c5725459f66ba256918a26648cba3ba1fa0037550ce23a54c46581aa02524937

Analysis

max time kernel
147s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/08/2024, 15:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
39.msi
Size 14.9MB
Sample240803-tff5kasfph
SHA256 c5725459f66ba256918a26648cba3ba1fa0037550ce23a54c46581aa02524937
MD5 47568e3eb33037dab5ad5c9c97afa3a6
SHA1 13062f926c5ea2af392c9a1d5d8abea4927c40f0
SHA512 d167c890536d205e052fff70dc8741a7ec530a7d1fc1a5af4d90ae6879104ca90356881b2de7f9113b5ac1f19d8b1ff196a4c33c70ce15f5639b856a2b774a88
SSDEEP 49152:31oYOtB7WHgVI0g6Tbrz5io+HGGWxyzzlrXVVdWyAf1V7RWypBqZdQwOh+yH/mUm:3qYe7W9GGWgl9ArydQwKH0
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

microsoft discovery execution persistence phishing privilege_escalation

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
2	2916	msiexec.exe
22	1116	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tampering.exe = "C:\\meadowing\\tampering.exe"	tampering.exe

Downloads MZ/PE file

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	MSIC4D9.tmp

Detected potential entity reuse from brand microsoft.
phishing microsoft

Drops file in Windows directory 16 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e57c256.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC45A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC4B9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC4D9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC4DA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC6F1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF45.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A2ABBCAB-0F4F-4507-B988-05087A0B1226}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC5E6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF85.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e57c256.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC331.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC578.tmp	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
4724	MSIC4D9.tmp
4364	tampering.exe

Loads dropped DLL 9 IoCs

pid	Process
1296	MsiExec.exe
1296	MsiExec.exe
1296	MsiExec.exe
1296	MsiExec.exe
1296	MsiExec.exe
1296	MsiExec.exe
4364	tampering.exe
1296	MsiExec.exe
1296	MsiExec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1116	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2916	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIC4D9.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tampering.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 53 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31122878"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c00000000000000010000000083ffff0083ffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer\DOMStorage\microsoft.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.microsoft.com	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ea125702b7698d479b1c3c8e0190d45f00000000020000000000106600000001000020000000c01d71d7bc461cf11a78af9b8f473a79669c249613008ad9b692bedebcc1ad3b000000000e80000000020000200000002f717c2ef3510ce0f6fa648182904890086385d3c5501999b7737fc9fb4c937520000000b19557468d302311cdf916d69bd38830b65be7151dc3020e38b8ea3f52b6f1714000000073276e19b4539942b5661c2d70d1c70954cb402297fa1be18ce0bc81e25c8fca199e49460e284e4b826eb4b077ff886d52df1206d25d892cf1ec751cf91356f3	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.microsoft.com\ = "124"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\microsoft.com\Total = "124"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1649433818"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ea125702b7698d479b1c3c8e0190d45f000000000200000000001066000000010000200000006ccdea65b9394463b51c80c2669bb8d57ccfb91d2250d0c144929f5f7b24563c000000000e8000000002000020000000851aa435b41344ef1fada3f1489f1a0e6cb1ca939cdbe7597069fb008dc5a4e72000000022886c1e7ad3b8329cf3d8c45116841ded5c6e6d435c46a631d690ab9027e1ec40000000669750039d9db656d0ad9bec7f1546aaca786fa2d4ea928f0f6b2e7a88119a3b314f859b0ccf2581d9b972556888150eab36bcc3ac6b7f0cef6666ff2a574baa	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429465825"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "124"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\microsoft.com\Total = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{8DE0B4F5-51B1-11EF-AC6B-D60584CC4361} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.microsoft.com\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1647871132"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\microsoft.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1647871132"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00c3c564bee5da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1097be64bee5da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\microsoft.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31122878"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31122878"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
764	msiexec.exe
764	msiexec.exe
2148	msedge.exe
2148	msedge.exe
5092	msedge.exe
5092	msedge.exe
1116	powershell.exe
1116	powershell.exe
1116	powershell.exe
1996	identity_helper.exe
1996	identity_helper.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe

Suspicious use of AdjustPrivilegeToken 59 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2916	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2916	msiexec.exe
Token: SeSecurityPrivilege	764	msiexec.exe
Token: SeCreateTokenPrivilege	2916	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2916	msiexec.exe
Token: SeLockMemoryPrivilege	2916	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2916	msiexec.exe
Token: SeMachineAccountPrivilege	2916	msiexec.exe
Token: SeTcbPrivilege	2916	msiexec.exe
Token: SeSecurityPrivilege	2916	msiexec.exe
Token: SeTakeOwnershipPrivilege	2916	msiexec.exe
Token: SeLoadDriverPrivilege	2916	msiexec.exe
Token: SeSystemProfilePrivilege	2916	msiexec.exe
Token: SeSystemtimePrivilege	2916	msiexec.exe
Token: SeProfSingleProcessPrivilege	2916	msiexec.exe
Token: SeIncBasePriorityPrivilege	2916	msiexec.exe
Token: SeCreatePagefilePrivilege	2916	msiexec.exe
Token: SeCreatePermanentPrivilege	2916	msiexec.exe
Token: SeBackupPrivilege	2916	msiexec.exe
Token: SeRestorePrivilege	2916	msiexec.exe
Token: SeShutdownPrivilege	2916	msiexec.exe
Token: SeDebugPrivilege	2916	msiexec.exe
Token: SeAuditPrivilege	2916	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2916	msiexec.exe
Token: SeChangeNotifyPrivilege	2916	msiexec.exe
Token: SeRemoteShutdownPrivilege	2916	msiexec.exe
Token: SeUndockPrivilege	2916	msiexec.exe
Token: SeSyncAgentPrivilege	2916	msiexec.exe
Token: SeEnableDelegationPrivilege	2916	msiexec.exe
Token: SeManageVolumePrivilege	2916	msiexec.exe
Token: SeImpersonatePrivilege	2916	msiexec.exe
Token: SeCreateGlobalPrivilege	2916	msiexec.exe
Token: SeRestorePrivilege	764	msiexec.exe
Token: SeTakeOwnershipPrivilege	764	msiexec.exe
Token: SeRestorePrivilege	764	msiexec.exe
Token: SeTakeOwnershipPrivilege	764	msiexec.exe
Token: SeRestorePrivilege	764	msiexec.exe
Token: SeTakeOwnershipPrivilege	764	msiexec.exe
Token: SeRestorePrivilege	764	msiexec.exe
Token: SeTakeOwnershipPrivilege	764	msiexec.exe
Token: SeRestorePrivilege	764	msiexec.exe
Token: SeTakeOwnershipPrivilege	764	msiexec.exe
Token: SeRestorePrivilege	764	msiexec.exe
Token: SeTakeOwnershipPrivilege	764	msiexec.exe
Token: SeRestorePrivilege	764	msiexec.exe
Token: SeTakeOwnershipPrivilege	764	msiexec.exe
Token: SeRestorePrivilege	764	msiexec.exe
Token: SeTakeOwnershipPrivilege	764	msiexec.exe
Token: SeRestorePrivilege	764	msiexec.exe
Token: SeTakeOwnershipPrivilege	764	msiexec.exe
Token: SeDebugPrivilege	1116	powershell.exe
Token: SeRestorePrivilege	764	msiexec.exe
Token: SeTakeOwnershipPrivilege	764	msiexec.exe
Token: SeRestorePrivilege	764	msiexec.exe
Token: SeTakeOwnershipPrivilege	764	msiexec.exe
Token: SeRestorePrivilege	764	msiexec.exe
Token: SeTakeOwnershipPrivilege	764	msiexec.exe
Token: SeRestorePrivilege	764	msiexec.exe
Token: SeTakeOwnershipPrivilege	764	msiexec.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
2916	msiexec.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
2916	msiexec.exe
3016	iexplore.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3016	iexplore.exe
3016	iexplore.exe
3920	IEXPLORE.EXE
3920	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 1296	764	msiexec.exe	87
PID 764 wrote to memory of 1296	764	msiexec.exe	87
PID 764 wrote to memory of 1296	764	msiexec.exe	87
PID 764 wrote to memory of 4724	764	msiexec.exe	88
PID 764 wrote to memory of 4724	764	msiexec.exe	88
PID 764 wrote to memory of 4724	764	msiexec.exe	88
PID 4724 wrote to memory of 5092	4724	MSIC4D9.tmp	89
PID 4724 wrote to memory of 5092	4724	MSIC4D9.tmp	89
PID 5092 wrote to memory of 3684	5092	msedge.exe	90
PID 5092 wrote to memory of 3684	5092	msedge.exe	90
PID 5092 wrote to memory of 1616	5092	msedge.exe	91
PID 5092 wrote to memory of 1616	5092	msedge.exe	91
PID 5092 wrote to memory of 1616	5092	msedge.exe	91
PID 5092 wrote to memory of 1616	5092	msedge.exe	91
PID 5092 wrote to memory of 1616	5092	msedge.exe	91
PID 5092 wrote to memory of 1616	5092	msedge.exe	91
PID 5092 wrote to memory of 1616	5092	msedge.exe	91
PID 5092 wrote to memory of 1616	5092	msedge.exe	91
PID 5092 wrote to memory of 1616	5092	msedge.exe	91
PID 5092 wrote to memory of 1616	5092	msedge.exe	91
PID 5092 wrote to memory of 1616	5092	msedge.exe	91
PID 5092 wrote to memory of 1616	5092	msedge.exe	91
PID 5092 wrote to memory of 1616	5092	msedge.exe	91
PID 5092 wrote to memory of 1616	5092	msedge.exe	91
PID 5092 wrote to memory of 1616	5092	msedge.exe	91
PID 5092 wrote to memory of 1616	5092	msedge.exe	91
PID 5092 wrote to memory of 1616	5092	msedge.exe	91
PID 5092 wrote to memory of 1616	5092	msedge.exe	91
PID 5092 wrote to memory of 1616	5092	msedge.exe	91
PID 5092 wrote to memory of 1616	5092	msedge.exe	91
PID 5092 wrote to memory of 1616	5092	msedge.exe	91
PID 5092 wrote to memory of 1616	5092	msedge.exe	91
PID 5092 wrote to memory of 1616	5092	msedge.exe	91
PID 5092 wrote to memory of 1616	5092	msedge.exe	91
PID 5092 wrote to memory of 1616	5092	msedge.exe	91
PID 5092 wrote to memory of 1616	5092	msedge.exe	91
PID 5092 wrote to memory of 1616	5092	msedge.exe	91
PID 5092 wrote to memory of 1616	5092	msedge.exe	91
PID 5092 wrote to memory of 1616	5092	msedge.exe	91
PID 5092 wrote to memory of 1616	5092	msedge.exe	91
PID 5092 wrote to memory of 1616	5092	msedge.exe	91
PID 5092 wrote to memory of 1616	5092	msedge.exe	91
PID 5092 wrote to memory of 1616	5092	msedge.exe	91
PID 5092 wrote to memory of 1616	5092	msedge.exe	91
PID 5092 wrote to memory of 1616	5092	msedge.exe	91
PID 5092 wrote to memory of 1616	5092	msedge.exe	91
PID 5092 wrote to memory of 1616	5092	msedge.exe	91
PID 5092 wrote to memory of 1616	5092	msedge.exe	91
PID 5092 wrote to memory of 1616	5092	msedge.exe	91
PID 5092 wrote to memory of 1616	5092	msedge.exe	91
PID 5092 wrote to memory of 2148	5092	msedge.exe	92
PID 5092 wrote to memory of 2148	5092	msedge.exe	92
PID 5092 wrote to memory of 2684	5092	msedge.exe	93
PID 5092 wrote to memory of 2684	5092	msedge.exe	93
PID 5092 wrote to memory of 2684	5092	msedge.exe	93
PID 5092 wrote to memory of 2684	5092	msedge.exe	93
PID 5092 wrote to memory of 2684	5092	msedge.exe	93
PID 5092 wrote to memory of 2684	5092	msedge.exe	93
PID 5092 wrote to memory of 2684	5092	msedge.exe	93
PID 5092 wrote to memory of 2684	5092	msedge.exe	93
PID 5092 wrote to memory of 2684	5092	msedge.exe	93
PID 5092 wrote to memory of 2684	5092	msedge.exe	93
PID 5092 wrote to memory of 2684	5092	msedge.exe	93
PID 5092 wrote to memory of 2684	5092	msedge.exe	93

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\39.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2916

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:764
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding EE0D39486ABE69B69B03FA42BDA6B746
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1296
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssCB60.ps1"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1116
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c C:\meadowing\tampering.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:664
    - - C:\meadowing\tampering.exe
        
        C:\meadowing\tampering.exe
        5⤵
        Adds Run key to start application
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:4364
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" %1 "https://rebrand.ly/5sayib0"
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:3016
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3016 CREDAT:17410 /prefetch:2
        7⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:3920
- C:\Windows\Installer\MSIC4D9.tmp
  "C:\Windows\Installer\MSIC4D9.tmp" https://freitaslogistica.com/sucedido/
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://freitaslogistica.com/sucedido/
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:5092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9f9fc46f8,0x7ff9f9fc4708,0x7ff9f9fc4718
      4⤵
      PID:3684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,1983680579892292042,6321175402841593979,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
      4⤵
      PID:1616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,1983680579892292042,6321175402841593979,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,1983680579892292042,6321175402841593979,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
      4⤵
      PID:2684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1983680579892292042,6321175402841593979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
      4⤵
      PID:4928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1983680579892292042,6321175402841593979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
      4⤵
      PID:4320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1983680579892292042,6321175402841593979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3988 /prefetch:1
      4⤵
      PID:3980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1983680579892292042,6321175402841593979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
      4⤵
      PID:4460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,1983680579892292042,6321175402841593979,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:8
      4⤵
      PID:1520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,1983680579892292042,6321175402841593979,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1983680579892292042,6321175402841593979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
      4⤵
      PID:3212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1983680579892292042,6321175402841593979,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
      4⤵
      PID:4724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1983680579892292042,6321175402841593979,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
      4⤵
      PID:1796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1983680579892292042,6321175402841593979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
      4⤵
      PID:3348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1983680579892292042,6321175402841593979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1844 /prefetch:1
      4⤵
      PID:2272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1983680579892292042,6321175402841593979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
      4⤵
      PID:1624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,1983680579892292042,6321175402841593979,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3492 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2248

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e57c259.rbs

Path C:\Config.Msi\e57c259.rbs
Size 1.2MB
SHA256 78fb50fcd11cdc829fb4be64132ce392c09ae284ecb5d75c236f7c3303e9bca2
MD5 0ffe5b8304402166b77105cd08e446c1
SHA1 dd40877b6d237614cc848ddcf7d42e34074295f4
SHA512 ed9427906eaf9d7c123a075c3bbbbb9ea64f0102ca8f8c7a7cf5b1698cae983cb0b328774c12ee4b104c27cab8c45a9e460d8250d1f0336ed49496792ee63935
SSDEEP 24576:fKd6BSOx4NHcDfVI0g6TjKd6BSOx4NHcDfVI0g6TA:ftB7WHgVI0g6TjtB7WHgVI0g6TA
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89
MD5 e765f3d75e6b0e4a7119c8b14d47d8da
SHA1 cc9f7c7826c2e1a129e7d98884926076c3714fc0
SHA512 a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771
MD5 53bc70ecb115bdbabe67620c416fe9b3
SHA1 af66ec51a13a59639eaf54d62ff3b4f092bb2fc1
SHA512 cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 e91b81550d65d5bd41b275df9483f25cd98c72c8f2e01d34de6d32e278adbec4
MD5 c622584823f7eb9a0afb35dbe6e5fdcc
SHA1 c783ff4b7b0ddd3325aa1dca13471e4e5a82622a
SHA512 56eb5d73f5720fe2f0fc2e2146a31e3bcd9a9f89011be98a9704049658d8bff475c61721c93c624f2cfd9f8039df8772f6c835482d4f98da50825edbfe555a86
SSDEEP 96:nDk/UU1B1tQwpvWMoiVmdeH85qx9+UWQyV+VDCziEwb:nDk/pf1tQGWMXX+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 e0c8fe908885adf346a8d86defca7ae2c7678373bab599e8dc024c2b1d5b3068
MD5 183f12e7793a422a71438b00fb5fdcc8
SHA1 fbbe232db200792249c39c0f6a19813205642e77
SHA512 64b45b4a550f2039ddc20f8d36faf4e5ea791c23204af34dc02be2125d2c5af852323be5ebb7f669340702c8bb9a6257f4a45812abe20c456d3a4e97a73fb36c
SSDEEP 96:nDk/hU1BdtQwpvWMoiVmdeH85qx9+UWQyV+VD7AiEwb:nDk/yfdtQGWMXX+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 f65c74a19819544007b6fb07404e1ce192af767b3a6bc90d1f36de6b11edbbf3
MD5 c831fd8141dbff3eb916a0ea0011eee0
SHA1 261a0e105878c5de82748f4a9f8273f8e01046ec
SHA512 df3a02bd8e925c1af6b2ddc768fec34b099ba2e7a0cb43cd44d6c18fc624e2046e2d7491c1d7527b693f9a5e64846cf6740aa1cdd57e22736cc9ef202968ef05
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup6hRclje2RUzv/7i+Bs0KVM:A9iIxuERzA83h09RZxYqozqTVVKo3Z4k
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 e85e94a9c4db993b9116bf67d9a178418984f480a519b1897af32249fbf4e850
MD5 4daf53c2146b6f9f8062de69832bc495
SHA1 0fdb6eee0d24511ef201d731228b20c5fd8072e3
SHA512 6766e37cbe498d268e0c6558c579995a6a5c348eff1bdc7db4ec0ae586fbfeb3a1ec27c2c174d2174383b52cd9405ed76d43808e922baa728e74ed271fcfb8f8
SSDEEP 192:KoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup6hRclje2RUzv/7i+us0KVM:O9iIxuERzA83h09RZxYqozqTVMKo3Z4k
MD5 SHA1 SHA512 SSDEEP

Submit Download

www.microsoft[1].xml

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\T2PP8W3E\www.microsoft[1].xml
Size 13B
SHA256 b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
MD5 c1ddea3ef6bbef3e7060a1a9ad89e4c5
SHA1 35e3224fcbd3e1af306f2b6a2c6bbea9b0867966
SHA512 6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed
MD5 SHA1 SHA512

Submit Download

imagestore.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\alhffcs\imagestore.dat
Size 17KB
SHA256 bc3a59d9f06f04d96f3c7a53fbbabd829380a67a628312f4750950d19147b7cf
MD5 db74deb583e4d231c285ed0a2416f6b7
SHA1 897e4480ff05ec45baa2523c2836390eb58ff312
SHA512 0b5ff23602e83fac74d91fdb0251a026b14ab7a6ab8095df401c4aab915a8b8452756c0b6f7d7115e93cb0d5f14f5407bc4cd2b97d6d2beac14a9d0f5ad5387d
SSDEEP 48:O+h2YL+W2YL+O2YL+tgyyyyyyyyyyyyyd2YL+DC2YL+GQQQQQ82/:/2A2I2T2g2sQQQQQ82/
MD5 SHA1 SHA512 SSDEEP

Submit Download

favicon[1].ico

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BRZNMQLE\favicon[1].ico
Size 16KB
SHA256 90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21
MD5 12e3dac858061d088023b2bd48e2fa96
SHA1 e08ce1a144eceae0c3c2ea7a9d6fbc5658f24ce5
SHA512 c5030c55a855e7a9e20e22f4c70bf1e0f3c558a9b7d501cfab6992ac2656ae5e41b050ccac541efa55f9603e0d349b247eb4912ee169d44044271789c719cd01
SSDEEP 24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5 SHA1 SHA512 SSDEEP

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OD2FK6XO\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_pkrkynai.02x.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pkrkynai.02x.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

pssCB11.ps1

Path C:\Users\Admin\AppData\Local\Temp\pssCB11.ps1
Size 6.9MB
SHA256 6bf3436398321d39c4d50238146d128bb1ab298dc8adb3f7a40bfee70ea4b019
MD5 ece69cb91450cce6f1cd5f688e5a9fe3
SHA1 159678690987c8d306343e1ca58d0934393d97ef
SHA512 23cd307395d0c5dd88d9ddbdc4a4d41010bb4146812a2536935c5ad34d1300688c3e0c644187849c4eb971318b0fac55a2d340b10f528d239f96b836a3861856
SSDEEP 49152:nWXGPNIs6bsnU8SXayEi5TJOvtMc55Mg8vBycfW4+37Y7LeW:g
MD5 SHA1 SHA512 SSDEEP

Submit Download

pssCB60.ps1

Path C:\Users\Admin\AppData\Local\Temp\pssCB60.ps1
Size 5KB
SHA256 9c5ab0fcb8a19c75aec49a7686ebdf54b114467ea09306804df8fb9122dcdc03
MD5 b84ff6f3cba4a8b533829578673e9b4c
SHA1 e1fe6f53e322f734d8d86e989c6ab2c022d781d3
SHA512 9306a6bd4b9f2ae1592e9d9b53702e603b343064f6858ce02471d446fd34eee252d1654df904957523e487a39662356fa2e16e939c311f275d56dc8c00e5ba59
SSDEEP 24:QCGTjAuARQvAD5V4zzLFAmhm/YMMtEzfug/Au6+w7uVIj9u92VFo1OWGvFnpVAEq:QT/cPVRm7tGDckORgc/jy
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSIC331.tmp

Path C:\Windows\Installer\MSIC331.tmp
Size 379KB
SHA256 f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f
MD5 305a50c391a94b42a68958f3f89906fb
SHA1 4110d68d71f3594f5d3bdfca91a1c759ab0105d4
SHA512 fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7
SSDEEP 6144:AtBnIPLnkhsByA5mx1d6N/mFoO86j6HHIBVjdpU2bupEP4xzGi6Sc9AOZ0MrVK2Z:AtBqnkbIQ6HHI/RpXupEP49v63zLrVVb
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSIC4D9.tmp

Path C:\Windows\Installer\MSIC4D9.tmp
Size 404KB
SHA256 55ad26c17f4aac71e6db6a6edee6ebf695510dc7e533e3fee64afc3eb06291e5
MD5 a34d4f165087b11d9e06781d52262868
SHA1 1b7b6a5bb53b7c12fb45325f261ad7a61b485ce1
SHA512 aa62ff3b601ddb83133dd3659b0881f523454dc7eea921da7cfefc50426e70bb36b4ebc337a8f16620da610784a81a8e4aa1cf5e0959d28aa155d1f026a81aaf
SSDEEP 12288:i4HyzQyz5io+HEbdG7U674UdfE+jwbuTphIvQZy9q8oi9:iyyzQyz5io+HExGWUAyiqZI
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSIC5E6.tmp

Path C:\Windows\Installer\MSIC5E6.tmp
Size 602KB
SHA256 9f903a637445d2df9923044939130135073112ec2e35a2c3e7a04da67d84c39a
MD5 7a65c26658055067c9bdf80f1ec7e3da
SHA1 58182a420b1c2b89600d8bd3dc62be20a48af3a8
SHA512 852f75b1cb59b420324e2b9183cc506a6697d984ad867546e147b8abb2efe110fbceea6094036e987ad5783268f63bf6d4a50e12446e6fcd1fc65503c6f20d65
SSDEEP 12288:9iVKdSVP8g9Ug3dqBqaOG0UWGZWo/yuIW+z+PE+bSnjffVfAGPdG6Tt:iKd6BSOx4NHcDfVI0g6Tt
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSIC6F1.tmp

Path C:\Windows\Installer\MSIC6F1.tmp
Size 620KB
SHA256 b3eb3c8ce966d12566acde81fdcff35ff2099f8620846e00a5a4b84e93aa57e5
MD5 f3f72d9186aa2805d8bb2b770b488ed2
SHA1 b26248f1b9aaaba4b6bda2e193a6ecbf669e12d4
SHA512 8e44b27d75480040e0810ce5620433950e5d3bc3374d508f045cdbe87cc659d522d160bb05a8e3ead77061bfde43a23f788f75903fc7551dab252df48ab48050
SSDEEP 12288:bKG7e/E22j/f/fZwqVYXV8V7RWypBqZVjrbYzb4E1w+s5elOZI+PIurI1C/sh/Qq:bf7MV8V7RWypBqZVj3Y/4YwOYmhYDyYk
MD5 SHA1 SHA512 SSDEEP

Submit Download

dbghelp.dll

Path C:\meadowing\dbghelp.dll
Size 6.2MB
SHA256 4e8607c498e63e9f66b53e26099ddad5ad663ed36c99000ebb9e11d6f16469fa
MD5 e60f51e8b4c82a53c4d184741f5fae37
SHA1 e238ce4e7b4fae25348610b8e0217bc528115f36
SHA512 c7d4a60d82374256d54a0d752d644162d8b9e80e018eaf04ce2144e731eee4182865e2fa9a7fa23c6ce3a90c49152496e122c20fdf3b9595c29e074839a54318
SSDEEP 196608:fJEbIMc7OC6hNooQDDximPZSR8771vmlelG1vtduif7Rv755eHLSYy5sn41tQ0:WbkiCFRDDximPZSS71vm0luvtYm641tp
MD5 SHA1 SHA512 SSDEEP

Submit Download

tampering.exe

Path C:\meadowing\tampering.exe
Size 446KB
SHA256 054b01984bdebaf673506849cccae7c329209245f3cbc0f6d366bba1294658df
MD5 b3b871e6016b1d02f7fa35cb885e7d8f
SHA1 78b97c60a8e4caa1058e35c5a3c58375fc126e95
SHA512 36e4eb7c066368bdf668a4356ebb3f00a8aad48770808241fc4686711c78a9c695837a73400de83286383d6cc189e17c4d094f2c68b62e2a18c7be6e7ceaf5b3
SSDEEP 12288:aKmRE3LJjlPbct7duQb4Od01AJGS3mrxWI7n3OqiHThrmotbY7rSrZWZlJmwJI+h:Ce33U01AJGS3mrxWI7n3OqiHThrmotbS
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1116-101-0x000000000E610000-0x000000000EC8A000-memory.dmp

Download

memory/1116-68-0x0000000005A50000-0x0000000005AB6000-memory.dmp

Download

memory/1116-95-0x000000000D0F0000-0x000000000D186000-memory.dmp

Download

memory/1116-80-0x00000000060B0000-0x00000000060FC000-memory.dmp

Download

memory/1116-79-0x0000000006090000-0x00000000060AE000-memory.dmp

Download

memory/1116-78-0x0000000005AC0000-0x0000000005E14000-memory.dmp

Download

memory/1116-98-0x000000000D080000-0x000000000D0A2000-memory.dmp

Download

memory/1116-100-0x000000000D9E0000-0x000000000DF84000-memory.dmp

Download

memory/1116-67-0x00000000059E0000-0x0000000005A46000-memory.dmp

Download

memory/1116-96-0x0000000006670000-0x000000000668A000-memory.dmp

Download

memory/1116-66-0x00000000050E0000-0x0000000005102000-memory.dmp

Download

memory/1116-65-0x0000000005180000-0x00000000057A8000-memory.dmp

Download

memory/1116-62-0x0000000002B00000-0x0000000002B36000-memory.dmp

Download

memory/4364-169-0x000000006C840000-0x000000006CE79000-memory.dmp

Download