metastealer | hxxps://adclick[.]g[.]doubleclick[.]net/pcs/click?Scan389443998489&adurl=hxxps://zzqo[.]shop/document[.]zip

Analysis

max time kernel
316s
max time network
314s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2024 23:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://adclick.g.doubleclick.net/pcs/click?Scan389443998489&adurl=https://zzqo.shop/document.zip

Score

10^/10

metastealer discovery execution spyware stealer

Malware Config

Extracted

Family

metastealer

kiyaqoimsiieeyqa.xyz

ssqsmisuowqcwsqo.xyz

ykqmwgsuummieaug.xyz

ewukeskgqswqesiw.xyz

cscqcsgewmwwaaui.xyz

cyoksykiamiscyia.xyz

okgomokemoucqeso.xyz

ikwacuakiqeimwua.xyz

aawcsqqaywckiwmi.xyz

aiqasksgmyeqocei.xyz

qgumcuisgaeyuqqe.xyz

eiesoycamyqqgcea.xyz

ywceswakicsqomqw.xyz

auaieuewouawygku.xyz

cmiascusccywowcs.xyz

uiqkkomkaceqacec.xyz

quqeciymqmkqccqw.xyz

ssqsauuuyyigouou.xyz

aogaakukuugqswcy.xyz

ucgwcwsuqsuwewgc.xyz

Attributes

dga_seed
21845
domain_length
16
num_dga_domains
10000
port
443

Signatures

Meta Stealer
Meta Stealer steals passwords stored in browsers, written in C++.
stealer metastealer

MetaStealer payload 1 IoCs

resource	yara_rule
behavioral1/memory/4108-201-0x0000000010000000-0x000000001072E000-memory.dmp	family_metastealer

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2448	powershell.exe
5876	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4108	setup.exe

Loads dropped DLL 1 IoCs

pid	Process
1272	MsiExec.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2800	ICACLS.EXE

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{5954EC54-3AE7-4C5F-A5C0-2B3335969234}	msiexec.exe
File created	C:\Windows\Installer\e596bd0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e596bd0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6D66.tmp	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	EXPAND.EXE
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	EXPAND.EXE

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Msft&Prod_Virtual_Disk\2&1f4adffe&0&000004\Service	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_MSFT&PROD_VIRTUAL_DISK\2&1F4ADFFE&0&000003	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Msft&Prod_Virtual_Disk\2&1f4adffe&0&000003\HardwareID	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Msft&Prod_Virtual_Disk\2&1f4adffe&0&000003\Service	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_MSFT&PROD_VIRTUAL_DISK\2&1F4ADFFE&0&000004	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Msft&Prod_Virtual_Disk\2&1f4adffe&0&000004\HardwareID	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
1308	systeminfo.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
876	msedge.exe
876	msedge.exe
4764	msedge.exe
4764	msedge.exe
1816	identity_helper.exe
1816	identity_helper.exe
1244	msedge.exe
1244	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
4932	msiexec.exe
4932	msiexec.exe
2448	powershell.exe
2448	powershell.exe
2448	powershell.exe
4108	setup.exe
4108	setup.exe
5876	powershell.exe
5876	powershell.exe
5876	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe

Suspicious use of AdjustPrivilegeToken 38 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5928	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5928	msiexec.exe
Token: SeSecurityPrivilege	4932	msiexec.exe
Token: SeCreateTokenPrivilege	5928	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5928	msiexec.exe
Token: SeLockMemoryPrivilege	5928	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5928	msiexec.exe
Token: SeMachineAccountPrivilege	5928	msiexec.exe
Token: SeTcbPrivilege	5928	msiexec.exe
Token: SeSecurityPrivilege	5928	msiexec.exe
Token: SeTakeOwnershipPrivilege	5928	msiexec.exe
Token: SeLoadDriverPrivilege	5928	msiexec.exe
Token: SeSystemProfilePrivilege	5928	msiexec.exe
Token: SeSystemtimePrivilege	5928	msiexec.exe
Token: SeProfSingleProcessPrivilege	5928	msiexec.exe
Token: SeIncBasePriorityPrivilege	5928	msiexec.exe
Token: SeCreatePagefilePrivilege	5928	msiexec.exe
Token: SeCreatePermanentPrivilege	5928	msiexec.exe
Token: SeBackupPrivilege	5928	msiexec.exe
Token: SeRestorePrivilege	5928	msiexec.exe
Token: SeShutdownPrivilege	5928	msiexec.exe
Token: SeDebugPrivilege	5928	msiexec.exe
Token: SeAuditPrivilege	5928	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5928	msiexec.exe
Token: SeChangeNotifyPrivilege	5928	msiexec.exe
Token: SeRemoteShutdownPrivilege	5928	msiexec.exe
Token: SeUndockPrivilege	5928	msiexec.exe
Token: SeSyncAgentPrivilege	5928	msiexec.exe
Token: SeEnableDelegationPrivilege	5928	msiexec.exe
Token: SeManageVolumePrivilege	5928	msiexec.exe
Token: SeImpersonatePrivilege	5928	msiexec.exe
Token: SeCreateGlobalPrivilege	5928	msiexec.exe
Token: SeRestorePrivilege	4932	msiexec.exe
Token: SeTakeOwnershipPrivilege	4932	msiexec.exe
Token: SeRestorePrivilege	4932	msiexec.exe
Token: SeTakeOwnershipPrivilege	4932	msiexec.exe
Token: SeDebugPrivilege	2448	powershell.exe
Token: SeDebugPrivilege	5876	powershell.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 2036	4764	msedge.exe	82
PID 4764 wrote to memory of 2036	4764	msedge.exe	82
PID 4764 wrote to memory of 1944	4764	msedge.exe	85
PID 4764 wrote to memory of 1944	4764	msedge.exe	85
PID 4764 wrote to memory of 1944	4764	msedge.exe	85
PID 4764 wrote to memory of 1944	4764	msedge.exe	85
PID 4764 wrote to memory of 1944	4764	msedge.exe	85
PID 4764 wrote to memory of 1944	4764	msedge.exe	85
PID 4764 wrote to memory of 1944	4764	msedge.exe	85
PID 4764 wrote to memory of 1944	4764	msedge.exe	85
PID 4764 wrote to memory of 1944	4764	msedge.exe	85
PID 4764 wrote to memory of 1944	4764	msedge.exe	85
PID 4764 wrote to memory of 1944	4764	msedge.exe	85
PID 4764 wrote to memory of 1944	4764	msedge.exe	85
PID 4764 wrote to memory of 1944	4764	msedge.exe	85
PID 4764 wrote to memory of 1944	4764	msedge.exe	85
PID 4764 wrote to memory of 1944	4764	msedge.exe	85
PID 4764 wrote to memory of 1944	4764	msedge.exe	85
PID 4764 wrote to memory of 1944	4764	msedge.exe	85
PID 4764 wrote to memory of 1944	4764	msedge.exe	85
PID 4764 wrote to memory of 1944	4764	msedge.exe	85
PID 4764 wrote to memory of 1944	4764	msedge.exe	85
PID 4764 wrote to memory of 1944	4764	msedge.exe	85
PID 4764 wrote to memory of 1944	4764	msedge.exe	85
PID 4764 wrote to memory of 1944	4764	msedge.exe	85
PID 4764 wrote to memory of 1944	4764	msedge.exe	85
PID 4764 wrote to memory of 1944	4764	msedge.exe	85
PID 4764 wrote to memory of 1944	4764	msedge.exe	85
PID 4764 wrote to memory of 1944	4764	msedge.exe	85
PID 4764 wrote to memory of 1944	4764	msedge.exe	85
PID 4764 wrote to memory of 1944	4764	msedge.exe	85
PID 4764 wrote to memory of 1944	4764	msedge.exe	85
PID 4764 wrote to memory of 1944	4764	msedge.exe	85
PID 4764 wrote to memory of 1944	4764	msedge.exe	85
PID 4764 wrote to memory of 1944	4764	msedge.exe	85
PID 4764 wrote to memory of 1944	4764	msedge.exe	85
PID 4764 wrote to memory of 1944	4764	msedge.exe	85
PID 4764 wrote to memory of 1944	4764	msedge.exe	85
PID 4764 wrote to memory of 1944	4764	msedge.exe	85
PID 4764 wrote to memory of 1944	4764	msedge.exe	85
PID 4764 wrote to memory of 1944	4764	msedge.exe	85
PID 4764 wrote to memory of 1944	4764	msedge.exe	85
PID 4764 wrote to memory of 876	4764	msedge.exe	86
PID 4764 wrote to memory of 876	4764	msedge.exe	86
PID 4764 wrote to memory of 1432	4764	msedge.exe	87
PID 4764 wrote to memory of 1432	4764	msedge.exe	87
PID 4764 wrote to memory of 1432	4764	msedge.exe	87
PID 4764 wrote to memory of 1432	4764	msedge.exe	87
PID 4764 wrote to memory of 1432	4764	msedge.exe	87
PID 4764 wrote to memory of 1432	4764	msedge.exe	87
PID 4764 wrote to memory of 1432	4764	msedge.exe	87
PID 4764 wrote to memory of 1432	4764	msedge.exe	87
PID 4764 wrote to memory of 1432	4764	msedge.exe	87
PID 4764 wrote to memory of 1432	4764	msedge.exe	87
PID 4764 wrote to memory of 1432	4764	msedge.exe	87
PID 4764 wrote to memory of 1432	4764	msedge.exe	87
PID 4764 wrote to memory of 1432	4764	msedge.exe	87
PID 4764 wrote to memory of 1432	4764	msedge.exe	87
PID 4764 wrote to memory of 1432	4764	msedge.exe	87
PID 4764 wrote to memory of 1432	4764	msedge.exe	87
PID 4764 wrote to memory of 1432	4764	msedge.exe	87
PID 4764 wrote to memory of 1432	4764	msedge.exe	87
PID 4764 wrote to memory of 1432	4764	msedge.exe	87
PID 4764 wrote to memory of 1432	4764	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://adclick.g.doubleclick.net/pcs/click?Scan389443998489&adurl=https://zzqo.shop/document.zip
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdab7846f8,0x7ffdab784708,0x7ffdab784718
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,3051472626946861926,723212045745430680,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,3051472626946861926,723212045745430680,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,3051472626946861926,723212045745430680,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,3051472626946861926,723212045745430680,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,3051472626946861926,723212045745430680,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,3051472626946861926,723212045745430680,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,3051472626946861926,723212045745430680,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,3051472626946861926,723212045745430680,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,3051472626946861926,723212045745430680,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2144,3051472626946861926,723212045745430680,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4904 /prefetch:8
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,3051472626946861926,723212045745430680,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2144,3051472626946861926,723212045745430680,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,3051472626946861926,723212045745430680,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,3051472626946861926,723212045745430680,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,3051472626946861926,723212045745430680,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5400 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3604

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:384

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:2580

\??\E:\Untitled_June_06_25_2024_export.pdf.pif
"E:\Untitled_June_06_25_2024_export.pdf.pif"
1⤵
PID:4560
- C:\Windows\SYSTEM32\msiexec.exe
  msiexec.exe /i "C:\Users\Admin\AppData\Local\Microsoft\Windows\windrv.msi" /Qn
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5928

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4932
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0C988AF31783E50D5966EB37BE57A609
  2⤵
  - Loads dropped DLL
  PID:1272
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-a4573b4b-f9e4-459e-a02c-e31bfe8112f7\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    PID:2800
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    PID:4484
- - C:\Users\Admin\AppData\Local\Temp\MW-a4573b4b-f9e4-459e-a02c-e31bfe8112f7\files\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\MW-a4573b4b-f9e4-459e-a02c-e31bfe8112f7\files\setup.exe" /VERYSILENT /VERYSILENT
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4108
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Microsoft\Windows\systemtask.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2448
  - - C:\Windows\SysWOW64\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:1308
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionPath "$env:LOCALAPPDATA\Microsoft\windows\systemtask.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5876

C:\Users\Admin\Downloads\Untitled_June_06_25_2024_export.pdf.pif
"C:\Users\Admin\Downloads\Untitled_June_06_25_2024_export.pdf.pif"
1⤵
PID:4756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:5208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
db9081c34e133c32d02f593df88f047a

SHA1
a0da007c14fd0591091924edc44bee90456700c6

SHA256
c9cd202ebb55fe8dd3e5563948bab458e947d7ba33bc0f38c6b37ce5d0bd7c3e

SHA512
12f9809958b024571891fae646208a76f3823ae333716a5cec303e15c38281db042b7acf95bc6523b6328ac9c8644794d39a0e03d9db196f156a6ee1fb4f2744

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3a09f853479af373691d131247040276

SHA1
1b6f098e04da87e9cf2d3284943ec2144f36ac04

SHA256
a358de2c0eba30c70a56022c44a3775aa99ffa819cd7f42f7c45ac358b5e739f

SHA512
341cf0f363621ee02525cd398ae0d462319c6a80e05fd25d9aca44234c42a3071b51991d4cf102ac9d89561a1567cbe76dfeaad786a304bec33821ca77080016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
20KB

MD5
274c27de6984da986c653339a58b1c2a

SHA1
efd3b8ad75ecd229690f79615b78ba23f50b62c5

SHA256
164c5c3b1444704a106d1d0aae080451f42e9cd39de980fd2f8cf22c777aa013

SHA512
8e0ee696cd884a68dffafe7304e632019b6e601a258bebe341bb24e66cc44a1f9b4989d8424f46652b349ab06583607b97e8358382f93aa0eca65defc4d700b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
314B

MD5
27cf9047da6308eb2bd907017cf29106

SHA1
3d5cf9a546bc65a1242c9d630e3c92ba745259f2

SHA256
8f704196b2c22e0ff40d70eba08cf93ef798b6bd5282a3b2506e493f9095dbe6

SHA512
54665e89f58a294741a43503b89915f1ba42f3257ae5b54a709e32f1c5e03faabc18a21cf7ea3a5ee92522808edf497aeefc416869eece816f399de476399d31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ffa72314b39e95852d6f4dfe584dfb81

SHA1
6b2d46d0ba4bb935163475dfdfdf9d911603b72b

SHA256
12875dcb8656e3ea55b5a74021d7f8516e1ea8974b5cd1baacadd998eb53cfef

SHA512
6423f6b09a15abdb294cb48473d80723da730c5f14a29765b1963fc2dfc6a00ad88ac0f3010c883b94e5347b9f699797be4c42643cb9ef33ac4daa50fd6bdc72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7325241020618f430809621ae65fb4b4

SHA1
c35ab250fd29d50950450feb44060e25e5eff7e0

SHA256
d3d0cb295171d32fae7fb4700a771161c02c556b6658e71632707781522ccac7

SHA512
02bac50c053f668ac2d9b69a2ac1b8f9488232d535bdab484195fd7dec30f44461295fb4d8b67db6ed34305f61e3c0c22b7f5b82499bdbd6dcf4dafd4045edf2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
50be9bc33354d7a99444d0372b0cbbdb

SHA1
59c5eeb5e944e5b8148f156927998107e739a43a

SHA256
f2b0e1f348a690c4a335df8de0509fce668009e95f1aa59bb566ded51dbf1c4d

SHA512
74f04789e2d4d10c7faf35c0e03687fe4d1fda85c22a0c232169a6d77b7b466dac726e16602fde3268d96d621ef4915e6b9052d98d7b7dfa84d3c36d63d0a7bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
53642a1c2e1a7657e27266ab7527b1b9

SHA1
6bb5ff0a3d123889c77875a284357b3bcda5f3b7

SHA256
b6981df9797458b0661128fb3ccc75714820119a3f35671cd07874bb67e461ee

SHA512
09be2452f4321e642aff56ce359f788cfe55cfb21dc92ddf41f74c55c187629228e96c2a43d042bb1f589ff0802ea42484e6f3496c288f9f121e4787cc773516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fe0caf3ec8d54116e025408c712a8dbc

SHA1
e857c0e95cafd0b0f7066c458bfb39390e0eb7af

SHA256
52a4693b508f3cfd384b5dce6b23d150581b49942fa5d89ecb57d71616e9b492

SHA512
13396b174b00a249579f93103f335049409c43502a9c62c78fb9a89f5d8bf725274ec142d127b36d8b78b5b8e1374e62dd163a9476aa73647203f8d8cba0497c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
c7f18bead493b5e243623ec9a8569002

SHA1
aef1e7daa2f2db880999ac162a200a343d904626

SHA256
29d85c6b9aab95576754379607213527b17c3be232dbc191672736dfbba18c98

SHA512
3c03086902c20aea37dff576d1533c5c9f331a68c248977b55d01a58be91d0026756a2fd68b5cbb21ea712498c95a7c68ea8398d497412fe96de3fcc04ffc7ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\windrv.msi

Filesize
1.6MB

MD5
24cbbd2c70efbb75845548513114317e

SHA1
bd13f38e7301648b8cea6135a851b8691fda2c27

SHA256
b31e366ae13a960eb0efbfb5074b0abd1f300151289833d7dfa1a9382bea1855

SHA512
b7b0e4fa57e17b0da21a85f56f29a711ff226c8a9e95ca59721e4f20e32b9cbd8a5fdf69010e79f8452df5457a055cc2a41f2ad773eaf692680bc39cb8e50ead

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-a4573b4b-f9e4-459e-a02c-e31bfe8112f7\files.cab

Filesize
1.3MB

MD5
57c5b54337af1acd54c65c5abae694b2

SHA1
87b6b5eebf8fa70a42bd2cf192740b7130a521a2

SHA256
ead264b457fd74737f51a2c4bf5d4679d7e1dcdd1547aca6fe3bf7e117c9d0d8

SHA512
af10bdc86a45d59d6e46b5cfa942348360c3ac4312d122bf80783673c448861621811a2c3f4446355037b98a67f642cb8ae27945619d0cd32aaeff9656c0982e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-a4573b4b-f9e4-459e-a02c-e31bfe8112f7\msiwrapper.ini

Filesize
1KB

MD5
e43b3d9d7c7d9504296f5968e09301cf

SHA1
4df781d504e9ec15adeb6219c451da4bccee5492

SHA256
9006e95e511da94f5ebb8475aedca1d3eaad4a57aba85624708158b14ab900b5

SHA512
a1a668bffcd3d545106a5e49f6de5b59c94e49548eb6fc45f96461a6ef65200f8857f1cd8ebc3000481a320bad1926b54adf3734a23faae8ee6422f383de2e2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_f0v4zmwj.gcb.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\document.zip

Filesize
2.2MB

MD5
24eec0b60c7d2a8559a373d5d8b48787

SHA1
94526ca28e53e1faff873dd95b6050adbfbff043

SHA256
f5afa1848a514c371f10393fe36f76ccead9d608d6eb21bb1d22160b93910ffa

SHA512
7fa85c130e9d119de49377b8f858bb184daba59e6637eac23eb5569fe671d6dbada1befde31c7ea26b400bfcb4eadd1bb395fbabe9f3164f84b15df3d6380809

Download Submit
C:\Windows\Installer\MSI6D66.tmp

Filesize
208KB

MD5
0c8921bbcc37c6efd34faf44cf3b0cb5

SHA1
dcfa71246157edcd09eecaf9d4c5e360b24b3e49

SHA256
fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1

SHA512
ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108

Download Submit
memory/2448-221-0x0000000005CF0000-0x0000000005D0E000-memory.dmp

Filesize
120KB

Download
memory/2448-242-0x0000000007220000-0x0000000007231000-memory.dmp

Filesize
68KB

Download
memory/2448-220-0x0000000005830000-0x0000000005B84000-memory.dmp

Filesize
3.3MB

Download
memory/2448-209-0x0000000005650000-0x00000000056B6000-memory.dmp

Filesize
408KB

Download
memory/2448-222-0x0000000005D30000-0x0000000005D7C000-memory.dmp

Filesize
304KB

Download
memory/2448-226-0x000000006F430000-0x000000006F47C000-memory.dmp

Filesize
304KB

Download
memory/2448-225-0x00000000062D0000-0x0000000006302000-memory.dmp

Filesize
200KB

Download
memory/2448-236-0x0000000006EC0000-0x0000000006EDE000-memory.dmp

Filesize
120KB

Download
memory/2448-237-0x0000000006EE0000-0x0000000006F83000-memory.dmp

Filesize
652KB

Download
memory/2448-238-0x0000000007660000-0x0000000007CDA000-memory.dmp

Filesize
6.5MB

Download
memory/2448-239-0x0000000007020000-0x000000000703A000-memory.dmp

Filesize
104KB

Download
memory/2448-240-0x0000000007080000-0x000000000708A000-memory.dmp

Filesize
40KB

Download
memory/2448-241-0x00000000072B0000-0x0000000007346000-memory.dmp

Filesize
600KB

Download
memory/2448-212-0x00000000056C0000-0x0000000005726000-memory.dmp

Filesize
408KB

Download
memory/2448-243-0x0000000007250000-0x000000000725E000-memory.dmp

Filesize
56KB

Download
memory/2448-244-0x0000000007260000-0x0000000007274000-memory.dmp

Filesize
80KB

Download
memory/2448-245-0x0000000007370000-0x000000000738A000-memory.dmp

Filesize
104KB

Download
memory/2448-246-0x00000000072A0000-0x00000000072A8000-memory.dmp

Filesize
32KB

Download
memory/2448-208-0x0000000004E40000-0x0000000004E62000-memory.dmp

Filesize
136KB

Download
memory/2448-207-0x0000000004F20000-0x0000000005548000-memory.dmp

Filesize
6.2MB

Download
memory/2448-206-0x00000000023D0000-0x0000000002406000-memory.dmp

Filesize
216KB

Download
memory/4108-201-0x0000000010000000-0x000000001072E000-memory.dmp

Filesize
7.2MB

Download
memory/5876-267-0x00000000060B0000-0x0000000006404000-memory.dmp

Filesize
3.3MB

Download
memory/5876-269-0x00000000068B0000-0x00000000068FC000-memory.dmp

Filesize
304KB

Download
memory/5876-270-0x0000000070400000-0x000000007044C000-memory.dmp

Filesize
304KB

Download
memory/5876-280-0x0000000007730000-0x00000000077D3000-memory.dmp

Filesize
652KB

Download
memory/5876-281-0x0000000007A90000-0x0000000007AA1000-memory.dmp

Filesize
68KB

Download
memory/5876-282-0x0000000007AD0000-0x0000000007AE4000-memory.dmp

Filesize
80KB

Download