Exit code: 0 Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7100 | C:\Users\admin\AppData\Local\Temp\EUE373.tmp\MicrosoftEdgeUpdate.exe /installsource taggedmi /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=true" | C:\Users\admin\AppData\Local\Temp\EUE373.tmp\MicrosoftEdgeUpdate.exe | — | MicrosoftEdgeWebview2Setup.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Update Exit code: 2147747592 Version: 1.3.143.57 Modules
| |||||||||||||||
Total events
13 225
Read events
12 924
Write events
292
Delete events
9
Modification events
| (PID) Process: | (4276) MicrosoftEdgeUpdate.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate |
| Operation: | delete value | Name: | eulaaccepted |
Value: | |||
| (PID) Process: | (4276) MicrosoftEdgeUpdate.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate |
| Operation: | write | Name: | path |
Value: C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | |||
| (PID) Process: | (4276) MicrosoftEdgeUpdate.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate |
| Operation: | write | Name: | UninstallCmdLine |
Value: "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /uninstall | |||
| (PID) Process: | (4276) MicrosoftEdgeUpdate.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A} |
| Operation: | write | Name: | pv |
Value: 1.3.143.57 | |||
| (PID) Process: | (4276) MicrosoftEdgeUpdate.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A} |
| Operation: | write | Name: | name |
Value: Microsoft Edge Update | |||
| (PID) Process: | (4276) MicrosoftEdgeUpdate.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A} |
| Operation: | write | Name: | pv |
Value: 1.3.143.57 | |||
| (PID) Process: | (4276) MicrosoftEdgeUpdate.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe |
| Operation: | write | Name: | DisableExceptionChainValidation |
Value: 0 | |||
| (PID) Process: | (4276) MicrosoftEdgeUpdate.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate |
| Operation: | write | Name: | IsMSIHelperRegistered |
Value: 0 | |||
| (PID) Process: | (4276) MicrosoftEdgeUpdate.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate |
| Operation: | write | Name: | LastOSVersion |
Value: 1C0100000A00000000000000654A000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010100 | |||
| (PID) Process: | (4276) MicrosoftEdgeUpdate.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate |
| Operation: | write | Name: | version |
Value: 1.3.143.57 | |||
Executable files
301
Suspicious files
3
Text files
9
Unknown types
2
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2580 | updater.exe | C:\Users\admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe | executable | |
MD5:60366CBF515774FFDE2B49297C3D2E9B | SHA256:7EBC4CE80143EF89CEA86A61EA151502868DB6CAAA678B8B43660A66ACE11C3A | |||
| 6016 | MicrosoftEdgeWebview2Setup.exe | C:\Users\admin\AppData\Local\Temp\EUE373.tmp\MicrosoftEdgeUpdateBroker.exe | executable | |
MD5:2F6C55219295B8FB852D0250407DCD39 | SHA256:8F53160721CBB335C5B48C0418ADDF228019FDF8BABEC80FB4C3D895F15B7E06 | |||
| 6016 | MicrosoftEdgeWebview2Setup.exe | C:\Users\admin\AppData\Local\Temp\EUE373.tmp\msedgeupdateres_ar.dll | executable | |
MD5:3CD36DD3FB7DBB8CD57D5BC5B30AF46D | SHA256:C5F7DB9EA55A3C1E6A309C7B2A906F99A9A695B969AC7F1FA3238840644390AB | |||
| 6016 | MicrosoftEdgeWebview2Setup.exe | C:\Users\admin\AppData\Local\Temp\EUE373.tmp\msedgeupdateres_bn.dll | executable | |
MD5:F834309ADF53C98AA3C285009750D7E0 | SHA256:0E556855E6486CBAC2B9015BC3193139C37B8021C3C58EEDD8E463709DCB464B | |||
| 6016 | MicrosoftEdgeWebview2Setup.exe | C:\Users\admin\AppData\Local\Temp\EUE373.tmp\msedgeupdateres_bg.dll | executable | |
MD5:F66B0BDA782786DAD87872CBC61367C1 | SHA256:A9264904354EFABFFE7D7E6E8006A79E3FC360D720E5939B11B5ED14A57B1B1A | |||
| 6016 | MicrosoftEdgeWebview2Setup.exe | C:\Users\admin\AppData\Local\Temp\EUE373.tmp\psmachine.dll | executable | |
MD5:460FE68C5A8EBFAC911CCD7E859A8C9A | SHA256:7998424877C98F049023391ADF0B494B9BFA0194B9ABE9161F74A256A50BB45B | |||
| 6016 | MicrosoftEdgeWebview2Setup.exe | C:\Users\admin\AppData\Local\Temp\EUE373.tmp\msedgeupdate.dll | executable | |
MD5:2141E11F0E1AAED7BDBCADF58FAD0357 | SHA256:7D3F4E7A5ECFA260582B80D5A04C118320274A5E421D99E6C39D875FF8A80B9C | |||
| 6016 | MicrosoftEdgeWebview2Setup.exe | C:\Users\admin\AppData\Local\Temp\EUE373.tmp\psmachine_arm64.dll | executable | |
MD5:8D0A79C5A41BE9A0175087D6CE8E3610 | SHA256:3C210E6E21FF1C18716ED92DD63FE8D5E8CA0A5F01895A81073C2AD30460B261 | |||
| 6016 | MicrosoftEdgeWebview2Setup.exe | C:\Users\admin\AppData\Local\Temp\EUE373.tmp\psuser_arm64.dll | executable | |
MD5:F0222252D8D96C68ED652F439556F823 | SHA256:EA2DDA97C7D41DE39FE1A0475A58A1D11C30995B411F3EEC9DC91E1F9F8C63B1 | |||
| 6016 | MicrosoftEdgeWebview2Setup.exe | C:\Users\admin\AppData\Local\Temp\EUE373.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe | executable | |
MD5:8B6401915E92E8DD7C1B08FD7C936240 | SHA256:C1346AC1F12D9B2D8ED4A34390498911ED87656AC8723208105ECBB84A6D4368 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
40
DNS requests
16
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1480 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
1480 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
936 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | whitelisted |
1064 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6052 | RUXIMICS.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 239.255.255.250:1900 | — | — | — | whitelisted |
— | — | 40.113.110.67:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 20.190.159.2:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
1064 | svchost.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
1064 | svchost.exe | 20.190.159.2:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6856 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6832 | wermgr.exe | 52.168.117.173:443 | watson.events.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
watson.events.data.microsoft.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
arc.msn.com |
| whitelisted |