Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\edgeupdate
Modifies file system
Creates the following files
- %WINDIR%\edgeupdate\microsoftedgesecurity.exe
- nul
Network activity
Connects to
- 'si###swop.io':443
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f9##############
Other
- 'si###swop.io':443
UDP
- DNS ASK si###swop.io
Miscellaneous
Creates and executes the following
- '%WINDIR%\edgeupdate\microsoftedgesecurity.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c schtasks /create /tn "EdgeUpdate" /tr "%WINDIR%\EdgeUpdate\MicrosoftEdgeSecurity.exe" /sc minute /mo 5 /f /rl highest
- '<SYSTEM32>\schtasks.exe' /create /tn "EdgeUpdate" /tr "%WINDIR%\EdgeUpdate\MicrosoftEdgeSecurity.exe" /sc minute /mo 5 /f /rl highest
- '<SYSTEM32>\cmd.exe' /c timeout /t 3 /nobreak > nul & del /f /q "<Full path to file>" & rmdir "<Current directory>"
- '<SYSTEM32>\timeout.exe' /t 3 /nobreak
- '<SYSTEM32>\cmd.exe' /c schtasks /create /tn "EdgeUpdate" /tr "%WINDIR%\EdgeUpdate\MicrosoftEdgeSecurity.exe" /sc minute /mo 5 /f /rl highest' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c timeout /t 3 /nobreak > nul & del /f /q "<Full path to file>" & rmdir "<Current directory>"' (with hidden window)
