metastealer | d67bc5bfd6512b944e1c5e3e7d6871771c84d9eb94c863d123c5e92c6a86dc46

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23-02-2024 13:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

install.msi
Size

3.3MB
MD5

4e5903c4ff6d79dbad178815b377554d
SHA1

74f50126aebbd186d6defa3641113cdc88a37fa2
SHA256

d67bc5bfd6512b944e1c5e3e7d6871771c84d9eb94c863d123c5e92c6a86dc46
SHA512

9a513449963c860e9be50c05a79beeea554fc6bc9748b260340711d8cb705cb022f53f10cfdc35ce1ad8d97644df57a9aae959b6dbb96c15b85d8ecaf62031a8
SSDEEP

98304:5pKIwis1N1AaewONvZOIUFz+PlROVt1OTLmUsg:6IHmnqvZlUFz8RtyPg

Score

10^/10

metastealer discovery spyware stealer

Malware Config

Signatures

Meta Stealer
Meta Stealer steals passwords stored in browsers, written in C++.
stealer metastealer

MetaStealer payload 1 IoCs

resource	yara_rule
behavioral2/memory/2752-188-0x0000000010000000-0x0000000010731000-memory.dmp	family_metastealer

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1704	ICACLS.EXE

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\Control Panel\International\Geo\Nation	cmd.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e579700.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{0EE48DF4-66A0-4D55-A54B-0602B9F3BDE1}	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	EXPAND.EXE
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	EXPAND.EXE
File opened for modification	C:\Windows\Installer\e579700.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI97EA.tmp	msiexec.exe

Executes dropped EXE 1 IoCs

pid	Process
2752	install.exe

Loads dropped DLL 1 IoCs

pid	Process
3640	MsiExec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000eb7a6b2c8ffa81410000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000eb7a6b2c0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900eb7a6b2c000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1deb7a6b2c000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000eb7a6b2c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
6000	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
556	msiexec.exe
556	msiexec.exe
3876	msedge.exe
3876	msedge.exe
2056	msedge.exe
2056	msedge.exe
5148	identity_helper.exe
5148	identity_helper.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe
2752	install.exe
2752	install.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeShutdownPrivilege	348	msiexec.exe
Token: SeIncreaseQuotaPrivilege	348	msiexec.exe
Token: SeSecurityPrivilege	556	msiexec.exe
Token: SeCreateTokenPrivilege	348	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	348	msiexec.exe
Token: SeLockMemoryPrivilege	348	msiexec.exe
Token: SeIncreaseQuotaPrivilege	348	msiexec.exe
Token: SeMachineAccountPrivilege	348	msiexec.exe
Token: SeTcbPrivilege	348	msiexec.exe
Token: SeSecurityPrivilege	348	msiexec.exe
Token: SeTakeOwnershipPrivilege	348	msiexec.exe
Token: SeLoadDriverPrivilege	348	msiexec.exe
Token: SeSystemProfilePrivilege	348	msiexec.exe
Token: SeSystemtimePrivilege	348	msiexec.exe
Token: SeProfSingleProcessPrivilege	348	msiexec.exe
Token: SeIncBasePriorityPrivilege	348	msiexec.exe
Token: SeCreatePagefilePrivilege	348	msiexec.exe
Token: SeCreatePermanentPrivilege	348	msiexec.exe
Token: SeBackupPrivilege	348	msiexec.exe
Token: SeRestorePrivilege	348	msiexec.exe
Token: SeShutdownPrivilege	348	msiexec.exe
Token: SeDebugPrivilege	348	msiexec.exe
Token: SeAuditPrivilege	348	msiexec.exe
Token: SeSystemEnvironmentPrivilege	348	msiexec.exe
Token: SeChangeNotifyPrivilege	348	msiexec.exe
Token: SeRemoteShutdownPrivilege	348	msiexec.exe
Token: SeUndockPrivilege	348	msiexec.exe
Token: SeSyncAgentPrivilege	348	msiexec.exe
Token: SeEnableDelegationPrivilege	348	msiexec.exe
Token: SeManageVolumePrivilege	348	msiexec.exe
Token: SeImpersonatePrivilege	348	msiexec.exe
Token: SeCreateGlobalPrivilege	348	msiexec.exe
Token: SeBackupPrivilege	3564	vssvc.exe
Token: SeRestorePrivilege	3564	vssvc.exe
Token: SeAuditPrivilege	3564	vssvc.exe
Token: SeBackupPrivilege	556	msiexec.exe
Token: SeRestorePrivilege	556	msiexec.exe
Token: SeRestorePrivilege	556	msiexec.exe
Token: SeTakeOwnershipPrivilege	556	msiexec.exe
Token: SeRestorePrivilege	556	msiexec.exe
Token: SeTakeOwnershipPrivilege	556	msiexec.exe
Token: SeBackupPrivilege	2408	srtasks.exe
Token: SeRestorePrivilege	2408	srtasks.exe
Token: SeSecurityPrivilege	2408	srtasks.exe
Token: SeTakeOwnershipPrivilege	2408	srtasks.exe
Token: SeBackupPrivilege	2408	srtasks.exe
Token: SeRestorePrivilege	2408	srtasks.exe
Token: SeSecurityPrivilege	2408	srtasks.exe
Token: SeTakeOwnershipPrivilege	2408	srtasks.exe
Token: SeDebugPrivilege	3988	powershell.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
348	msiexec.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 556 wrote to memory of 2408	556	msiexec.exe	99
PID 556 wrote to memory of 2408	556	msiexec.exe	99
PID 556 wrote to memory of 3640	556	msiexec.exe	101
PID 556 wrote to memory of 3640	556	msiexec.exe	101
PID 556 wrote to memory of 3640	556	msiexec.exe	101
PID 3640 wrote to memory of 1704	3640	MsiExec.exe	102
PID 3640 wrote to memory of 1704	3640	MsiExec.exe	102
PID 3640 wrote to memory of 1704	3640	MsiExec.exe	102
PID 3640 wrote to memory of 3636	3640	MsiExec.exe	104
PID 3640 wrote to memory of 3636	3640	MsiExec.exe	104
PID 3640 wrote to memory of 3636	3640	MsiExec.exe	104
PID 3640 wrote to memory of 840	3640	MsiExec.exe	106
PID 3640 wrote to memory of 840	3640	MsiExec.exe	106
PID 3640 wrote to memory of 840	3640	MsiExec.exe	106
PID 840 wrote to memory of 2056	840	cmd.exe	108
PID 840 wrote to memory of 2056	840	cmd.exe	108
PID 2056 wrote to memory of 2684	2056	msedge.exe	109
PID 2056 wrote to memory of 2684	2056	msedge.exe	109
PID 2056 wrote to memory of 868	2056	msedge.exe	113
PID 2056 wrote to memory of 868	2056	msedge.exe	113
PID 2056 wrote to memory of 868	2056	msedge.exe	113
PID 2056 wrote to memory of 868	2056	msedge.exe	113
PID 2056 wrote to memory of 868	2056	msedge.exe	113
PID 2056 wrote to memory of 868	2056	msedge.exe	113
PID 2056 wrote to memory of 868	2056	msedge.exe	113
PID 2056 wrote to memory of 868	2056	msedge.exe	113
PID 2056 wrote to memory of 868	2056	msedge.exe	113
PID 2056 wrote to memory of 868	2056	msedge.exe	113
PID 2056 wrote to memory of 868	2056	msedge.exe	113
PID 2056 wrote to memory of 868	2056	msedge.exe	113
PID 2056 wrote to memory of 868	2056	msedge.exe	113
PID 2056 wrote to memory of 868	2056	msedge.exe	113
PID 2056 wrote to memory of 868	2056	msedge.exe	113
PID 2056 wrote to memory of 868	2056	msedge.exe	113
PID 2056 wrote to memory of 868	2056	msedge.exe	113
PID 2056 wrote to memory of 868	2056	msedge.exe	113
PID 2056 wrote to memory of 868	2056	msedge.exe	113
PID 2056 wrote to memory of 868	2056	msedge.exe	113
PID 2056 wrote to memory of 868	2056	msedge.exe	113
PID 2056 wrote to memory of 868	2056	msedge.exe	113
PID 2056 wrote to memory of 868	2056	msedge.exe	113
PID 2056 wrote to memory of 868	2056	msedge.exe	113
PID 2056 wrote to memory of 868	2056	msedge.exe	113
PID 2056 wrote to memory of 868	2056	msedge.exe	113
PID 2056 wrote to memory of 868	2056	msedge.exe	113
PID 2056 wrote to memory of 868	2056	msedge.exe	113
PID 2056 wrote to memory of 868	2056	msedge.exe	113
PID 2056 wrote to memory of 868	2056	msedge.exe	113
PID 2056 wrote to memory of 868	2056	msedge.exe	113
PID 2056 wrote to memory of 868	2056	msedge.exe	113
PID 2056 wrote to memory of 868	2056	msedge.exe	113
PID 2056 wrote to memory of 868	2056	msedge.exe	113
PID 2056 wrote to memory of 868	2056	msedge.exe	113
PID 2056 wrote to memory of 868	2056	msedge.exe	113
PID 2056 wrote to memory of 868	2056	msedge.exe	113
PID 2056 wrote to memory of 868	2056	msedge.exe	113
PID 2056 wrote to memory of 868	2056	msedge.exe	113
PID 2056 wrote to memory of 868	2056	msedge.exe	113
PID 2056 wrote to memory of 3876	2056	msedge.exe	111
PID 2056 wrote to memory of 3876	2056	msedge.exe	111
PID 2056 wrote to memory of 4060	2056	msedge.exe	112
PID 2056 wrote to memory of 4060	2056	msedge.exe	112
PID 2056 wrote to memory of 4060	2056	msedge.exe	112
PID 2056 wrote to memory of 4060	2056	msedge.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\install.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:348

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:556
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2408
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DA315061D9526BB5904D7BB03DE977A9
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3640
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-679e900e-2ac2-4e24-9658-5ac10893df0e\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    PID:1704
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    PID:3636
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start msedge https://www.concurtraining.com/customers/tech_pubs/Docs/_Current/UG_Inv/Inv_UG_Invoice_Pay.pdf
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.concurtraining.com/customers/tech_pubs/Docs/_Current/UG_Inv/Inv_UG_Invoice_Pay.pdf
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2056
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb100c46f8,0x7ffb100c4708,0x7ffb100c4718
        5⤵
        
        PID:2684
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,12152374523403817200,15733276335143813711,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3876
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,12152374523403817200,15733276335143813711,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
        5⤵
        
        PID:4060
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,12152374523403817200,15733276335143813711,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
        5⤵
        
        PID:868
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12152374523403817200,15733276335143813711,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
        5⤵
        
        PID:4160
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12152374523403817200,15733276335143813711,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
        5⤵
        
        PID:3352
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12152374523403817200,15733276335143813711,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3844 /prefetch:1
        5⤵
        
        PID:1128
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --field-trial-handle=2144,12152374523403817200,15733276335143813711,131072 --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=5096 /prefetch:6
        5⤵
        
        PID:776
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12152374523403817200,15733276335143813711,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
        5⤵
        
        PID:4908
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12152374523403817200,15733276335143813711,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
        5⤵
        
        PID:4344
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,12152374523403817200,15733276335143813711,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5916 /prefetch:8
        5⤵
        
        PID:5132
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,12152374523403817200,15733276335143813711,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5916 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5148
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12152374523403817200,15733276335143813711,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
        5⤵
        
        PID:5268
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12152374523403817200,15733276335143813711,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:1
        5⤵
        
        PID:5260
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,12152374523403817200,15733276335143813711,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5684 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5788
- - C:\Users\Admin\AppData\Local\Temp\MW-679e900e-2ac2-4e24-9658-5ac10893df0e\files\install.exe
    "C:\Users\Admin\AppData\Local\Temp\MW-679e900e-2ac2-4e24-9658-5ac10893df0e\files\install.exe" /VERYSILENT /VERYSILENT
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2752
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionPath "%LOCALAPPDATA%\Microsoft\windows\systemtask.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3988
  - - C:\Windows\SysWOW64\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:6000

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:60

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
aa6f46176fbc19ccf3e361dc1135ece0

SHA1
cb1f8c693b88331e9513b77efe47be9e43c43b12

SHA256
2f5ba493c7c4192e9310cea3a96cfec4fd14c6285af6e3659627ab177e560819

SHA512
5d26fdffebeb1eb5adde9f7da19fe7069e364d3f68670013cb0cc3e2b40bf1fbcb9bdebbfe999747caf141c88ccd53bd4acf2074283e4bde46b8c28fbae296f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1af9fbc1d4655baf2df9e8948103d616

SHA1
c58d5c208d0d5aab5b6979b64102b0086799b0bf

SHA256
e83daa7b2af963dbb884d82919710164e2337f0f9f5e5c56ee4b7129d160c135

SHA512
714d0ff527a8a24ec5d32a0a2b74e402ee933ea86e42d3e2fb5615c8345e6c09aa1c2ddf2dea53d71c5a666483a3b494b894326fea0cc1d8a06d3b32ec9397d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
190B

MD5
d5500b5aac90fd96526e8faa73d9388f

SHA1
b5917249a627f8deae7e7922b9b8fd83de13b1eb

SHA256
8a14eb94c762dd663a9ccc0526312bc49802af52b42e9f1530f47ec787c4d4dc

SHA512
568105cd443ec3aeec1c333d4c1c66ee5027248361abe3f5a8c293a71ea5104cfea0a32d6776d137ebc78786c753c8f8c49de0de33ce31d8f0fc47b83c5eb58c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
13e7ae5e39c78c287d0c5840b4664e91

SHA1
a34b255cb5f81fc3c1bb75430719bd9b678516de

SHA256
f436c5a91baf67834ad59e679c7b887ae3f1ce128688d69bee7c17807d9db659

SHA512
1b6e356301d3bff1b94422bbf57b16016af56fe5a3cd359b4944b90d4cd3534cbc546b250655cae7ae93f1adee371d06cdf5af1647285f750094a0627ffd7c6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
119b8f14d6a1261d5b8a035abdf98339

SHA1
8ab23b1913a7a6961f846830cb2c40e38a5538be

SHA256
dc6121d52cfbb1f98980b9722a4e0dc77970b8ff6f7bc0a49697d36f63c66a28

SHA512
d2fff95044aa06b655c7aa5749004ee595a75ecab6d18518297b8d654765db0c5940c63b58689f7efd2911f998cfc5bbbda13042ee28143d18c15f47947669d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
42a1937284aba0a5b929ffaec22c6fca

SHA1
6562091f4bcc5f0374b44213fe89a0ea33de0672

SHA256
fe1718b461c8a279bb2beb2edf7360a160e8e3304985f00b50e4369bce661a33

SHA512
22a268f896112cae44b33486d9db3668d629ecd26631f6ae6b4ebdc5657d387be2e258ee402b04eb750636bad299a21a4ee8cbe167d43a615ef62c94f8733139

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
8c2a38336cf037a1120b124ce0ffdfe3

SHA1
3505f4704a872a151eff74caf0153b3c3619650b

SHA256
ad933088faa38af4fbd670100dfe3fdef58307bc81dc4d7d81514c8de9c9df64

SHA512
4642be32b1c5f078c54b68892ad05542d53be1bd73389328598188475790ab9153f4ff5d6e020c933fae0ab12422851e111398f4006497572cdbac9f37c56c50

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-679e900e-2ac2-4e24-9658-5ac10893df0e\files.cab

Filesize
3.1MB

MD5
c5251b4a0300ac59b9c51b39b48960ef

SHA1
1a9f4710e07aff28c8961b8bb4d5a525ea385e42

SHA256
4d5fd376d65beb611b661283d72a19f92e69812c716546e3b3809062671238f2

SHA512
a00ddbbd2e4d29b6e54ad422d3a69c4cf3b68cec704c677b5713afe8080774a7b35367464fe5bde19efdd07795f1f7ce2ef13f236241b048638f56fa158b2e76

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-679e900e-2ac2-4e24-9658-5ac10893df0e\files\install.exe

Filesize
3.4MB

MD5
0aa61a01935a4cf9f104df2e9b86d287

SHA1
5201aaf6ce61875c76501745ad4a97d1aa4157bd

SHA256
7f80bfa6d3293299a6deb8e43437f0f8204eebcfe32711a9d6ec0aad5b524571

SHA512
39ee1e08202f233d6c780971c2075e58ead990d12fc2ce55a1de986e067360a5023f8d185feae20733b545dbe028cd3dc9450565e6df6a02da754662197b8cf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-679e900e-2ac2-4e24-9658-5ac10893df0e\files\install.exe

Filesize
3.7MB

MD5
58d0fde7e7074d56c88cec07bd5eb14e

SHA1
de28414edc8dcf5b2388ca1b5fc88bba01eaf032

SHA256
2e1830f054a5cf4d332529ad2906c9e38a3eb79f67131ae19a412c1facb4fa16

SHA512
99137ad7ec7398069c75ff9194bd87f4ef3aaadda136f5834a752ec667a13aff94cc755537d655f6c5c94aaac49419b1a49124ca9276b28560e1c559299e6dde

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-679e900e-2ac2-4e24-9658-5ac10893df0e\msiwrapper.ini

Filesize
1KB

MD5
90877cab4d32daea0cacb4fc3c67ec37

SHA1
bf244fb0f88246b66b0a3ae3b9a6c8b677e8dfc5

SHA256
545cd3d0f3ac133d4a6146ef6feb29badad0a866c34d4a78ab08390a8d72e109

SHA512
a3ef4e708f60f18e3575d93ae6aeb43573ca1e5c30f23b46f0af85cc8ddc5a52d9ded2c01e707721ac01fa4a0ee30ef0488f7b231866032b4c34967c74a80602

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-679e900e-2ac2-4e24-9658-5ac10893df0e\msiwrapper.ini

Filesize
1KB

MD5
42b7619ea915b3d52b066eebaa656001

SHA1
4bfcdae818268e5cf01eb3a8620d5f2b403d7602

SHA256
8689e7e2fa980d972faa718c28a6faa86807ddb7370f7cb84ed949cca9eaa052

SHA512
d9186d5f68ed483220112029dd6deab7d8bf31494eac80707910bbf64db98afcff3b11965c9a24fc94f5cd6997ebfaa8385cc69a8b0fed9f988feb8701611df7

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xupoj3q2.arj.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\Installer\MSI97EA.tmp

Filesize
208KB

MD5
4caaa03e0b59ca60a3d34674b732b702

SHA1
ee80c8f4684055ac8960b9720fb108be07e1d10c

SHA256
d01af2b8c692dffb04a5a04e3ccd0d0a3b2c67c8fc45a4b68c0a065b4e64cc3d

SHA512
25888848871286bdd1f9c43a0fba35640edb5bafbe0c6aa2f9708a070ea4e5b16745b7c4f744ae4f5643f75ef47f196d430bf70921ed27715f712825ec590a34

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
12.4MB

MD5
8be72401af9ef46c74196a989b10f1dc

SHA1
aa49fbf2fa804481039d0c3d310638fe204a629f

SHA256
466540cb61ab1ceacdd951eca1a4900920027e5e7470f38e00f49ff498ffdcb5

SHA512
27ded7aa47078a4d6eea9da7b19283521699e0e89c3fda24fe3121890f6132cd907d2858870dc38602336ef3613d183bbd730b730c3d2658dce12a817343868c

Download Submit
\??\Volume{2c6b7aeb-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{6366f269-638b-4f02-9d32-e37963c8471f}_OnDiskSnapshotProp

Filesize
6KB

MD5
f02f63ffa8bb07a140d69e2dbe1347f4

SHA1
8869bc49bf6f972bcabe553c3a5522991257d2ca

SHA256
09eacdcee277cb4e0cf9098aec6bb047980e4088e2c113cf33cb7697999418ed

SHA512
ed434cfccddde8aad81043bd1146f170cddddc2b239fb3c1b7cff7975f03a0a0e4e949c4e1c9414fc2d47f490b11ba3c9ae75f2fcb7fdf7eed476a601fb14815

Download Submit
memory/2752-111-0x0000000000400000-0x00000000007B7000-memory.dmp

Filesize
3.7MB

Download
memory/2752-132-0x0000000002400000-0x000000000247A000-memory.dmp

Filesize
488KB

Download
memory/2752-138-0x0000000002400000-0x000000000247A000-memory.dmp

Filesize
488KB

Download
memory/2752-156-0x0000000002400000-0x000000000247A000-memory.dmp

Filesize
488KB

Download
memory/2752-188-0x0000000010000000-0x0000000010731000-memory.dmp

Filesize
7.2MB

Download
memory/3988-196-0x0000000004DE0000-0x0000000004DF0000-memory.dmp

Filesize
64KB

Download
memory/3988-226-0x0000000006950000-0x000000000696E000-memory.dmp

Filesize
120KB

Download
memory/3988-197-0x0000000005460000-0x0000000005A88000-memory.dmp

Filesize
6.2MB

Download
memory/3988-198-0x0000000005410000-0x0000000005432000-memory.dmp

Filesize
136KB

Download
memory/3988-199-0x0000000005CC0000-0x0000000005D26000-memory.dmp

Filesize
408KB

Download
memory/3988-200-0x0000000005DA0000-0x0000000005E06000-memory.dmp

Filesize
408KB

Download
memory/3988-194-0x0000000004DE0000-0x0000000004DF0000-memory.dmp

Filesize
64KB

Download
memory/3988-210-0x0000000005F10000-0x0000000006264000-memory.dmp

Filesize
3.3MB

Download
memory/3988-211-0x00000000063A0000-0x00000000063BE000-memory.dmp

Filesize
120KB

Download
memory/3988-212-0x00000000063F0000-0x000000000643C000-memory.dmp

Filesize
304KB

Download
memory/3988-214-0x000000007EE10000-0x000000007EE20000-memory.dmp

Filesize
64KB

Download
memory/3988-215-0x0000000006990000-0x00000000069C2000-memory.dmp

Filesize
200KB

Download
memory/3988-216-0x000000006E950000-0x000000006E99C000-memory.dmp

Filesize
304KB

Download
memory/3988-195-0x0000000004DF0000-0x0000000004E26000-memory.dmp

Filesize
216KB

Download
memory/3988-227-0x0000000007590000-0x0000000007633000-memory.dmp

Filesize
652KB

Download
memory/3988-228-0x0000000007D20000-0x000000000839A000-memory.dmp

Filesize
6.5MB

Download
memory/3988-229-0x00000000076E0000-0x00000000076FA000-memory.dmp

Filesize
104KB

Download
memory/3988-230-0x0000000007740000-0x000000000774A000-memory.dmp

Filesize
40KB

Download
memory/3988-231-0x0000000007970000-0x0000000007A06000-memory.dmp

Filesize
600KB

Download
memory/3988-232-0x00000000078E0000-0x00000000078F1000-memory.dmp

Filesize
68KB

Download
memory/3988-233-0x0000000007910000-0x000000000791E000-memory.dmp

Filesize
56KB

Download
memory/3988-234-0x0000000007920000-0x0000000007934000-memory.dmp

Filesize
80KB

Download
memory/3988-235-0x0000000007A30000-0x0000000007A4A000-memory.dmp

Filesize
104KB

Download
memory/3988-236-0x0000000007960000-0x0000000007968000-memory.dmp

Filesize
32KB

Download
memory/3988-239-0x0000000072060000-0x0000000072810000-memory.dmp

Filesize
7.7MB

Download
memory/3988-193-0x0000000072060000-0x0000000072810000-memory.dmp

Filesize
7.7MB

Download