metastealer | 60f172403738997a3e49ba5b7b247854bc45b42db5895c47d43b0b0ed86588c1

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-12-2024 11:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

56ff7c.msi
Size

1.9MB
MD5

dc1dacc4a53407aebffc38ef512f52e7
SHA1

737e0c4312552da152f009bdce0f9048e368fee1
SHA256

60f172403738997a3e49ba5b7b247854bc45b42db5895c47d43b0b0ed86588c1
SHA512

9685d5c2a48d334814599fc0f8f05dcc9af441a30d09f034030f01158648a2ffd25febfad1e4237457b1de8adb9765f005c3549624dd588f73cc738a2ed62cba
SSDEEP

24576:vt9cpVDhol4Cw4o72KP8MgRhG52dt3JJCyrdEnlBj:4pRho2XN2Q8xhGQP6QdE

Score

10^/10

metastealer discovery execution persistence privilege_escalation spyware stealer

Malware Config

Extracted

Family

metastealer

kiyaqoimsiieeyqa.xyz

ssqsmisuowqcwsqo.xyz

ykqmwgsuummieaug.xyz

ewukeskgqswqesiw.xyz

cscqcsgewmwwaaui.xyz

cyoksykiamiscyia.xyz

okgomokemoucqeso.xyz

ikwacuakiqeimwua.xyz

aawcsqqaywckiwmi.xyz

aiqasksgmyeqocei.xyz

qgumcuisgaeyuqqe.xyz

eiesoycamyqqgcea.xyz

ywceswakicsqomqw.xyz

auaieuewouawygku.xyz

cmiascusccywowcs.xyz

uiqkkomkaceqacec.xyz

quqeciymqmkqccqw.xyz

ssqsauuuyyigouou.xyz

aogaakukuugqswcy.xyz

ucgwcwsuqsuwewgc.xyz

Attributes

dga_seed
21845
domain_length
16
num_dga_domains
10000
port
443

Signatures

Meta Stealer
Meta Stealer steals passwords stored in browsers, written in C++.
stealer metastealer

MetaStealer payload 1 IoCs

resource	yara_rule
behavioral2/memory/4352-170-0x0000000010000000-0x0000000010731000-memory.dmp	family_metastealer

Metastealer family
metastealer

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4848	powershell.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4104	ICACLS.EXE

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	cmd.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e57e30d.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{740864D8-D5D4-4230-8D1D-1C2E0E22C8A6}	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	EXPAND.EXE
File opened for modification	C:\Windows\Installer\e57e30d.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE407.tmp	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	EXPAND.EXE

Executes dropped EXE 1 IoCs

pid	Process
4352	install86.exe

Loads dropped DLL 1 IoCs

pid	Process
372	MsiExec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3080	msiexec.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ICACLS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXPAND.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	install86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e3c1c56297b3270b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e3c1c5620000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900e3c1c562000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de3c1c562000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000e3c1c56200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
5768	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
1392	msiexec.exe
1392	msiexec.exe
4368	msedge.exe
4368	msedge.exe
956	msedge.exe
956	msedge.exe
5196	identity_helper.exe
5196	identity_helper.exe
4848	powershell.exe
4848	powershell.exe
4848	powershell.exe
4352	install86.exe
4352	install86.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3080	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3080	msiexec.exe
Token: SeSecurityPrivilege	1392	msiexec.exe
Token: SeCreateTokenPrivilege	3080	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3080	msiexec.exe
Token: SeLockMemoryPrivilege	3080	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3080	msiexec.exe
Token: SeMachineAccountPrivilege	3080	msiexec.exe
Token: SeTcbPrivilege	3080	msiexec.exe
Token: SeSecurityPrivilege	3080	msiexec.exe
Token: SeTakeOwnershipPrivilege	3080	msiexec.exe
Token: SeLoadDriverPrivilege	3080	msiexec.exe
Token: SeSystemProfilePrivilege	3080	msiexec.exe
Token: SeSystemtimePrivilege	3080	msiexec.exe
Token: SeProfSingleProcessPrivilege	3080	msiexec.exe
Token: SeIncBasePriorityPrivilege	3080	msiexec.exe
Token: SeCreatePagefilePrivilege	3080	msiexec.exe
Token: SeCreatePermanentPrivilege	3080	msiexec.exe
Token: SeBackupPrivilege	3080	msiexec.exe
Token: SeRestorePrivilege	3080	msiexec.exe
Token: SeShutdownPrivilege	3080	msiexec.exe
Token: SeDebugPrivilege	3080	msiexec.exe
Token: SeAuditPrivilege	3080	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3080	msiexec.exe
Token: SeChangeNotifyPrivilege	3080	msiexec.exe
Token: SeRemoteShutdownPrivilege	3080	msiexec.exe
Token: SeUndockPrivilege	3080	msiexec.exe
Token: SeSyncAgentPrivilege	3080	msiexec.exe
Token: SeEnableDelegationPrivilege	3080	msiexec.exe
Token: SeManageVolumePrivilege	3080	msiexec.exe
Token: SeImpersonatePrivilege	3080	msiexec.exe
Token: SeCreateGlobalPrivilege	3080	msiexec.exe
Token: SeBackupPrivilege	3520	vssvc.exe
Token: SeRestorePrivilege	3520	vssvc.exe
Token: SeAuditPrivilege	3520	vssvc.exe
Token: SeBackupPrivilege	1392	msiexec.exe
Token: SeRestorePrivilege	1392	msiexec.exe
Token: SeRestorePrivilege	1392	msiexec.exe
Token: SeTakeOwnershipPrivilege	1392	msiexec.exe
Token: SeRestorePrivilege	1392	msiexec.exe
Token: SeTakeOwnershipPrivilege	1392	msiexec.exe
Token: SeBackupPrivilege	2356	srtasks.exe
Token: SeRestorePrivilege	2356	srtasks.exe
Token: SeSecurityPrivilege	2356	srtasks.exe
Token: SeTakeOwnershipPrivilege	2356	srtasks.exe
Token: SeBackupPrivilege	2356	srtasks.exe
Token: SeRestorePrivilege	2356	srtasks.exe
Token: SeSecurityPrivilege	2356	srtasks.exe
Token: SeTakeOwnershipPrivilege	2356	srtasks.exe
Token: SeDebugPrivilege	4848	powershell.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3080	msiexec.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 2356	1392	msiexec.exe	93
PID 1392 wrote to memory of 2356	1392	msiexec.exe	93
PID 1392 wrote to memory of 372	1392	msiexec.exe	95
PID 1392 wrote to memory of 372	1392	msiexec.exe	95
PID 1392 wrote to memory of 372	1392	msiexec.exe	95
PID 372 wrote to memory of 4104	372	MsiExec.exe	96
PID 372 wrote to memory of 4104	372	MsiExec.exe	96
PID 372 wrote to memory of 4104	372	MsiExec.exe	96
PID 372 wrote to memory of 1468	372	MsiExec.exe	98
PID 372 wrote to memory of 1468	372	MsiExec.exe	98
PID 372 wrote to memory of 1468	372	MsiExec.exe	98
PID 372 wrote to memory of 4664	372	MsiExec.exe	103
PID 372 wrote to memory of 4664	372	MsiExec.exe	103
PID 372 wrote to memory of 4664	372	MsiExec.exe	103
PID 4664 wrote to memory of 956	4664	cmd.exe	105
PID 4664 wrote to memory of 956	4664	cmd.exe	105
PID 956 wrote to memory of 1396	956	msedge.exe	106
PID 956 wrote to memory of 1396	956	msedge.exe	106
PID 956 wrote to memory of 3600	956	msedge.exe	108
PID 956 wrote to memory of 3600	956	msedge.exe	108
PID 956 wrote to memory of 3600	956	msedge.exe	108
PID 956 wrote to memory of 3600	956	msedge.exe	108
PID 956 wrote to memory of 3600	956	msedge.exe	108
PID 956 wrote to memory of 3600	956	msedge.exe	108
PID 956 wrote to memory of 3600	956	msedge.exe	108
PID 956 wrote to memory of 3600	956	msedge.exe	108
PID 956 wrote to memory of 3600	956	msedge.exe	108
PID 956 wrote to memory of 3600	956	msedge.exe	108
PID 956 wrote to memory of 3600	956	msedge.exe	108
PID 956 wrote to memory of 3600	956	msedge.exe	108
PID 956 wrote to memory of 3600	956	msedge.exe	108
PID 956 wrote to memory of 3600	956	msedge.exe	108
PID 956 wrote to memory of 3600	956	msedge.exe	108
PID 956 wrote to memory of 3600	956	msedge.exe	108
PID 956 wrote to memory of 3600	956	msedge.exe	108
PID 956 wrote to memory of 3600	956	msedge.exe	108
PID 956 wrote to memory of 3600	956	msedge.exe	108
PID 956 wrote to memory of 3600	956	msedge.exe	108
PID 956 wrote to memory of 3600	956	msedge.exe	108
PID 956 wrote to memory of 3600	956	msedge.exe	108
PID 956 wrote to memory of 3600	956	msedge.exe	108
PID 956 wrote to memory of 3600	956	msedge.exe	108
PID 956 wrote to memory of 3600	956	msedge.exe	108
PID 956 wrote to memory of 3600	956	msedge.exe	108
PID 956 wrote to memory of 3600	956	msedge.exe	108
PID 956 wrote to memory of 3600	956	msedge.exe	108
PID 956 wrote to memory of 3600	956	msedge.exe	108
PID 956 wrote to memory of 3600	956	msedge.exe	108
PID 956 wrote to memory of 3600	956	msedge.exe	108
PID 956 wrote to memory of 3600	956	msedge.exe	108
PID 956 wrote to memory of 3600	956	msedge.exe	108
PID 956 wrote to memory of 3600	956	msedge.exe	108
PID 956 wrote to memory of 3600	956	msedge.exe	108
PID 956 wrote to memory of 3600	956	msedge.exe	108
PID 956 wrote to memory of 3600	956	msedge.exe	108
PID 956 wrote to memory of 3600	956	msedge.exe	108
PID 956 wrote to memory of 3600	956	msedge.exe	108
PID 956 wrote to memory of 3600	956	msedge.exe	108
PID 956 wrote to memory of 4368	956	msedge.exe	109
PID 956 wrote to memory of 4368	956	msedge.exe	109
PID 956 wrote to memory of 4500	956	msedge.exe	110
PID 956 wrote to memory of 4500	956	msedge.exe	110
PID 956 wrote to memory of 4500	956	msedge.exe	110
PID 956 wrote to memory of 4500	956	msedge.exe	110

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\56ff7c.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3080

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2356
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6A48DF8C505977FED7B0E2C50EA9159E
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:372
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-dc356582-0c30-4c04-be71-9c453bfbaf64\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:4104
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:1468
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start msedge https://www.med.unc.edu/webguide/wp-content/uploads/sites/419/2019/07/AdobePDF.pdf
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.med.unc.edu/webguide/wp-content/uploads/sites/419/2019/07/AdobePDF.pdf
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:956
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe0b2a46f8,0x7ffe0b2a4708,0x7ffe0b2a4718
        5⤵
        
        PID:1396
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,17429100535548512183,17038125815134638837,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
        5⤵
        
        PID:3600
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,17429100535548512183,17038125815134638837,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4368
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,17429100535548512183,17038125815134638837,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2952 /prefetch:8
        5⤵
        
        PID:4500
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,17429100535548512183,17038125815134638837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
        5⤵
        
        PID:2436
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,17429100535548512183,17038125815134638837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
        5⤵
        
        PID:3856
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,17429100535548512183,17038125815134638837,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
        5⤵
        
        PID:3184
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --field-trial-handle=2032,17429100535548512183,17038125815134638837,131072 --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=5072 /prefetch:6
        5⤵
        
        PID:1928
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,17429100535548512183,17038125815134638837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
        5⤵
        
        PID:4440
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,17429100535548512183,17038125815134638837,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
        5⤵
        
        PID:1336
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,17429100535548512183,17038125815134638837,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6004 /prefetch:8
        5⤵
        
        PID:5180
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,17429100535548512183,17038125815134638837,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6004 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5196
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,17429100535548512183,17038125815134638837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
        5⤵
        
        PID:5324
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,17429100535548512183,17038125815134638837,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1
        5⤵
        
        PID:5332
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,17429100535548512183,17038125815134638837,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5308 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3864
- - C:\Users\Admin\AppData\Local\Temp\MW-dc356582-0c30-4c04-be71-9c453bfbaf64\files\install86.exe
    "C:\Users\Admin\AppData\Local\Temp\MW-dc356582-0c30-4c04-be71-9c453bfbaf64\files\install86.exe" /VERYSILENT /VERYSILENT
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4352
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Microsoft\Windows\systemtask.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4848
  - - C:\Windows\SysWOW64\systeminfo.exe
      systeminfo
      4⤵
      System Location Discovery: System Language Discovery
      Gathers system information
      PID:5768

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3520

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3288

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

File and Directory Permissions Modification

T1222

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
64baf91dd1044fe9384d0e826a9546f6

SHA1
48d9f3a724f558031652ea927ca70d8c83065311

SHA256
839bbac1e05bebbefe6b25dcc2b9c0b0e144b082e3d7047d58e997167e85deaa

SHA512
4d9659fad3f7a079d4d551f71bf1f93ccd1c61620a62a96824611dd61b80a9db77b7eff4096a209a391fda17d10011414a6c216e740415c8d03e0fe3d1ae716a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fc53ebd4ec8ba2b31fbe3be429629cf8

SHA1
349f6216c73e84d40e1aa4046b3d81be64647d0d

SHA256
b629682768b01ed5dbfa7bbd72c8237b4b223c3b5c9b137587f25de82668206e

SHA512
fa3e8b2394e41cb9bbc35b106e4a7163f1af1286c44c75e0f0fe2ff21ed30c84a04a7e81f3abd8cf677d52f6124909ac6a4fdbeccd0ab3b29f69a47d6205f596

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c1a4f2596a2b72f6478d5fd3676cc71d

SHA1
97db2a3c5b92295bca10df09ec369f68c1726518

SHA256
7a37d2e7c1cbfe402fc2fc93dc02f8cb53b7757743c3513580524bec4c1d0281

SHA512
a563a60405edea1b14b8bcecb995e61085463440c3acffc66841e22e26efe9b2252e7ffbda12b5e9b489def96ee7c5fb075dc9fb9175f9b4286d30779dedc9d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-dc356582-0c30-4c04-be71-9c453bfbaf64\files.cab

Filesize
1.6MB

MD5
32ae8557d0880ecf9d0120578c3d4262

SHA1
06b7e7c8ffdbbbda50982135c5966b248d882535

SHA256
6f8cc33cb74cf753413e56b40aca479b6aa5a88edc02c8aa26a2b902f448f862

SHA512
181ebfa32f8906a9b7032b0417262b13240310e40edd76f6b45ddeb6bf3c02a083105256d0aa7b028c9c32d87b92c1add298b5e01aa38d756f2cdd386e41fa39

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-dc356582-0c30-4c04-be71-9c453bfbaf64\msiwrapper.ini

Filesize
1KB

MD5
1b657b0d558b6a988c8f62963b318dec

SHA1
aa6319cb0e1b17ed6909f57fa111cc120aed83b1

SHA256
e8133cf09a472df71e9b2f45d7bf79cc3166b96f3321a43307e3d09a6adcf712

SHA512
8551d99c56bfcc21a89025a6b24620bb08fab4876971a26488e64492e579f95c76cb8b96618d64f6fcc0578fb7594eb76ca832567035494590ec089f5666f074

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0tvvj33p.ccj.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\Installer\MSIE407.tmp

Filesize
208KB

MD5
0c8921bbcc37c6efd34faf44cf3b0cb5

SHA1
dcfa71246157edcd09eecaf9d4c5e360b24b3e49

SHA256
fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1

SHA512
ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.1MB

MD5
ad90f2b58110ba04e8f50a31b5c4bc03

SHA1
3884581597771e291c61d885d5834729cad8fc76

SHA256
72f1fa4d15302b1eb2d04bab85ea19a23ec10d5728827617c514e9c1a0f01d88

SHA512
903f0be60ccf13a03fa7d2f2ef063da97c93fb872de7565b2833250b9bd4ed91fad90822daa45b983c52aaa8394c69e5921f240d2aeefbb491f2333aeaf323fc

Download Submit
\??\Volume{62c5c1e3-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{5374a624-6581-44a6-b109-19df18689adf}_OnDiskSnapshotProp

Filesize
6KB

MD5
79385ed23d370587a59535877540ac1c

SHA1
838edc982475fc9d4c6605c3cb1f42762491e802

SHA256
fc64bc9ef8ded65af51a74db89c79c2829833a9a1db9b81a231f1cb404d3e4b6

SHA512
f4cf6f458edd7c3b237bbd00d9d5e2b28ff5786c224a8d2b219744d9b65cbecdcff69de7b4af0dbdcbbbdf45b6916d9dd9c014c3bda123d66fe0e9d96e432c80

Download Submit
memory/4352-170-0x0000000010000000-0x0000000010731000-memory.dmp

Filesize
7.2MB

Download
memory/4848-178-0x0000000005740000-0x00000000057A6000-memory.dmp

Filesize
408KB

Download
memory/4848-205-0x0000000006DD0000-0x0000000006E73000-memory.dmp

Filesize
652KB

Download
memory/4848-176-0x0000000004FA0000-0x00000000055C8000-memory.dmp

Filesize
6.2MB

Download
memory/4848-179-0x00000000057B0000-0x0000000005816000-memory.dmp

Filesize
408KB

Download
memory/4848-175-0x0000000004830000-0x0000000004866000-memory.dmp

Filesize
216KB

Download
memory/4848-189-0x0000000005920000-0x0000000005C74000-memory.dmp

Filesize
3.3MB

Download
memory/4848-191-0x0000000005DF0000-0x0000000005E0E000-memory.dmp

Filesize
120KB

Download
memory/4848-192-0x0000000005E30000-0x0000000005E7C000-memory.dmp

Filesize
304KB

Download
memory/4848-204-0x00000000063B0000-0x00000000063CE000-memory.dmp

Filesize
120KB

Download
memory/4848-194-0x000000006EAA0000-0x000000006EAEC000-memory.dmp

Filesize
304KB

Download
memory/4848-193-0x00000000063D0000-0x0000000006402000-memory.dmp

Filesize
200KB

Download
memory/4848-177-0x0000000004E40000-0x0000000004E62000-memory.dmp

Filesize
136KB

Download
memory/4848-206-0x0000000007760000-0x0000000007DDA000-memory.dmp

Filesize
6.5MB

Download
memory/4848-207-0x0000000007120000-0x000000000713A000-memory.dmp

Filesize
104KB

Download
memory/4848-208-0x0000000007180000-0x000000000718A000-memory.dmp

Filesize
40KB

Download
memory/4848-209-0x00000000073B0000-0x0000000007446000-memory.dmp

Filesize
600KB

Download
memory/4848-210-0x0000000007320000-0x0000000007331000-memory.dmp

Filesize
68KB

Download
memory/4848-211-0x0000000007350000-0x000000000735E000-memory.dmp

Filesize
56KB

Download
memory/4848-212-0x0000000007360000-0x0000000007374000-memory.dmp

Filesize
80KB

Download
memory/4848-213-0x0000000007470000-0x000000000748A000-memory.dmp

Filesize
104KB

Download
memory/4848-214-0x00000000073A0000-0x00000000073A8000-memory.dmp

Filesize
32KB

Download