metastealer | d67bc5bfd6512b944e1c5e3e7d6871771c84d9eb94c863d123c5e92c6a86dc46

Analysis

max time kernel
150s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22/02/2024, 12:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.msi
Size 3.3MB
Sample240222-p17qsshg78
SHA256 d67bc5bfd6512b944e1c5e3e7d6871771c84d9eb94c863d123c5e92c6a86dc46
MD5 4e5903c4ff6d79dbad178815b377554d
SHA1 74f50126aebbd186d6defa3641113cdc88a37fa2
SHA512 9a513449963c860e9be50c05a79beeea554fc6bc9748b260340711d8cb705cb022f53f10cfdc35ce1ad8d97644df57a9aae959b6dbb96c15b85d8ecaf62031a8
SSDEEP 98304:5pKIwis1N1AaewONvZOIUFz+PlROVt1OTLmUsg:6IHmnqvZlUFz8RtyPg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metastealer discovery spyware stealer

Malware Config

Signatures

Meta Stealer
Meta Stealer steals passwords stored in browsers, written in C++.
stealer metastealer

MetaStealer payload 1 IoCs

resource	yara_rule
behavioral2/memory/4472-176-0x0000000010000000-0x0000000010731000-memory.dmp	family_metastealer

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3296	ICACLS.EXE

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000\Control Panel\International\Geo\Nation	cmd.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{0EE48DF4-66A0-4D55-A54B-0602B9F3BDE1}	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBDB2.tmp	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	EXPAND.EXE
File created	C:\Windows\Installer\e57ad66.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57ad66.msi	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	EXPAND.EXE

Executes dropped EXE 1 IoCs

pid	Process
4472	install.exe

Loads dropped DLL 1 IoCs

pid	Process
3748	MsiExec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
564	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
3880	msiexec.exe
3880	msiexec.exe
1344	msedge.exe
1344	msedge.exe
3568	msedge.exe
3568	msedge.exe
936	identity_helper.exe
936	identity_helper.exe
3508	powershell.exe
3508	powershell.exe
3508	powershell.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
4472	install.exe
4472	install.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4240	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4240	msiexec.exe
Token: SeSecurityPrivilege	3880	msiexec.exe
Token: SeCreateTokenPrivilege	4240	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4240	msiexec.exe
Token: SeLockMemoryPrivilege	4240	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4240	msiexec.exe
Token: SeMachineAccountPrivilege	4240	msiexec.exe
Token: SeTcbPrivilege	4240	msiexec.exe
Token: SeSecurityPrivilege	4240	msiexec.exe
Token: SeTakeOwnershipPrivilege	4240	msiexec.exe
Token: SeLoadDriverPrivilege	4240	msiexec.exe
Token: SeSystemProfilePrivilege	4240	msiexec.exe
Token: SeSystemtimePrivilege	4240	msiexec.exe
Token: SeProfSingleProcessPrivilege	4240	msiexec.exe
Token: SeIncBasePriorityPrivilege	4240	msiexec.exe
Token: SeCreatePagefilePrivilege	4240	msiexec.exe
Token: SeCreatePermanentPrivilege	4240	msiexec.exe
Token: SeBackupPrivilege	4240	msiexec.exe
Token: SeRestorePrivilege	4240	msiexec.exe
Token: SeShutdownPrivilege	4240	msiexec.exe
Token: SeDebugPrivilege	4240	msiexec.exe
Token: SeAuditPrivilege	4240	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4240	msiexec.exe
Token: SeChangeNotifyPrivilege	4240	msiexec.exe
Token: SeRemoteShutdownPrivilege	4240	msiexec.exe
Token: SeUndockPrivilege	4240	msiexec.exe
Token: SeSyncAgentPrivilege	4240	msiexec.exe
Token: SeEnableDelegationPrivilege	4240	msiexec.exe
Token: SeManageVolumePrivilege	4240	msiexec.exe
Token: SeImpersonatePrivilege	4240	msiexec.exe
Token: SeCreateGlobalPrivilege	4240	msiexec.exe
Token: SeBackupPrivilege	4764	vssvc.exe
Token: SeRestorePrivilege	4764	vssvc.exe
Token: SeAuditPrivilege	4764	vssvc.exe
Token: SeRestorePrivilege	3880	msiexec.exe
Token: SeTakeOwnershipPrivilege	3880	msiexec.exe
Token: SeRestorePrivilege	3880	msiexec.exe
Token: SeTakeOwnershipPrivilege	3880	msiexec.exe
Token: SeDebugPrivilege	3508	powershell.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4240	msiexec.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3880 wrote to memory of 3748	3880	msiexec.exe	93
PID 3880 wrote to memory of 3748	3880	msiexec.exe	93
PID 3880 wrote to memory of 3748	3880	msiexec.exe	93
PID 3748 wrote to memory of 3296	3748	MsiExec.exe	95
PID 3748 wrote to memory of 3296	3748	MsiExec.exe	95
PID 3748 wrote to memory of 3296	3748	MsiExec.exe	95
PID 3748 wrote to memory of 4688	3748	MsiExec.exe	97
PID 3748 wrote to memory of 4688	3748	MsiExec.exe	97
PID 3748 wrote to memory of 4688	3748	MsiExec.exe	97
PID 3748 wrote to memory of 2320	3748	MsiExec.exe	99
PID 3748 wrote to memory of 2320	3748	MsiExec.exe	99
PID 3748 wrote to memory of 2320	3748	MsiExec.exe	99
PID 2320 wrote to memory of 3568	2320	cmd.exe	101
PID 2320 wrote to memory of 3568	2320	cmd.exe	101
PID 3568 wrote to memory of 4332	3568	msedge.exe	102
PID 3568 wrote to memory of 4332	3568	msedge.exe	102
PID 3568 wrote to memory of 1104	3568	msedge.exe	105
PID 3568 wrote to memory of 1104	3568	msedge.exe	105
PID 3568 wrote to memory of 1104	3568	msedge.exe	105
PID 3568 wrote to memory of 1104	3568	msedge.exe	105
PID 3568 wrote to memory of 1104	3568	msedge.exe	105
PID 3568 wrote to memory of 1104	3568	msedge.exe	105
PID 3568 wrote to memory of 1104	3568	msedge.exe	105
PID 3568 wrote to memory of 1104	3568	msedge.exe	105
PID 3568 wrote to memory of 1104	3568	msedge.exe	105
PID 3568 wrote to memory of 1104	3568	msedge.exe	105
PID 3568 wrote to memory of 1104	3568	msedge.exe	105
PID 3568 wrote to memory of 1104	3568	msedge.exe	105
PID 3568 wrote to memory of 1104	3568	msedge.exe	105
PID 3568 wrote to memory of 1104	3568	msedge.exe	105
PID 3568 wrote to memory of 1104	3568	msedge.exe	105
PID 3568 wrote to memory of 1104	3568	msedge.exe	105
PID 3568 wrote to memory of 1104	3568	msedge.exe	105
PID 3568 wrote to memory of 1104	3568	msedge.exe	105
PID 3568 wrote to memory of 1104	3568	msedge.exe	105
PID 3568 wrote to memory of 1104	3568	msedge.exe	105
PID 3568 wrote to memory of 1104	3568	msedge.exe	105
PID 3568 wrote to memory of 1104	3568	msedge.exe	105
PID 3568 wrote to memory of 1104	3568	msedge.exe	105
PID 3568 wrote to memory of 1104	3568	msedge.exe	105
PID 3568 wrote to memory of 1104	3568	msedge.exe	105
PID 3568 wrote to memory of 1104	3568	msedge.exe	105
PID 3568 wrote to memory of 1104	3568	msedge.exe	105
PID 3568 wrote to memory of 1104	3568	msedge.exe	105
PID 3568 wrote to memory of 1104	3568	msedge.exe	105
PID 3568 wrote to memory of 1104	3568	msedge.exe	105
PID 3568 wrote to memory of 1104	3568	msedge.exe	105
PID 3568 wrote to memory of 1104	3568	msedge.exe	105
PID 3568 wrote to memory of 1104	3568	msedge.exe	105
PID 3568 wrote to memory of 1104	3568	msedge.exe	105
PID 3568 wrote to memory of 1104	3568	msedge.exe	105
PID 3568 wrote to memory of 1104	3568	msedge.exe	105
PID 3568 wrote to memory of 1104	3568	msedge.exe	105
PID 3568 wrote to memory of 1104	3568	msedge.exe	105
PID 3568 wrote to memory of 1104	3568	msedge.exe	105
PID 3568 wrote to memory of 1104	3568	msedge.exe	105
PID 3568 wrote to memory of 1344	3568	msedge.exe	104
PID 3568 wrote to memory of 1344	3568	msedge.exe	104
PID 3568 wrote to memory of 4388	3568	msedge.exe	106
PID 3568 wrote to memory of 4388	3568	msedge.exe	106
PID 3568 wrote to memory of 4388	3568	msedge.exe	106
PID 3568 wrote to memory of 4388	3568	msedge.exe	106
PID 3568 wrote to memory of 4388	3568	msedge.exe	106
PID 3568 wrote to memory of 4388	3568	msedge.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\install.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4240

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FEFC821C6646F9A6133A7B8C166FFE89
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3748
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-17d94ee4-4f54-494d-9872-8e07c1e84393\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    PID:3296
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    PID:4688
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start msedge https://www.concurtraining.com/customers/tech_pubs/Docs/_Current/UG_Inv/Inv_UG_Invoice_Pay.pdf
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:2320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.concurtraining.com/customers/tech_pubs/Docs/_Current/UG_Inv/Inv_UG_Invoice_Pay.pdf
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:3568
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffe6c046f8,0x7fffe6c04708,0x7fffe6c04718
        5⤵
        
        PID:4332
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,15154708564389696871,18046201757685040581,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1344
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,15154708564389696871,18046201757685040581,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
        5⤵
        
        PID:1104
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,15154708564389696871,18046201757685040581,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
        5⤵
        
        PID:4388
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15154708564389696871,18046201757685040581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
        5⤵
        
        PID:3716
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15154708564389696871,18046201757685040581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
        5⤵
        
        PID:1444
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15154708564389696871,18046201757685040581,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
        5⤵
        
        PID:1068
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --field-trial-handle=2136,15154708564389696871,18046201757685040581,131072 --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=5096 /prefetch:6
        5⤵
        
        PID:4364
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15154708564389696871,18046201757685040581,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
        5⤵
        
        PID:4816
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15154708564389696871,18046201757685040581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
        5⤵
        
        PID:4444
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,15154708564389696871,18046201757685040581,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6040 /prefetch:8
        5⤵
        
        PID:4384
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,15154708564389696871,18046201757685040581,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6040 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:936
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15154708564389696871,18046201757685040581,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
        5⤵
        
        PID:988
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15154708564389696871,18046201757685040581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
        5⤵
        
        PID:1480
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,15154708564389696871,18046201757685040581,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2920 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3044
- - C:\Users\Admin\AppData\Local\Temp\MW-17d94ee4-4f54-494d-9872-8e07c1e84393\files\install.exe
    "C:\Users\Admin\AppData\Local\Temp\MW-17d94ee4-4f54-494d-9872-8e07c1e84393\files\install.exe" /VERYSILENT /VERYSILENT
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4472
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionPath "%LOCALAPPDATA%\Microsoft\windows\systemtask.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3508
  - - C:\Windows\SysWOW64\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:564

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 562016f9159ef363fcbe62ed13ee26052b31d4f67dc5ea6d60864a7d5dfa50a1
MD5 f5b0bf4edca2187f7715ddd49777a1b2
SHA1 eb78099013d0894a11c48d496f48973585f0c7c0
SHA512 1039b98cffd32ca4c9e37486b96e01b167d76b19dd8440a21da4932d677c463f4c5ce2260239e8337f59bd61ff3111905e23ab71d3ca5b20e7d2935fea7952c9
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f168242e74bfde18bacb9e18945a39bb447188eba916c7adf0f342ed8d82281e
MD5 f4db60c9bb06ea5452df26771fa873ac
SHA1 c118183a1315a285606f81da05fc19367a2cdfe1
SHA512 180ed98f9d5a14a22687a099c4a0ba6b586610f7b8b4c8de89f3b91713b07a2ef3726fcd318cb4e270b1745213b898037d29cca4b490d0c91833b797d69ac406
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 190B
SHA256 8a14eb94c762dd663a9ccc0526312bc49802af52b42e9f1530f47ec787c4d4dc
MD5 d5500b5aac90fd96526e8faa73d9388f
SHA1 b5917249a627f8deae7e7922b9b8fd83de13b1eb
SHA512 568105cd443ec3aeec1c333d4c1c66ee5027248361abe3f5a8c293a71ea5104cfea0a32d6776d137ebc78786c753c8f8c49de0de33ce31d8f0fc47b83c5eb58c
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 784c44c0c8aeef695bcfd83fde2791f71c24cedfd0ffad3a7002c0767a40875d
MD5 bbabcb7f6f9e93e177f52e9d16024bc2
SHA1 5724ff601abeefe016a954c75d8ad102ca2c8e56
SHA512 98bf4d01d9da928684e192459cf554e08ab99b07555bc9e4d20bdd1f998a83cba71429bdf1cfb42bd581ee55cbf9bd32dca93d4868eccc13f521166d094a1763
SSDEEP 96:nLkJSxm/FQYmqZ1yxlO/wpvWMoiVmdeHlHf9g6I0UWQyV+VD7ziEwb:nLkJPOGAxlwGWMXl1pI0rt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 27aefff77642cecf512b790fc6cf38852683787276fd2a6cc456708c89051034
MD5 49c1dddeb2fc6b5717b59ec08f8b42ea
SHA1 4d13662f4a763394c71a0a7061696a21b0706289
SHA512 6925204d2584997045f81ce6cccd631411c6b673157601be89e1bf4fac0db3e18569f0bb29c97d657db363fd848320ddbbe744a3cddb744ad8775a65fe528558
SSDEEP 96:nLk4Sxm/FamqZ1yxlO/qpvWMoiVmdeDuN1jlHd9g6I0UWQyV+VD7AiEwb:nLk4PDGAxlw8WMzuNhl/pI0rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 03d887233570a3d8047a7079eeccfd1859853f634dcf174facca87cb888b63b9
MD5 75e33d050228231ac193aa4f2b0d4bd8
SHA1 f7a594261d9b994687eb82b5f32d24ba4c9e1e3c
SHA512 31eba1d76d24d133486dc9b9286b9539c66e5982a49851fe8781f0bc6984565602be082de53361a1089c6f2ec48422338b14150300618c94ab7160ed2b3277ed
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup1Be2RUojsbtEi9xUX1MPeS:A9iIxuERzA83h09RZxY1VTwH9E1MeuBF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 27b20c291f0bf54988d30339cfb93fa26cee44b40a3e0bbc52f93ada7d291f1d
MD5 e65145489c2085244d56417933652f4e
SHA1 1800e322b54226a0bcbd23fb005bb41c95452d70
SHA512 8def7a90c6881a8a2e04949f6a7172238ceb14be0319af7b47c8e518e3b739d8185205ab60c14b383dbc303626ccb736217656075bcf03d6f9457462be9c1ab2
SSDEEP 384:A9iIxuERzA83h09RZxYswVTFiPH9E1MeuBOqn:rIxuERzA83h09RZxMiPHTOqn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 a817dfd7b84715b5ecd7cb2be83c5c2cfc4430a231c0073ac747333679c8208a
MD5 66f180c453ae30a5aee5ab5af08929b1
SHA1 165c65032ce32da75cc36cd189922a3025344184
SHA512 8190d65465e9eb242ab362eee53b7c771a2afdd4351066bd76ac18bb4ddd810a15228a1aba174681fac2a5f000f7376f599c216f0f5b17eba425e633850c6853
SSDEEP 192:ioCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup1Be2RUojsbtEn9xUX1MPeS:29iIxuERzA83h09RZxY1VTwI9E1MeuBF
MD5 SHA1 SHA512 SSDEEP

Submit Download

files.cab

Path C:\Users\Admin\AppData\Local\Temp\MW-17d94ee4-4f54-494d-9872-8e07c1e84393\files.cab
Size 1.5MB
SHA256 a2bfab4eedc0284a111ad069195034a0b2733351bc38c466c4c4ca5b0b243685
MD5 7f535f122be29f78c93db0b371176415
SHA1 20d49fad3d7155ab30df757c566dc83673bba186
SHA512 0f83364295ee8267f26c20f064df3e638927a62418d2a1f39fd0fd98787333171f7b2ce91cfeefe7517fc0bfe675f14788e410bdd6e4525ea72dd0af05468b44
SSDEEP 24576:tshI9soawbTsah+HtHVa/ZSgp0ewbdsPiUp19L6j8djTZJTSI4xq4zWIJSPl/ZFh:toIwisah+N1a/taewOt7LvVzTSIUFz+3
MD5 SHA1 SHA512 SSDEEP

Submit Download

install.exe

Path C:\Users\Admin\AppData\Local\Temp\MW-17d94ee4-4f54-494d-9872-8e07c1e84393\files\install.exe
Size 17.4MB
SHA256 2761aa8ceababb7e4956e9459e6f51758227dd7d334c5d28147e54f99841f1e1
MD5 930b292d0be0195909fff9d994ff9a24
SHA1 c5d6d018d19681e45ad9360df6f57776636bc575
SHA512 c77cff6e250c0fd3356cf229264e3823f873fc8be05a57cea6dc3e87883856afa015c9f243fafcd12c4366d790f6bc4385df0c1532d585c7a6bf9cbe610b54db
SSDEEP 98304:e/Tn3LbKjO+t+NmUtZqVcqbXmZ66z24VZbwpgMLWzmidN:eb3IO6PUNqSZ66z24VZbwpgOWzmidN
MD5 SHA1 SHA512 SSDEEP

Submit Download

install.exe

Path C:\Users\Admin\AppData\Local\Temp\MW-17d94ee4-4f54-494d-9872-8e07c1e84393\files\install.exe
Size 4.1MB
SHA256 0bb62899e1c098cd87f198d994d6d2cabcea93ca3145399f3194158cc7b6cbd5
MD5 deeaa0d12475d64be9e7a2815a2e0b7c
SHA1 6c4970b81d6114df83dc3842c602b6de0e8de847
SHA512 9a5658e38850241070cbf31106f235428c2ad1e77d7472048cc0544e0316e0c8e4be6de2726432d93275ffb783317d5713d611f98b4d078f0a3b732528e2a7a2
SSDEEP 98304:e/Tn3LbKjO+t+NmUtZqVcqbXmZ66z24VZbwpgMLWzmidN:eb3IO6PUNqSZ66z24VZbwpgOWzmidN
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiwrapper.ini

Path C:\Users\Admin\AppData\Local\Temp\MW-17d94ee4-4f54-494d-9872-8e07c1e84393\msiwrapper.ini
Size 336B
SHA256 3adf1e3c9e3f4ed46bea6f0f8db183400732026d9418018fe4bc1869ad9763b6
MD5 bf445f051cd626e6c1fc8c5cad4fc13f
SHA1 f37077939b8f27da0b381f96a627fd2cba89c719
SHA512 60ab7bd88e6958cc956482293334f3bd8934fb116ce482592bda84a595327e65a916ab3826e758e440920b47b5f6a58ab3387a6ed22d5bd2e46ae9fff86fdbd6
MD5 SHA1 SHA512

Submit Download

msiwrapper.ini

Path C:\Users\Admin\AppData\Local\Temp\MW-17d94ee4-4f54-494d-9872-8e07c1e84393\msiwrapper.ini
Size 1KB
SHA256 dad8d2e429a3b1508d78a11cb8abf537ae92892855d3fa3da7393db5d1f7ac19
MD5 897b34ee44908720efb1d6d773618601
SHA1 775597f2e6217f714152f18c5c6cae196c618d12
SHA512 09827dafe07082a7f66a9460bdad6709f39927b4ae025b4a55c5452445f341b8e17c9055712f0f817b444246b74106005dd7b9c7b4d4a8d80722b67bc1577f52
MD5 SHA1 SHA512

Submit Download

msiwrapper.ini

Path C:\Users\Admin\AppData\Local\Temp\MW-17d94ee4-4f54-494d-9872-8e07c1e84393\msiwrapper.ini
Size 1KB
SHA256 977103ef0f0d25fc51b79790856d1273c17912f05c8a0b8bc26f6f3e46351c54
MD5 b2920ff7040d62782630740131cd4356
SHA1 114df8e0ea2dd5f487e5ed2dbc369ac714a9719c
SHA512 17081b3cb022f749d7388f303e7581a0213698f6bb547e6d1bba1de5456da48dc022d6f9f5fdff3612d65c19a62f695919c1139bc07329bd48e8644fbf2df81e
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_dhzjuxdw.nr1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dhzjuxdw.nr1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

MSIBDB2.tmp

Path C:\Windows\Installer\MSIBDB2.tmp
Size 208KB
SHA256 d01af2b8c692dffb04a5a04e3ccd0d0a3b2c67c8fc45a4b68c0a065b4e64cc3d
MD5 4caaa03e0b59ca60a3d34674b732b702
SHA1 ee80c8f4684055ac8960b9720fb108be07e1d10c
SHA512 25888848871286bdd1f9c43a0fba35640edb5bafbe0c6aa2f9708a070ea4e5b16745b7c4f744ae4f5643f75ef47f196d430bf70921ed27715f712825ec590a34
SSDEEP 3072:AspAtOdmXwCGjtYNKbYO2gjpcm8rRuqpjCLw2loHUvU4yGxr53qM2a8:2tOdiRQYpgjpjew5LLyGx1qo8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3508-186-0x0000000004EB0000-0x0000000004EC0000-memory.dmp

Download

memory/3508-202-0x0000000004EB0000-0x0000000004EC0000-memory.dmp

Download

memory/3508-232-0x0000000072C80000-0x0000000073430000-memory.dmp

Download

memory/3508-182-0x0000000004EC0000-0x0000000004EF6000-memory.dmp

Download

memory/3508-183-0x0000000072C80000-0x0000000073430000-memory.dmp

Download

memory/3508-185-0x0000000005530000-0x0000000005B58000-memory.dmp

Download

memory/3508-230-0x0000000007AE0000-0x0000000007AE8000-memory.dmp

Download

memory/3508-184-0x0000000004EB0000-0x0000000004EC0000-memory.dmp

Download

memory/3508-187-0x00000000054E0000-0x0000000005502000-memory.dmp

Download

memory/3508-188-0x0000000005D90000-0x0000000005DF6000-memory.dmp

Download

memory/3508-229-0x0000000007B00000-0x0000000007B1A000-memory.dmp

Download

memory/3508-194-0x0000000005E70000-0x0000000005ED6000-memory.dmp

Download

memory/3508-199-0x0000000005FE0000-0x0000000006334000-memory.dmp

Download

memory/3508-200-0x0000000006490000-0x00000000064AE000-memory.dmp

Download

memory/3508-201-0x00000000064D0000-0x000000000651C000-memory.dmp

Download

memory/3508-228-0x0000000007A00000-0x0000000007A14000-memory.dmp

Download

memory/3508-204-0x000000007F5C0000-0x000000007F5D0000-memory.dmp

Download

memory/3508-205-0x0000000007470000-0x00000000074A2000-memory.dmp

Download

memory/3508-206-0x000000006F570000-0x000000006F5BC000-memory.dmp

Download

memory/3508-216-0x0000000006A40000-0x0000000006A5E000-memory.dmp

Download

memory/3508-217-0x00000000076B0000-0x0000000007753000-memory.dmp

Download

memory/3508-218-0x0000000007DE0000-0x000000000845A000-memory.dmp

Download

memory/3508-219-0x00000000077A0000-0x00000000077BA000-memory.dmp

Download

memory/3508-220-0x0000000007800000-0x000000000780A000-memory.dmp

Download

memory/3508-221-0x0000000007A30000-0x0000000007AC6000-memory.dmp

Download

memory/3508-224-0x00000000079C0000-0x00000000079D1000-memory.dmp

Download

memory/3508-227-0x00000000079F0000-0x00000000079FE000-memory.dmp

Download

memory/4472-167-0x00000000008E0000-0x000000000095A000-memory.dmp

Download

memory/4472-128-0x00000000008E0000-0x000000000095A000-memory.dmp

Download

memory/4472-143-0x00000000008E0000-0x000000000095A000-memory.dmp

Download

memory/4472-176-0x0000000010000000-0x0000000010731000-memory.dmp

Download

memory/4472-102-0x0000000000400000-0x00000000007B7000-memory.dmp

Download