metastealer | aa283d1f02c6d3c83dcc1665e9944ed54705e6c46132276c3db208d043e6ca34

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-12-2024 11:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setup (2).msi
Size

1.9MB
MD5

8b77331198791037f336022ef7e269d2
SHA1

c48ddd7547eec8417b295bcd00cbac3c34bd175b
SHA256

aa283d1f02c6d3c83dcc1665e9944ed54705e6c46132276c3db208d043e6ca34
SHA512

d841c91694094cbb1ea9b6f282748ec994c6bd0af3d037831481b9713c28dd8ae79149b93b7a30d2bcdde7875b42ad102ea81de6f99e6c4dd5f25ae7b5d947e5
SSDEEP

24576:ht9cpVDhXukQS9k2+y4csX3+4OkoorlvRaLicTOUKX:WpRhX5VxP4XO4OKrPaLNazX

Score

10^/10

metastealer discovery execution spyware stealer

Malware Config

Extracted

Family

metastealer

kiyaqoimsiieeyqa.xyz

ssqsmisuowqcwsqo.xyz

ykqmwgsuummieaug.xyz

ewukeskgqswqesiw.xyz

cscqcsgewmwwaaui.xyz

cyoksykiamiscyia.xyz

okgomokemoucqeso.xyz

ikwacuakiqeimwua.xyz

aawcsqqaywckiwmi.xyz

aiqasksgmyeqocei.xyz

qgumcuisgaeyuqqe.xyz

eiesoycamyqqgcea.xyz

ywceswakicsqomqw.xyz

auaieuewouawygku.xyz

cmiascusccywowcs.xyz

uiqkkomkaceqacec.xyz

quqeciymqmkqccqw.xyz

ssqsauuuyyigouou.xyz

aogaakukuugqswcy.xyz

ucgwcwsuqsuwewgc.xyz

Attributes

dga_seed
21845
domain_length
16
num_dga_domains
10000
port
443

Signatures

Meta Stealer
Meta Stealer steals passwords stored in browsers, written in C++.
stealer metastealer

MetaStealer payload 1 IoCs

resource	yara_rule
behavioral2/memory/556-194-0x0000000010000000-0x0000000010731000-memory.dmp	family_metastealer

Metastealer family
metastealer

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5452	powershell.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4048	ICACLS.EXE

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	cmd.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e57ab82.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	EXPAND.EXE
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAC4D.tmp	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	EXPAND.EXE
File opened for modification	C:\Windows\Installer\e57ab82.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{0B0E6C8A-C139-47E7-99E1-CFD19140782C}	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Executes dropped EXE 1 IoCs

pid	Process
556	setup.exe

Loads dropped DLL 1 IoCs

pid	Process
2308	MsiExec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ICACLS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXPAND.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000038a6760542cf76680000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000038a676050000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090038a67605000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d38a67605000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000038a6760500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
5468	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
3840	msiexec.exe
3840	msiexec.exe
4276	msedge.exe
4276	msedge.exe
3996	msedge.exe
3996	msedge.exe
1984	identity_helper.exe
1984	identity_helper.exe
5452	powershell.exe
5452	powershell.exe
5452	powershell.exe
556	setup.exe
556	setup.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2648	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2648	msiexec.exe
Token: SeSecurityPrivilege	3840	msiexec.exe
Token: SeCreateTokenPrivilege	2648	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2648	msiexec.exe
Token: SeLockMemoryPrivilege	2648	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2648	msiexec.exe
Token: SeMachineAccountPrivilege	2648	msiexec.exe
Token: SeTcbPrivilege	2648	msiexec.exe
Token: SeSecurityPrivilege	2648	msiexec.exe
Token: SeTakeOwnershipPrivilege	2648	msiexec.exe
Token: SeLoadDriverPrivilege	2648	msiexec.exe
Token: SeSystemProfilePrivilege	2648	msiexec.exe
Token: SeSystemtimePrivilege	2648	msiexec.exe
Token: SeProfSingleProcessPrivilege	2648	msiexec.exe
Token: SeIncBasePriorityPrivilege	2648	msiexec.exe
Token: SeCreatePagefilePrivilege	2648	msiexec.exe
Token: SeCreatePermanentPrivilege	2648	msiexec.exe
Token: SeBackupPrivilege	2648	msiexec.exe
Token: SeRestorePrivilege	2648	msiexec.exe
Token: SeShutdownPrivilege	2648	msiexec.exe
Token: SeDebugPrivilege	2648	msiexec.exe
Token: SeAuditPrivilege	2648	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2648	msiexec.exe
Token: SeChangeNotifyPrivilege	2648	msiexec.exe
Token: SeRemoteShutdownPrivilege	2648	msiexec.exe
Token: SeUndockPrivilege	2648	msiexec.exe
Token: SeSyncAgentPrivilege	2648	msiexec.exe
Token: SeEnableDelegationPrivilege	2648	msiexec.exe
Token: SeManageVolumePrivilege	2648	msiexec.exe
Token: SeImpersonatePrivilege	2648	msiexec.exe
Token: SeCreateGlobalPrivilege	2648	msiexec.exe
Token: SeBackupPrivilege	4224	vssvc.exe
Token: SeRestorePrivilege	4224	vssvc.exe
Token: SeAuditPrivilege	4224	vssvc.exe
Token: SeBackupPrivilege	3840	msiexec.exe
Token: SeRestorePrivilege	3840	msiexec.exe
Token: SeRestorePrivilege	3840	msiexec.exe
Token: SeTakeOwnershipPrivilege	3840	msiexec.exe
Token: SeRestorePrivilege	3840	msiexec.exe
Token: SeTakeOwnershipPrivilege	3840	msiexec.exe
Token: SeBackupPrivilege	4368	srtasks.exe
Token: SeRestorePrivilege	4368	srtasks.exe
Token: SeSecurityPrivilege	4368	srtasks.exe
Token: SeTakeOwnershipPrivilege	4368	srtasks.exe
Token: SeBackupPrivilege	4368	srtasks.exe
Token: SeRestorePrivilege	4368	srtasks.exe
Token: SeSecurityPrivilege	4368	srtasks.exe
Token: SeTakeOwnershipPrivilege	4368	srtasks.exe
Token: SeDebugPrivilege	5452	powershell.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2648	msiexec.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3840 wrote to memory of 4368	3840	msiexec.exe	95
PID 3840 wrote to memory of 4368	3840	msiexec.exe	95
PID 3840 wrote to memory of 2308	3840	msiexec.exe	98
PID 3840 wrote to memory of 2308	3840	msiexec.exe	98
PID 3840 wrote to memory of 2308	3840	msiexec.exe	98
PID 2308 wrote to memory of 4048	2308	MsiExec.exe	99
PID 2308 wrote to memory of 4048	2308	MsiExec.exe	99
PID 2308 wrote to memory of 4048	2308	MsiExec.exe	99
PID 2308 wrote to memory of 4288	2308	MsiExec.exe	101
PID 2308 wrote to memory of 4288	2308	MsiExec.exe	101
PID 2308 wrote to memory of 4288	2308	MsiExec.exe	101
PID 2308 wrote to memory of 1588	2308	MsiExec.exe	107
PID 2308 wrote to memory of 1588	2308	MsiExec.exe	107
PID 2308 wrote to memory of 1588	2308	MsiExec.exe	107
PID 1588 wrote to memory of 3996	1588	cmd.exe	109
PID 1588 wrote to memory of 3996	1588	cmd.exe	109
PID 3996 wrote to memory of 3556	3996	msedge.exe	110
PID 3996 wrote to memory of 3556	3996	msedge.exe	110
PID 3996 wrote to memory of 4092	3996	msedge.exe	112
PID 3996 wrote to memory of 4092	3996	msedge.exe	112
PID 3996 wrote to memory of 4092	3996	msedge.exe	112
PID 3996 wrote to memory of 4092	3996	msedge.exe	112
PID 3996 wrote to memory of 4092	3996	msedge.exe	112
PID 3996 wrote to memory of 4092	3996	msedge.exe	112
PID 3996 wrote to memory of 4092	3996	msedge.exe	112
PID 3996 wrote to memory of 4092	3996	msedge.exe	112
PID 3996 wrote to memory of 4092	3996	msedge.exe	112
PID 3996 wrote to memory of 4092	3996	msedge.exe	112
PID 3996 wrote to memory of 4092	3996	msedge.exe	112
PID 3996 wrote to memory of 4092	3996	msedge.exe	112
PID 3996 wrote to memory of 4092	3996	msedge.exe	112
PID 3996 wrote to memory of 4092	3996	msedge.exe	112
PID 3996 wrote to memory of 4092	3996	msedge.exe	112
PID 3996 wrote to memory of 4092	3996	msedge.exe	112
PID 3996 wrote to memory of 4092	3996	msedge.exe	112
PID 3996 wrote to memory of 4092	3996	msedge.exe	112
PID 3996 wrote to memory of 4092	3996	msedge.exe	112
PID 3996 wrote to memory of 4092	3996	msedge.exe	112
PID 3996 wrote to memory of 4092	3996	msedge.exe	112
PID 3996 wrote to memory of 4092	3996	msedge.exe	112
PID 3996 wrote to memory of 4092	3996	msedge.exe	112
PID 3996 wrote to memory of 4092	3996	msedge.exe	112
PID 3996 wrote to memory of 4092	3996	msedge.exe	112
PID 3996 wrote to memory of 4092	3996	msedge.exe	112
PID 3996 wrote to memory of 4092	3996	msedge.exe	112
PID 3996 wrote to memory of 4092	3996	msedge.exe	112
PID 3996 wrote to memory of 4092	3996	msedge.exe	112
PID 3996 wrote to memory of 4092	3996	msedge.exe	112
PID 3996 wrote to memory of 4092	3996	msedge.exe	112
PID 3996 wrote to memory of 4092	3996	msedge.exe	112
PID 3996 wrote to memory of 4092	3996	msedge.exe	112
PID 3996 wrote to memory of 4092	3996	msedge.exe	112
PID 3996 wrote to memory of 4092	3996	msedge.exe	112
PID 3996 wrote to memory of 4092	3996	msedge.exe	112
PID 3996 wrote to memory of 4092	3996	msedge.exe	112
PID 3996 wrote to memory of 4092	3996	msedge.exe	112
PID 3996 wrote to memory of 4092	3996	msedge.exe	112
PID 3996 wrote to memory of 4092	3996	msedge.exe	112
PID 3996 wrote to memory of 4276	3996	msedge.exe	113
PID 3996 wrote to memory of 4276	3996	msedge.exe	113
PID 3996 wrote to memory of 4888	3996	msedge.exe	114
PID 3996 wrote to memory of 4888	3996	msedge.exe	114
PID 3996 wrote to memory of 4888	3996	msedge.exe	114
PID 3996 wrote to memory of 4888	3996	msedge.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\setup (2).msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2648

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3840
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4368
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 90C083800E366470F62E77AFB6E1B12B
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-e517d74e-3cbe-42c5-8c34-4d1409aa8166\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:4048
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4288
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start msedge https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdf
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdf
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:3996
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0x9c,0x128,0x7ffbdfc046f8,0x7ffbdfc04708,0x7ffbdfc04718
        5⤵
        
        PID:3556
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,4166244302568597365,15431212717688623167,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
        5⤵
        
        PID:4092
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,4166244302568597365,15431212717688623167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4276
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,4166244302568597365,15431212717688623167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
        5⤵
        
        PID:4888
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4166244302568597365,15431212717688623167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
        5⤵
        
        PID:2920
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4166244302568597365,15431212717688623167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
        5⤵
        
        PID:2176
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4166244302568597365,15431212717688623167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
        5⤵
        
        PID:3580
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4166244302568597365,15431212717688623167,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
        5⤵
        
        PID:748
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,4166244302568597365,15431212717688623167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5576 /prefetch:8
        5⤵
        
        PID:4600
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,4166244302568597365,15431212717688623167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5576 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1984
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4166244302568597365,15431212717688623167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3996 /prefetch:1
        5⤵
        
        PID:5144
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4166244302568597365,15431212717688623167,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
        5⤵
        
        PID:5152
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,4166244302568597365,15431212717688623167,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1308 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1800
- - C:\Users\Admin\AppData\Local\Temp\MW-e517d74e-3cbe-42c5-8c34-4d1409aa8166\files\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\MW-e517d74e-3cbe-42c5-8c34-4d1409aa8166\files\setup.exe" /VERYSILENT /VERYSILENT
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:556
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Microsoft\Windows\systemtask.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5452
  - - C:\Windows\SysWOW64\systeminfo.exe
      systeminfo
      4⤵
      System Location Discovery: System Language Discovery
      Gathers system information
      PID:5468

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3904

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37f660dd4b6ddf23bc37f5c823d1c33a

SHA1
1c35538aa307a3e09d15519df6ace99674ae428b

SHA256
4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

SHA512
807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7cb450b1315c63b1d5d89d98ba22da5

SHA1
694005cd9e1a4c54e0b83d0598a8a0c089df1556

SHA256
38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

SHA512
df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
383B

MD5
01ae38f9cf2e45bba499016269afc359

SHA1
4c217a163ca8927fe69576e39a14126bc3b361a0

SHA256
4a9bef007a861d6cbc928555ece8dddafab6498cea04ee23f2e5dd6a866445e1

SHA512
d586c95599e2f7dace5b8939569c6f0b395daa06b466744121d847f5e94aaf0004c82e9ea1fbdd18701b061a30ac8c764328aa25922917f6ca517b7eda3f05cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4b5aa2c782a00c3d515baffda5be8a9f

SHA1
8ff6522fda5fd2b6f71f76817a0fe38f7a47b3bd

SHA256
541903c76fe5718b3bdcfb192e91c736c685f488443b1c29f1e9395a2ea0e295

SHA512
5bebfe5cba6861fe2c8a53f3b2134a6145314e8823a257b48acf8b947601847e5cbc8da9441f8774bc32e3bf75e2504c9f5a057583cc572199bbc8cf3716808e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
49b8286eac25ec397c74f72e6353f0f2

SHA1
34f53a82c87d83fa8fcc978f247e0fc699591d70

SHA256
83ffa0c44bf5aea2b0bd3b21a306e77419aa54640fde8ca19f5af12d0477186f

SHA512
f59c2f4d81ac2fd6fdf4d13f9dc1ef01478c7b84bb645641f9bb4ab4c930d4307faa5942f4e8e7ba1af83ddb1fb76bde976d8f26d07b88e8f4ad6e58b29de176

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7b356edbcd3995b355b8334e33bd2ae5

SHA1
31f5b390a5cb9daa546575918d1ca0729bfef252

SHA256
40d6447b4078eb904e416303a284bcd9b79958c2f89faf8281437cea74b19241

SHA512
6c22fad17665225f4989be9e689bdcfd3759634e60966557822dc7e9b52f39fb05a7f7fe7e2916a495671e02fb572de90e8c01b5bad89e725966c475b49cfb17

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-e517d74e-3cbe-42c5-8c34-4d1409aa8166\files.cab

Filesize
1.6MB

MD5
809337e8fba896e6c6be38773398afd5

SHA1
f1cf29e8175ba87b9b28a02dca9e5fb09f175027

SHA256
6b956a5c80beb1085c7bb11f6386b31b718bbf59c59ee8bd83de2c0febe90aa3

SHA512
4edf0a07ecb49a0af6b06621c06221e2fe5d48808cc305b59d4142c990474543bce0c6fb99677257a3dede9c6edcbaa8e613af31c3ad0cf0c21576a783ee19f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-e517d74e-3cbe-42c5-8c34-4d1409aa8166\msiwrapper.ini

Filesize
342B

MD5
15bc719ffd83d3603a79ece47c328c11

SHA1
ec4a6c0ab34c0bc32c1fc97eb647436760b546d4

SHA256
8d5124a6ed30d06049f6b650319ada12c7fdebb1d5db16c5e4268f641a64fb40

SHA512
c2c7a993e10f930e3e95d65f1f9a0c74e107d2d14770308671c5e013da427034635dbb8497d44ec8173052532d920eb6917798406a1cedc3c26e04e250532721

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-e517d74e-3cbe-42c5-8c34-4d1409aa8166\msiwrapper.ini

Filesize
1KB

MD5
52d763c187e3824032c9b7770dd4d94c

SHA1
75164c791367d683bc74b642051134d135cf4e82

SHA256
063f4947725cb886bd62579911daede197b59425cb8de89d51b38fb2ee0c2104

SHA512
3cbb6ea2055fb0092d6ed3e869fea5febfbcddd918ebc515c4a63beceeb41e9ad91440b5c38f218487d912b2a7ed2459372925323250b60ee47218229abd7970

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5xmw51vp.dd3.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\Installer\MSIAC4D.tmp

Filesize
208KB

MD5
0c8921bbcc37c6efd34faf44cf3b0cb5

SHA1
dcfa71246157edcd09eecaf9d4c5e360b24b3e49

SHA256
fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1

SHA512
ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.1MB

MD5
a1231ceb6af2574fbcfcd232f2238e06

SHA1
f60c900e5f5337ba3f34697cf0dd80293ac775bf

SHA256
5d6d43c6e8648242d12d756398279ff9352654061a10261b4ccbf97663cbf068

SHA512
a86a5a69adb15fc4eefa22513f84deb34bec9708e74732bdf27181b1174b8792e97e870114168c1c6a7571a8f96b3fd7ef738a9f3ff2217c9da13abf90933da5

Download Submit
\??\Volume{0576a638-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{6f8dba2e-5859-48e7-b701-eb3bf145d303}_OnDiskSnapshotProp

Filesize
6KB

MD5
c84a05dcfa698ab29b8da9271fad247b

SHA1
d1da888cb73731b70d2bebb9aca2321b3b76d04f

SHA256
33efc86cac7bc558c5c1fe8876e01b086e78cc08e647dd254ae7863afc96f441

SHA512
a6186a5bc9ad086951779ba5e1b7037776ef5f98677cc805589dc213ae681a68b21c5fd357eb1bbf446295f037254ac284e0693c776ffafb83fdd5e30b01f8fd

Download Submit
memory/556-194-0x0000000010000000-0x0000000010731000-memory.dmp

Filesize
7.2MB

Download
memory/5452-202-0x0000000005030000-0x0000000005052000-memory.dmp

Filesize
136KB

Download
memory/5452-229-0x00000000071A0000-0x0000000007243000-memory.dmp

Filesize
652KB

Download
memory/5452-203-0x00000000058E0000-0x0000000005946000-memory.dmp

Filesize
408KB

Download
memory/5452-204-0x0000000005950000-0x00000000059B6000-memory.dmp

Filesize
408KB

Download
memory/5452-199-0x00000000026C0000-0x00000000026F6000-memory.dmp

Filesize
216KB

Download
memory/5452-214-0x00000000059C0000-0x0000000005D14000-memory.dmp

Filesize
3.3MB

Download
memory/5452-216-0x0000000005FF0000-0x000000000603C000-memory.dmp

Filesize
304KB

Download
memory/5452-215-0x0000000005FC0000-0x0000000005FDE000-memory.dmp

Filesize
120KB

Download
memory/5452-218-0x000000006E3B0000-0x000000006E3FC000-memory.dmp

Filesize
304KB

Download
memory/5452-217-0x0000000006580000-0x00000000065B2000-memory.dmp

Filesize
200KB

Download
memory/5452-228-0x0000000007170000-0x000000000718E000-memory.dmp

Filesize
120KB

Download
memory/5452-200-0x0000000005080000-0x00000000056A8000-memory.dmp

Filesize
6.2MB

Download
memory/5452-230-0x0000000007920000-0x0000000007F9A000-memory.dmp

Filesize
6.5MB

Download
memory/5452-231-0x00000000072E0000-0x00000000072FA000-memory.dmp

Filesize
104KB

Download
memory/5452-232-0x0000000007340000-0x000000000734A000-memory.dmp

Filesize
40KB

Download
memory/5452-233-0x0000000007570000-0x0000000007606000-memory.dmp

Filesize
600KB

Download
memory/5452-234-0x00000000074E0000-0x00000000074F1000-memory.dmp

Filesize
68KB

Download
memory/5452-235-0x0000000007510000-0x000000000751E000-memory.dmp

Filesize
56KB

Download
memory/5452-236-0x0000000007520000-0x0000000007534000-memory.dmp

Filesize
80KB

Download
memory/5452-237-0x0000000007630000-0x000000000764A000-memory.dmp

Filesize
104KB

Download
memory/5452-238-0x0000000007560000-0x0000000007568000-memory.dmp

Filesize
32KB

Download