82f58171b159067bd974be1c356cdcc15a668fa0f89455a4959bb2c9fe12b306

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2024, 21:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a3b21.msi
Size

1.9MB
MD5

38a5c5f8df9a03003650d975d5b7bc0f
SHA1

b961e5ed74f2297b3425c1cb2b5cd68dba622ddc
SHA256

82f58171b159067bd974be1c356cdcc15a668fa0f89455a4959bb2c9fe12b306
SHA512

44ff21728e2deb0f56c197f573283307580640a5af819877808681d191f428cafc280ea4636ec566e6ccd6ccd97f04985d99a73f9099a46ec1fe7fe3e3f1f7c7
SSDEEP

24576:Pt9cpVDhiMtsHyJuHQDkXPe9+noxv1Hn:YpRhiMiHeuqkfe9pxv1H

Score

7^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4584	ICACLS.EXE

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	cmd.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	EXPAND.EXE
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	EXPAND.EXE
File opened for modification	C:\Windows\Installer\e579c4f.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9D2A.tmp	msiexec.exe
File created	C:\Windows\Installer\e579c4f.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{011986F4-FBE1-4600-AEF4-FCBCCF365CC9}	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Executes dropped EXE 1 IoCs

pid	Process
3444	setup.exe

Loads dropped DLL 1 IoCs

pid	Process
2444	MsiExec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2696	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ICACLS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXPAND.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000f914d34881601a250000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000f914d3480000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900f914d348000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1df914d348000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000f914d34800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2236	msiexec.exe
2236	msiexec.exe
1536	msedge.exe
1536	msedge.exe
1684	msedge.exe
1684	msedge.exe
5492	identity_helper.exe
5492	identity_helper.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2696	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2696	msiexec.exe
Token: SeSecurityPrivilege	2236	msiexec.exe
Token: SeCreateTokenPrivilege	2696	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2696	msiexec.exe
Token: SeLockMemoryPrivilege	2696	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2696	msiexec.exe
Token: SeMachineAccountPrivilege	2696	msiexec.exe
Token: SeTcbPrivilege	2696	msiexec.exe
Token: SeSecurityPrivilege	2696	msiexec.exe
Token: SeTakeOwnershipPrivilege	2696	msiexec.exe
Token: SeLoadDriverPrivilege	2696	msiexec.exe
Token: SeSystemProfilePrivilege	2696	msiexec.exe
Token: SeSystemtimePrivilege	2696	msiexec.exe
Token: SeProfSingleProcessPrivilege	2696	msiexec.exe
Token: SeIncBasePriorityPrivilege	2696	msiexec.exe
Token: SeCreatePagefilePrivilege	2696	msiexec.exe
Token: SeCreatePermanentPrivilege	2696	msiexec.exe
Token: SeBackupPrivilege	2696	msiexec.exe
Token: SeRestorePrivilege	2696	msiexec.exe
Token: SeShutdownPrivilege	2696	msiexec.exe
Token: SeDebugPrivilege	2696	msiexec.exe
Token: SeAuditPrivilege	2696	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2696	msiexec.exe
Token: SeChangeNotifyPrivilege	2696	msiexec.exe
Token: SeRemoteShutdownPrivilege	2696	msiexec.exe
Token: SeUndockPrivilege	2696	msiexec.exe
Token: SeSyncAgentPrivilege	2696	msiexec.exe
Token: SeEnableDelegationPrivilege	2696	msiexec.exe
Token: SeManageVolumePrivilege	2696	msiexec.exe
Token: SeImpersonatePrivilege	2696	msiexec.exe
Token: SeCreateGlobalPrivilege	2696	msiexec.exe
Token: SeBackupPrivilege	2132	vssvc.exe
Token: SeRestorePrivilege	2132	vssvc.exe
Token: SeAuditPrivilege	2132	vssvc.exe
Token: SeBackupPrivilege	2236	msiexec.exe
Token: SeRestorePrivilege	2236	msiexec.exe
Token: SeRestorePrivilege	2236	msiexec.exe
Token: SeTakeOwnershipPrivilege	2236	msiexec.exe
Token: SeRestorePrivilege	2236	msiexec.exe
Token: SeTakeOwnershipPrivilege	2236	msiexec.exe
Token: SeBackupPrivilege	2496	srtasks.exe
Token: SeRestorePrivilege	2496	srtasks.exe
Token: SeSecurityPrivilege	2496	srtasks.exe
Token: SeTakeOwnershipPrivilege	2496	srtasks.exe
Token: SeBackupPrivilege	2496	srtasks.exe
Token: SeRestorePrivilege	2496	srtasks.exe
Token: SeSecurityPrivilege	2496	srtasks.exe
Token: SeTakeOwnershipPrivilege	2496	srtasks.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2696	msiexec.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2496	2236	msiexec.exe	102
PID 2236 wrote to memory of 2496	2236	msiexec.exe	102
PID 2236 wrote to memory of 2444	2236	msiexec.exe	104
PID 2236 wrote to memory of 2444	2236	msiexec.exe	104
PID 2236 wrote to memory of 2444	2236	msiexec.exe	104
PID 2444 wrote to memory of 4584	2444	MsiExec.exe	107
PID 2444 wrote to memory of 4584	2444	MsiExec.exe	107
PID 2444 wrote to memory of 4584	2444	MsiExec.exe	107
PID 2444 wrote to memory of 4484	2444	MsiExec.exe	109
PID 2444 wrote to memory of 4484	2444	MsiExec.exe	109
PID 2444 wrote to memory of 4484	2444	MsiExec.exe	109
PID 2444 wrote to memory of 648	2444	MsiExec.exe	114
PID 2444 wrote to memory of 648	2444	MsiExec.exe	114
PID 2444 wrote to memory of 648	2444	MsiExec.exe	114
PID 648 wrote to memory of 1684	648	cmd.exe	116
PID 648 wrote to memory of 1684	648	cmd.exe	116
PID 1684 wrote to memory of 4956	1684	msedge.exe	117
PID 1684 wrote to memory of 4956	1684	msedge.exe	117
PID 1684 wrote to memory of 4564	1684	msedge.exe	119
PID 1684 wrote to memory of 4564	1684	msedge.exe	119
PID 1684 wrote to memory of 4564	1684	msedge.exe	119
PID 1684 wrote to memory of 4564	1684	msedge.exe	119
PID 1684 wrote to memory of 4564	1684	msedge.exe	119
PID 1684 wrote to memory of 4564	1684	msedge.exe	119
PID 1684 wrote to memory of 4564	1684	msedge.exe	119
PID 1684 wrote to memory of 4564	1684	msedge.exe	119
PID 1684 wrote to memory of 4564	1684	msedge.exe	119
PID 1684 wrote to memory of 4564	1684	msedge.exe	119
PID 1684 wrote to memory of 4564	1684	msedge.exe	119
PID 1684 wrote to memory of 4564	1684	msedge.exe	119
PID 1684 wrote to memory of 4564	1684	msedge.exe	119
PID 1684 wrote to memory of 4564	1684	msedge.exe	119
PID 1684 wrote to memory of 4564	1684	msedge.exe	119
PID 1684 wrote to memory of 4564	1684	msedge.exe	119
PID 1684 wrote to memory of 4564	1684	msedge.exe	119
PID 1684 wrote to memory of 4564	1684	msedge.exe	119
PID 1684 wrote to memory of 4564	1684	msedge.exe	119
PID 1684 wrote to memory of 4564	1684	msedge.exe	119
PID 1684 wrote to memory of 4564	1684	msedge.exe	119
PID 1684 wrote to memory of 4564	1684	msedge.exe	119
PID 1684 wrote to memory of 4564	1684	msedge.exe	119
PID 1684 wrote to memory of 4564	1684	msedge.exe	119
PID 1684 wrote to memory of 4564	1684	msedge.exe	119
PID 1684 wrote to memory of 4564	1684	msedge.exe	119
PID 1684 wrote to memory of 4564	1684	msedge.exe	119
PID 1684 wrote to memory of 4564	1684	msedge.exe	119
PID 1684 wrote to memory of 4564	1684	msedge.exe	119
PID 1684 wrote to memory of 4564	1684	msedge.exe	119
PID 1684 wrote to memory of 4564	1684	msedge.exe	119
PID 1684 wrote to memory of 4564	1684	msedge.exe	119
PID 1684 wrote to memory of 4564	1684	msedge.exe	119
PID 1684 wrote to memory of 4564	1684	msedge.exe	119
PID 1684 wrote to memory of 4564	1684	msedge.exe	119
PID 1684 wrote to memory of 4564	1684	msedge.exe	119
PID 1684 wrote to memory of 4564	1684	msedge.exe	119
PID 1684 wrote to memory of 4564	1684	msedge.exe	119
PID 1684 wrote to memory of 4564	1684	msedge.exe	119
PID 1684 wrote to memory of 4564	1684	msedge.exe	119
PID 1684 wrote to memory of 1536	1684	msedge.exe	120
PID 1684 wrote to memory of 1536	1684	msedge.exe	120
PID 1684 wrote to memory of 2580	1684	msedge.exe	121
PID 1684 wrote to memory of 2580	1684	msedge.exe	121
PID 1684 wrote to memory of 2580	1684	msedge.exe	121
PID 1684 wrote to memory of 2580	1684	msedge.exe	121

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\6a3b21.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2696

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2496
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 40F237DA55C8803AC192D9A253BD8CF4
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-b4a7ca27-c18a-4440-90b6-548691ba646a\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:4584
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4484
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start msedge https://www.ipswich.gov.uk/sites/default/files/ncd42_-_car_parking_what_works_where.pdf
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.ipswich.gov.uk/sites/default/files/ncd42_-_car_parking_what_works_where.pdf
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:1684
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff91cf746f8,0x7ff91cf74708,0x7ff91cf74718
        5⤵
        
        PID:4956
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,12116615542049979531,8388648107129551199,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
        5⤵
        
        PID:4564
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,12116615542049979531,8388648107129551199,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1536
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,12116615542049979531,8388648107129551199,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
        5⤵
        
        PID:2580
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12116615542049979531,8388648107129551199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
        5⤵
        
        PID:1688
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12116615542049979531,8388648107129551199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
        5⤵
        
        PID:2244
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12116615542049979531,8388648107129551199,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
        5⤵
        
        PID:2840
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --field-trial-handle=2152,12116615542049979531,8388648107129551199,131072 --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=5132 /prefetch:6
        5⤵
        
        PID:4484
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12116615542049979531,8388648107129551199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
        5⤵
        
        PID:4084
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12116615542049979531,8388648107129551199,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
        5⤵
        
        PID:1796
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,12116615542049979531,8388648107129551199,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5796 /prefetch:8
        5⤵
        
        PID:5148
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,12116615542049979531,8388648107129551199,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5796 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5492
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12116615542049979531,8388648107129551199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
        5⤵
        
        PID:5624
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12116615542049979531,8388648107129551199,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
        5⤵
        
        PID:5632
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,12116615542049979531,8388648107129551199,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1864 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4296
- - C:\Users\Admin\AppData\Local\Temp\MW-b4a7ca27-c18a-4440-90b6-548691ba646a\files\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\MW-b4a7ca27-c18a-4440-90b6-548691ba646a\files\setup.exe" /VERYSILENT /VERYSILENT
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3444

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

File and Directory Permissions Modification

T1222

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2708a320abc3deac9c12e638111e7197

SHA1
5fa9d8b202913d920c1428679ee05c9f32c6a30e

SHA256
3529ad689dcd2e56bcb41144076efbc9d6f6857a84998ab94c6960a07b187877

SHA512
8b683d3f57a4ef9c9da21cf45d4b4105a3cb8febf63ffbfabf82c33a7eba9110b806f25a369a495cdacf67b5797e6872dd6f23f612f64ff0281408510beac7f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
eff7ded271548679a67b21ba4714ea76

SHA1
87195669ed98fafa5ed899ec8d41845a3119c144

SHA256
6c68f38576a824560d23f9e10d38aeecb97698aeb0fc99b3bcc500ae61d5b82e

SHA512
50499f3b3a5232eedc8b5ed778ed773e7ad156a6fdf3d0435ad23bc7e90dd76ff089e5d48341db535c618573d8c9fbf0fe7298977a1068205434529e175c1bfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
48d2197b8d4378186d699a203c0db6f3

SHA1
1ccc579e8faf18c8126caad1eda778aee0a6b0be

SHA256
ac6d080433c282609771d6541d2211517436321b05f14c33ece6e183d105c0f7

SHA512
5833f08cef89f0371c7d5e1b8c140e0f5ab179bc9b31979ead4da550a4ab7ce723a65c5602fd3617ba6fb2aea832dab178369707ca01dc81359d8a93f0c4b14e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-b4a7ca27-c18a-4440-90b6-548691ba646a\files.cab

Filesize
1.6MB

MD5
fd9377242e4d124479ded7c3cdcebbf1

SHA1
44952da56e4da2616c37a13cbf5c5d1ca35e391a

SHA256
a40f3fe0b8e33ff46a76b1e67e3571827ee3a8115fadacedf1076528ac89517d

SHA512
86e32ce6798c89de871c22d6ede382af0b9a993203c6e05ebff1908dc546b265c7b90049703a75b833f2253173dd1f2c8bfdae50b5cf7e87518694f16fc7f787

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-b4a7ca27-c18a-4440-90b6-548691ba646a\msiwrapper.ini

Filesize
1KB

MD5
09926beede57434c1ced1d004452ae7c

SHA1
bf41d55c2851d9fca12f6146cdb088d7edf153e7

SHA256
0c11e7a710fcb81c187c9dbaca280c3177e5e53e05c52b8587ebfdcac2edb510

SHA512
dd81c4f0a70bd29051114e27e17ae15b79dacf79a976a441b1ce56178d43ab46da4a5711486020f4baa7cb0b94f83c04c44bf7dc5bc5473cf00eea55099d91ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-b4a7ca27-c18a-4440-90b6-548691ba646a\msiwrapper.ini

Filesize
1KB

MD5
ae8368b4abcd9e699f3762b97ed39b71

SHA1
0b83ba1e0e00ddce55714217ba089fd0def9387b

SHA256
7635254221ca8cf96372c34ee00d0a0def0caf6b25e14d74231c92a9d906e3b3

SHA512
6f949520ba341c9f196a21959ef463b31187407c65888ae1a06cbc8e82a689f9fe5783e5af914a16d8075ddbbb5316bd32c8d8a8910981d73327305b21829c4f

Download Submit
C:\Windows\Installer\MSI9D2A.tmp

Filesize
208KB

MD5
0c8921bbcc37c6efd34faf44cf3b0cb5

SHA1
dcfa71246157edcd09eecaf9d4c5e360b24b3e49

SHA256
fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1

SHA512
ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.1MB

MD5
bb2fbcda3ab3074a0a79b07fc9c96670

SHA1
c5ccfbf859cbc5eff74ece3f46320d8cb42152a2

SHA256
4f51b8ec1863b065c5eb22b35d6bfab89a5a4c508bba2cd253523ceebd528630

SHA512
77131de89c4934ff2bf9bb97c30494fd81d947ec9fa9ebf7d7a6a0e757d370c1baad8eea83d0c324de81f5790f24ceb5cfe2bc310f8b7c50b1963d0c9a586c96

Download Submit
\??\Volume{48d314f9-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{c9ef9f64-50ed-4939-91c4-44586ea959dd}_OnDiskSnapshotProp

Filesize
6KB

MD5
abf35c22360e5ea2e5270c66f3fe8f52

SHA1
082d3f61a7886422902148dafada5bdf82ca002a

SHA256
272447abd4c1cbba35c82f0b9221f13277e5c7f90dc2cd50f13b97d5d16ab62d

SHA512
fb91099fc90a012042c14fae010d45318f0c854e992955fff0c65005e386efde811dbd9816482129b5585e183471e02cf38f27c3dcf5e56fd7a91f15e9edddd5

Download Submit