metastealer | 6d2705d1bd666792331b29b0ae1895a1ef2072d0dc1e55ef105212da9024fc47

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-12-2024 11:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

57ff67.msi
Size

1.9MB
MD5

74a757de4790c76a4d83d640901e5249
SHA1

d27c7ace0079aaf1fd39abbc0e161aa84aa399a9
SHA256

6d2705d1bd666792331b29b0ae1895a1ef2072d0dc1e55ef105212da9024fc47
SHA512

db06f8f0082fb45c97e35b3d959e513dc9defc8ed2ef15f4a937dee92c2a762ef0802dfcadb6a8741964e517eb0190bf40adca08c64bc0f9a976cbca57a2ede4
SSDEEP

24576:Qt9cpVDh7lt0nSRDxmR+UJ2jUvshD3rcxCEiPzRqe:PpRh7FDxzUSDFr7EKz9

Score

10^/10

metastealer discovery execution persistence privilege_escalation spyware stealer

Malware Config

Extracted

Family

metastealer

kiyaqoimsiieeyqa.xyz

ssqsmisuowqcwsqo.xyz

ykqmwgsuummieaug.xyz

ewukeskgqswqesiw.xyz

cscqcsgewmwwaaui.xyz

cyoksykiamiscyia.xyz

okgomokemoucqeso.xyz

ikwacuakiqeimwua.xyz

aawcsqqaywckiwmi.xyz

aiqasksgmyeqocei.xyz

qgumcuisgaeyuqqe.xyz

eiesoycamyqqgcea.xyz

ywceswakicsqomqw.xyz

auaieuewouawygku.xyz

cmiascusccywowcs.xyz

uiqkkomkaceqacec.xyz

quqeciymqmkqccqw.xyz

ssqsauuuyyigouou.xyz

aogaakukuugqswcy.xyz

ucgwcwsuqsuwewgc.xyz

Attributes

dga_seed
21845
domain_length
16
num_dga_domains
10000
port
443

Signatures

Meta Stealer
Meta Stealer steals passwords stored in browsers, written in C++.
stealer metastealer

MetaStealer payload 1 IoCs

resource	yara_rule
behavioral2/memory/2460-185-0x0000000010000000-0x0000000010731000-memory.dmp	family_metastealer

Metastealer family
metastealer

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2420	powershell.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5116	ICACLS.EXE

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	cmd.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE678.tmp	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	EXPAND.EXE
File created	C:\Windows\Installer\e57e5ad.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{ACE8395F-8E19-4CA8-87FE-1E8977674C8C}	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	EXPAND.EXE
File opened for modification	C:\Windows\Installer\e57e5ad.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Executes dropped EXE 1 IoCs

pid	Process
2460	setup.exe

Loads dropped DLL 1 IoCs

pid	Process
3956	MsiExec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4120	msiexec.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ICACLS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXPAND.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e3c1c56297b3270b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e3c1c5620000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900e3c1c562000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de3c1c562000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000e3c1c56200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
4620	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
5008	msiexec.exe
5008	msiexec.exe
1852	msedge.exe
1852	msedge.exe
464	msedge.exe
464	msedge.exe
1872	identity_helper.exe
1872	identity_helper.exe
2420	powershell.exe
2420	powershell.exe
2420	powershell.exe
2460	setup.exe
2460	setup.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4120	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4120	msiexec.exe
Token: SeSecurityPrivilege	5008	msiexec.exe
Token: SeCreateTokenPrivilege	4120	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4120	msiexec.exe
Token: SeLockMemoryPrivilege	4120	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4120	msiexec.exe
Token: SeMachineAccountPrivilege	4120	msiexec.exe
Token: SeTcbPrivilege	4120	msiexec.exe
Token: SeSecurityPrivilege	4120	msiexec.exe
Token: SeTakeOwnershipPrivilege	4120	msiexec.exe
Token: SeLoadDriverPrivilege	4120	msiexec.exe
Token: SeSystemProfilePrivilege	4120	msiexec.exe
Token: SeSystemtimePrivilege	4120	msiexec.exe
Token: SeProfSingleProcessPrivilege	4120	msiexec.exe
Token: SeIncBasePriorityPrivilege	4120	msiexec.exe
Token: SeCreatePagefilePrivilege	4120	msiexec.exe
Token: SeCreatePermanentPrivilege	4120	msiexec.exe
Token: SeBackupPrivilege	4120	msiexec.exe
Token: SeRestorePrivilege	4120	msiexec.exe
Token: SeShutdownPrivilege	4120	msiexec.exe
Token: SeDebugPrivilege	4120	msiexec.exe
Token: SeAuditPrivilege	4120	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4120	msiexec.exe
Token: SeChangeNotifyPrivilege	4120	msiexec.exe
Token: SeRemoteShutdownPrivilege	4120	msiexec.exe
Token: SeUndockPrivilege	4120	msiexec.exe
Token: SeSyncAgentPrivilege	4120	msiexec.exe
Token: SeEnableDelegationPrivilege	4120	msiexec.exe
Token: SeManageVolumePrivilege	4120	msiexec.exe
Token: SeImpersonatePrivilege	4120	msiexec.exe
Token: SeCreateGlobalPrivilege	4120	msiexec.exe
Token: SeBackupPrivilege	4840	vssvc.exe
Token: SeRestorePrivilege	4840	vssvc.exe
Token: SeAuditPrivilege	4840	vssvc.exe
Token: SeBackupPrivilege	5008	msiexec.exe
Token: SeRestorePrivilege	5008	msiexec.exe
Token: SeRestorePrivilege	5008	msiexec.exe
Token: SeTakeOwnershipPrivilege	5008	msiexec.exe
Token: SeRestorePrivilege	5008	msiexec.exe
Token: SeTakeOwnershipPrivilege	5008	msiexec.exe
Token: SeBackupPrivilege	3432	srtasks.exe
Token: SeRestorePrivilege	3432	srtasks.exe
Token: SeSecurityPrivilege	3432	srtasks.exe
Token: SeTakeOwnershipPrivilege	3432	srtasks.exe
Token: SeBackupPrivilege	3432	srtasks.exe
Token: SeRestorePrivilege	3432	srtasks.exe
Token: SeSecurityPrivilege	3432	srtasks.exe
Token: SeTakeOwnershipPrivilege	3432	srtasks.exe
Token: SeDebugPrivilege	2420	powershell.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4120	msiexec.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 3432	5008	msiexec.exe	87
PID 5008 wrote to memory of 3432	5008	msiexec.exe	87
PID 5008 wrote to memory of 3956	5008	msiexec.exe	89
PID 5008 wrote to memory of 3956	5008	msiexec.exe	89
PID 5008 wrote to memory of 3956	5008	msiexec.exe	89
PID 3956 wrote to memory of 5116	3956	MsiExec.exe	90
PID 3956 wrote to memory of 5116	3956	MsiExec.exe	90
PID 3956 wrote to memory of 5116	3956	MsiExec.exe	90
PID 3956 wrote to memory of 2028	3956	MsiExec.exe	92
PID 3956 wrote to memory of 2028	3956	MsiExec.exe	92
PID 3956 wrote to memory of 2028	3956	MsiExec.exe	92
PID 3956 wrote to memory of 3972	3956	MsiExec.exe	98
PID 3956 wrote to memory of 3972	3956	MsiExec.exe	98
PID 3956 wrote to memory of 3972	3956	MsiExec.exe	98
PID 3972 wrote to memory of 464	3972	cmd.exe	100
PID 3972 wrote to memory of 464	3972	cmd.exe	100
PID 464 wrote to memory of 3452	464	msedge.exe	101
PID 464 wrote to memory of 3452	464	msedge.exe	101
PID 464 wrote to memory of 2992	464	msedge.exe	103
PID 464 wrote to memory of 2992	464	msedge.exe	103
PID 464 wrote to memory of 2992	464	msedge.exe	103
PID 464 wrote to memory of 2992	464	msedge.exe	103
PID 464 wrote to memory of 2992	464	msedge.exe	103
PID 464 wrote to memory of 2992	464	msedge.exe	103
PID 464 wrote to memory of 2992	464	msedge.exe	103
PID 464 wrote to memory of 2992	464	msedge.exe	103
PID 464 wrote to memory of 2992	464	msedge.exe	103
PID 464 wrote to memory of 2992	464	msedge.exe	103
PID 464 wrote to memory of 2992	464	msedge.exe	103
PID 464 wrote to memory of 2992	464	msedge.exe	103
PID 464 wrote to memory of 2992	464	msedge.exe	103
PID 464 wrote to memory of 2992	464	msedge.exe	103
PID 464 wrote to memory of 2992	464	msedge.exe	103
PID 464 wrote to memory of 2992	464	msedge.exe	103
PID 464 wrote to memory of 2992	464	msedge.exe	103
PID 464 wrote to memory of 2992	464	msedge.exe	103
PID 464 wrote to memory of 2992	464	msedge.exe	103
PID 464 wrote to memory of 2992	464	msedge.exe	103
PID 464 wrote to memory of 2992	464	msedge.exe	103
PID 464 wrote to memory of 2992	464	msedge.exe	103
PID 464 wrote to memory of 2992	464	msedge.exe	103
PID 464 wrote to memory of 2992	464	msedge.exe	103
PID 464 wrote to memory of 2992	464	msedge.exe	103
PID 464 wrote to memory of 2992	464	msedge.exe	103
PID 464 wrote to memory of 2992	464	msedge.exe	103
PID 464 wrote to memory of 2992	464	msedge.exe	103
PID 464 wrote to memory of 2992	464	msedge.exe	103
PID 464 wrote to memory of 2992	464	msedge.exe	103
PID 464 wrote to memory of 2992	464	msedge.exe	103
PID 464 wrote to memory of 2992	464	msedge.exe	103
PID 464 wrote to memory of 2992	464	msedge.exe	103
PID 464 wrote to memory of 2992	464	msedge.exe	103
PID 464 wrote to memory of 2992	464	msedge.exe	103
PID 464 wrote to memory of 2992	464	msedge.exe	103
PID 464 wrote to memory of 2992	464	msedge.exe	103
PID 464 wrote to memory of 2992	464	msedge.exe	103
PID 464 wrote to memory of 2992	464	msedge.exe	103
PID 464 wrote to memory of 2992	464	msedge.exe	103
PID 464 wrote to memory of 1852	464	msedge.exe	104
PID 464 wrote to memory of 1852	464	msedge.exe	104
PID 464 wrote to memory of 4524	464	msedge.exe	105
PID 464 wrote to memory of 4524	464	msedge.exe	105
PID 464 wrote to memory of 4524	464	msedge.exe	105
PID 464 wrote to memory of 4524	464	msedge.exe	105

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\57ff67.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4120

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3432
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3E86E45ACF7026BAF52F038083A31BEC
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3956
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-37319ae2-1251-496c-a452-e1709b5bf059\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:5116
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2028
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start msedge https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdf
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdf
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:464
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcebfc46f8,0x7ffcebfc4708,0x7ffcebfc4718
        5⤵
        
        PID:3452
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,18326590467310827530,856468385535327115,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
        5⤵
        
        PID:2992
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,18326590467310827530,856468385535327115,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1852
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,18326590467310827530,856468385535327115,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2484 /prefetch:8
        5⤵
        
        PID:4524
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,18326590467310827530,856468385535327115,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
        5⤵
        
        PID:4384
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,18326590467310827530,856468385535327115,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
        5⤵
        
        PID:1820
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,18326590467310827530,856468385535327115,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:8
        5⤵
        
        PID:4444
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,18326590467310827530,856468385535327115,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1872
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,18326590467310827530,856468385535327115,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
        5⤵
        
        PID:4360
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,18326590467310827530,856468385535327115,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
        5⤵
        
        PID:4392
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,18326590467310827530,856468385535327115,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
        5⤵
        
        PID:5200
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,18326590467310827530,856468385535327115,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
        5⤵
        
        PID:5208
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,18326590467310827530,856468385535327115,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1736 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3272
- - C:\Users\Admin\AppData\Local\Temp\MW-37319ae2-1251-496c-a452-e1709b5bf059\files\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\MW-37319ae2-1251-496c-a452-e1709b5bf059\files\setup.exe" /VERYSILENT /VERYSILENT
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2460
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Microsoft\Windows\systemtask.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2420
  - - C:\Windows\SysWOW64\systeminfo.exe
      systeminfo
      4⤵
      System Location Discovery: System Language Discovery
      Gathers system information
      PID:4620

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4840

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1776

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

File and Directory Permissions Modification

T1222

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
383B

MD5
e6cd777250c8f7b2ac864984e9fafd12

SHA1
d67b54ddc9b7219b927c612a0a63497a63e7f8a6

SHA256
20e8e9b6597938097de717833940736b853057fc2ed1f5eec67ea77de48c6240

SHA512
50b4ba6040ab7f8715140d006b18ab07f25f03a39a4f1ae5f72b7dfe7961849040b0c60f69e0d4a79c28e0fc3dc3db66c156b3f8da856dd81848c70d05898db2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
432782e9efcfb06f417475181be6326c

SHA1
c9fea3db0991ceb16a77f437675bfbad7a006f60

SHA256
27832c3a2dd77cc53eb3ff569781c2f2207c79d481a7b093e7af8a626743633c

SHA512
f3ac8e6cf3afdf21dfb412bdcf2312bbd013325567a86c64968bff90c9aa1f20c20863b84b7a5ce35fb3593b10218cd6f1faa19ba1f366ed6f36deb6bcd446db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
118b08b14a699530ac14e9d2c1d2b9ec

SHA1
664d3ce520088588dff571e665801d8b77850c85

SHA256
000ac436aee3d270460277df0f5ddb658f2bd3bd832283db5b60902b6f406414

SHA512
ff219188c43ca1de9dd1c5571031d6a5111c5e8d1fd82f110ad4c2051f5229ce1b9ec0494c11cb687225c2e3090d7ba5afd2ef0fc743829dd193b82b9bdc0b77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
984ef721871754f56e7f63e5cfa22185

SHA1
e01c69de8a7ab65f53023a9ae7cc7bc2bd890d04

SHA256
237e61d6a12ae9eeffaa44c736102afd4cc5cc8b04e4c5017090f75fd58680e9

SHA512
88c8921989da13e0abfdf68c1a5bceb8fc0ebf69676397058119981d93647ac5920369649c85ec6b1b17d3b4c917633941d32a464ccd0b45299217148f07d151

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-37319ae2-1251-496c-a452-e1709b5bf059\files.cab

Filesize
1.6MB

MD5
d0ecbe8399a46101b4e9d90b891deeb8

SHA1
1bcd3c5af8ab80e427402c92665e39a993a85b9a

SHA256
639f888682c0526229cabecac2da894fddf3a90e899f20d48aad28563b2cd3fb

SHA512
6986e33f3b3be73803a32d481f0987c3906bfadfe38a6fddf2b0df626f74bf9618e964aec9d091ad38f4253b0c5d2a242c8f4840c81e27464f537fc13730619f

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-37319ae2-1251-496c-a452-e1709b5bf059\msiwrapper.ini

Filesize
1KB

MD5
8daf652a62ce902a899fe59bf1dc74d3

SHA1
02a4bab42411eaa9c34078ab25e30131861186af

SHA256
288ebe47f673c0cde214231d0ec1d49c939d7e41b26557535279bff61dee50fa

SHA512
f221af4e1d2392d19c482dd81bf45180ed31f87ff9e225c4c6cec35597b153a42d6942723aeeefb0b5703b4aad0b319f4746b9da5e5e5a0fb04d9f33b29853f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2ftxuv4z.cvk.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\Installer\MSIE678.tmp

Filesize
208KB

MD5
0c8921bbcc37c6efd34faf44cf3b0cb5

SHA1
dcfa71246157edcd09eecaf9d4c5e360b24b3e49

SHA256
fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1

SHA512
ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.1MB

MD5
5a681740331fc5996942e568c63f768a

SHA1
8b1c76ba8ad4e5ef86dcefc2391fd6549b287ad5

SHA256
05a532a4ba6ee68ca19e70a2b257ffcb3da98b453d33d4e7e0bc3d3836323d91

SHA512
98b8851bd553398b7ef8526f180eb4ad70a08ae0b92836778ae81ede9f3814269cf62161ce546e0cfa097325be2e014bb4ef32315c958546b49c827b01bea7b2

Download Submit
\??\Volume{62c5c1e3-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{35efe8e2-f5e8-44d4-851d-04afc1bb1648}_OnDiskSnapshotProp

Filesize
6KB

MD5
8e2edfb3faa15a464a7c369f4e7edec6

SHA1
a93980428dddcab5bb3121678ced41e6624d323d

SHA256
4b057b3f29305c2965eb0e366d81a0115e3ffe055041661d16e17097bde9f42f

SHA512
964a829ddd93071ac7edb1be563a200c83df2ef6b548adb7fe3f50120dc08b050ac057401fe69c122e2ce644d045bf70a36c73d562d1cc1fdfbe62549387129b

Download Submit
memory/2420-192-0x0000000005930000-0x0000000005996000-memory.dmp

Filesize
408KB

Download
memory/2420-218-0x0000000007220000-0x000000000723E000-memory.dmp

Filesize
120KB

Download
memory/2420-191-0x00000000050B0000-0x00000000050D2000-memory.dmp

Filesize
136KB

Download
memory/2420-193-0x0000000005A50000-0x0000000005AB6000-memory.dmp

Filesize
408KB

Download
memory/2420-189-0x0000000004AA0000-0x0000000004AD6000-memory.dmp

Filesize
216KB

Download
memory/2420-228-0x0000000007600000-0x0000000007608000-memory.dmp

Filesize
32KB

Download
memory/2420-203-0x0000000005BC0000-0x0000000005F14000-memory.dmp

Filesize
3.3MB

Download
memory/2420-205-0x0000000006060000-0x000000000607E000-memory.dmp

Filesize
120KB

Download
memory/2420-206-0x00000000060F0000-0x000000000613C000-memory.dmp

Filesize
304KB

Download
memory/2420-208-0x000000006E930000-0x000000006E97C000-memory.dmp

Filesize
304KB

Download
memory/2420-207-0x0000000006630000-0x0000000006662000-memory.dmp

Filesize
200KB

Download
memory/2420-190-0x0000000005110000-0x0000000005738000-memory.dmp

Filesize
6.2MB

Download
memory/2420-219-0x0000000007250000-0x00000000072F3000-memory.dmp

Filesize
652KB

Download
memory/2420-220-0x00000000079C0000-0x000000000803A000-memory.dmp

Filesize
6.5MB

Download
memory/2420-221-0x0000000007380000-0x000000000739A000-memory.dmp

Filesize
104KB

Download
memory/2420-222-0x00000000073E0000-0x00000000073EA000-memory.dmp

Filesize
40KB

Download
memory/2420-223-0x0000000007610000-0x00000000076A6000-memory.dmp

Filesize
600KB

Download
memory/2420-224-0x0000000007580000-0x0000000007591000-memory.dmp

Filesize
68KB

Download
memory/2420-225-0x00000000075C0000-0x00000000075CE000-memory.dmp

Filesize
56KB

Download
memory/2420-226-0x00000000075D0000-0x00000000075E4000-memory.dmp

Filesize
80KB

Download
memory/2420-227-0x00000000076B0000-0x00000000076CA000-memory.dmp

Filesize
104KB

Download
memory/2460-185-0x0000000010000000-0x0000000010731000-memory.dmp

Filesize
7.2MB

Download