metastealer | 60f172403738997a3e49ba5b7b247854bc45b42db5895c47d43b0b0ed86588c1

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/12/2024, 02:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

60f172403738997a3e49ba5b7b247854bc45b42db5895c47d43b0b0ed86588c1.msi
Size

1.9MB
MD5

dc1dacc4a53407aebffc38ef512f52e7
SHA1

737e0c4312552da152f009bdce0f9048e368fee1
SHA256

60f172403738997a3e49ba5b7b247854bc45b42db5895c47d43b0b0ed86588c1
SHA512

9685d5c2a48d334814599fc0f8f05dcc9af441a30d09f034030f01158648a2ffd25febfad1e4237457b1de8adb9765f005c3549624dd588f73cc738a2ed62cba
SSDEEP

24576:vt9cpVDhol4Cw4o72KP8MgRhG52dt3JJCyrdEnlBj:4pRho2XN2Q8xhGQP6QdE

Score

10^/10

metastealer discovery execution persistence privilege_escalation spyware stealer

Malware Config

Extracted

Family

metastealer

kiyaqoimsiieeyqa.xyz

ssqsmisuowqcwsqo.xyz

ykqmwgsuummieaug.xyz

ewukeskgqswqesiw.xyz

cscqcsgewmwwaaui.xyz

cyoksykiamiscyia.xyz

okgomokemoucqeso.xyz

ikwacuakiqeimwua.xyz

aawcsqqaywckiwmi.xyz

aiqasksgmyeqocei.xyz

qgumcuisgaeyuqqe.xyz

eiesoycamyqqgcea.xyz

ywceswakicsqomqw.xyz

auaieuewouawygku.xyz

cmiascusccywowcs.xyz

uiqkkomkaceqacec.xyz

quqeciymqmkqccqw.xyz

ssqsauuuyyigouou.xyz

aogaakukuugqswcy.xyz

ucgwcwsuqsuwewgc.xyz

Attributes

dga_seed
21845
domain_length
16
num_dga_domains
10000
port
443

Signatures

Meta Stealer
Meta Stealer steals passwords stored in browsers, written in C++.
stealer metastealer

MetaStealer payload 1 IoCs

resource	yara_rule
behavioral2/memory/2868-175-0x0000000010000000-0x0000000010731000-memory.dmp	family_metastealer

Metastealer family
metastealer

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1148	powershell.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2924	ICACLS.EXE

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	cmd.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e57e0da.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE1A5.tmp	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	EXPAND.EXE
File created	C:\Windows\Installer\e57e0da.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{740864D8-D5D4-4230-8D1D-1C2E0E22C8A6}	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	EXPAND.EXE

Executes dropped EXE 1 IoCs

pid	Process
2868	install86.exe

Loads dropped DLL 1 IoCs

pid	Process
3728	MsiExec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3996	msiexec.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	install86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ICACLS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXPAND.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e3c1c56297b3270b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e3c1c5620000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900e3c1c562000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de3c1c562000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000e3c1c56200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
5624	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
5008	msiexec.exe
5008	msiexec.exe
5084	msedge.exe
5084	msedge.exe
2752	msedge.exe
2752	msedge.exe
1472	identity_helper.exe
1472	identity_helper.exe
1148	powershell.exe
1148	powershell.exe
1148	powershell.exe
2868	install86.exe
2868	install86.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3996	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3996	msiexec.exe
Token: SeSecurityPrivilege	5008	msiexec.exe
Token: SeCreateTokenPrivilege	3996	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3996	msiexec.exe
Token: SeLockMemoryPrivilege	3996	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3996	msiexec.exe
Token: SeMachineAccountPrivilege	3996	msiexec.exe
Token: SeTcbPrivilege	3996	msiexec.exe
Token: SeSecurityPrivilege	3996	msiexec.exe
Token: SeTakeOwnershipPrivilege	3996	msiexec.exe
Token: SeLoadDriverPrivilege	3996	msiexec.exe
Token: SeSystemProfilePrivilege	3996	msiexec.exe
Token: SeSystemtimePrivilege	3996	msiexec.exe
Token: SeProfSingleProcessPrivilege	3996	msiexec.exe
Token: SeIncBasePriorityPrivilege	3996	msiexec.exe
Token: SeCreatePagefilePrivilege	3996	msiexec.exe
Token: SeCreatePermanentPrivilege	3996	msiexec.exe
Token: SeBackupPrivilege	3996	msiexec.exe
Token: SeRestorePrivilege	3996	msiexec.exe
Token: SeShutdownPrivilege	3996	msiexec.exe
Token: SeDebugPrivilege	3996	msiexec.exe
Token: SeAuditPrivilege	3996	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3996	msiexec.exe
Token: SeChangeNotifyPrivilege	3996	msiexec.exe
Token: SeRemoteShutdownPrivilege	3996	msiexec.exe
Token: SeUndockPrivilege	3996	msiexec.exe
Token: SeSyncAgentPrivilege	3996	msiexec.exe
Token: SeEnableDelegationPrivilege	3996	msiexec.exe
Token: SeManageVolumePrivilege	3996	msiexec.exe
Token: SeImpersonatePrivilege	3996	msiexec.exe
Token: SeCreateGlobalPrivilege	3996	msiexec.exe
Token: SeBackupPrivilege	4840	vssvc.exe
Token: SeRestorePrivilege	4840	vssvc.exe
Token: SeAuditPrivilege	4840	vssvc.exe
Token: SeBackupPrivilege	5008	msiexec.exe
Token: SeRestorePrivilege	5008	msiexec.exe
Token: SeRestorePrivilege	5008	msiexec.exe
Token: SeTakeOwnershipPrivilege	5008	msiexec.exe
Token: SeRestorePrivilege	5008	msiexec.exe
Token: SeTakeOwnershipPrivilege	5008	msiexec.exe
Token: SeBackupPrivilege	1492	srtasks.exe
Token: SeRestorePrivilege	1492	srtasks.exe
Token: SeSecurityPrivilege	1492	srtasks.exe
Token: SeTakeOwnershipPrivilege	1492	srtasks.exe
Token: SeBackupPrivilege	1492	srtasks.exe
Token: SeRestorePrivilege	1492	srtasks.exe
Token: SeSecurityPrivilege	1492	srtasks.exe
Token: SeTakeOwnershipPrivilege	1492	srtasks.exe
Token: SeDebugPrivilege	1148	powershell.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3996	msiexec.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 1492	5008	msiexec.exe	87
PID 5008 wrote to memory of 1492	5008	msiexec.exe	87
PID 5008 wrote to memory of 3728	5008	msiexec.exe	89
PID 5008 wrote to memory of 3728	5008	msiexec.exe	89
PID 5008 wrote to memory of 3728	5008	msiexec.exe	89
PID 3728 wrote to memory of 2924	3728	MsiExec.exe	90
PID 3728 wrote to memory of 2924	3728	MsiExec.exe	90
PID 3728 wrote to memory of 2924	3728	MsiExec.exe	90
PID 3728 wrote to memory of 3904	3728	MsiExec.exe	92
PID 3728 wrote to memory of 3904	3728	MsiExec.exe	92
PID 3728 wrote to memory of 3904	3728	MsiExec.exe	92
PID 3728 wrote to memory of 1276	3728	MsiExec.exe	98
PID 3728 wrote to memory of 1276	3728	MsiExec.exe	98
PID 3728 wrote to memory of 1276	3728	MsiExec.exe	98
PID 1276 wrote to memory of 2752	1276	cmd.exe	100
PID 1276 wrote to memory of 2752	1276	cmd.exe	100
PID 2752 wrote to memory of 3452	2752	msedge.exe	101
PID 2752 wrote to memory of 3452	2752	msedge.exe	101
PID 2752 wrote to memory of 2948	2752	msedge.exe	103
PID 2752 wrote to memory of 2948	2752	msedge.exe	103
PID 2752 wrote to memory of 2948	2752	msedge.exe	103
PID 2752 wrote to memory of 2948	2752	msedge.exe	103
PID 2752 wrote to memory of 2948	2752	msedge.exe	103
PID 2752 wrote to memory of 2948	2752	msedge.exe	103
PID 2752 wrote to memory of 2948	2752	msedge.exe	103
PID 2752 wrote to memory of 2948	2752	msedge.exe	103
PID 2752 wrote to memory of 2948	2752	msedge.exe	103
PID 2752 wrote to memory of 2948	2752	msedge.exe	103
PID 2752 wrote to memory of 2948	2752	msedge.exe	103
PID 2752 wrote to memory of 2948	2752	msedge.exe	103
PID 2752 wrote to memory of 2948	2752	msedge.exe	103
PID 2752 wrote to memory of 2948	2752	msedge.exe	103
PID 2752 wrote to memory of 2948	2752	msedge.exe	103
PID 2752 wrote to memory of 2948	2752	msedge.exe	103
PID 2752 wrote to memory of 2948	2752	msedge.exe	103
PID 2752 wrote to memory of 2948	2752	msedge.exe	103
PID 2752 wrote to memory of 2948	2752	msedge.exe	103
PID 2752 wrote to memory of 2948	2752	msedge.exe	103
PID 2752 wrote to memory of 2948	2752	msedge.exe	103
PID 2752 wrote to memory of 2948	2752	msedge.exe	103
PID 2752 wrote to memory of 2948	2752	msedge.exe	103
PID 2752 wrote to memory of 2948	2752	msedge.exe	103
PID 2752 wrote to memory of 2948	2752	msedge.exe	103
PID 2752 wrote to memory of 2948	2752	msedge.exe	103
PID 2752 wrote to memory of 2948	2752	msedge.exe	103
PID 2752 wrote to memory of 2948	2752	msedge.exe	103
PID 2752 wrote to memory of 2948	2752	msedge.exe	103
PID 2752 wrote to memory of 2948	2752	msedge.exe	103
PID 2752 wrote to memory of 2948	2752	msedge.exe	103
PID 2752 wrote to memory of 2948	2752	msedge.exe	103
PID 2752 wrote to memory of 2948	2752	msedge.exe	103
PID 2752 wrote to memory of 2948	2752	msedge.exe	103
PID 2752 wrote to memory of 2948	2752	msedge.exe	103
PID 2752 wrote to memory of 2948	2752	msedge.exe	103
PID 2752 wrote to memory of 2948	2752	msedge.exe	103
PID 2752 wrote to memory of 2948	2752	msedge.exe	103
PID 2752 wrote to memory of 2948	2752	msedge.exe	103
PID 2752 wrote to memory of 2948	2752	msedge.exe	103
PID 2752 wrote to memory of 5084	2752	msedge.exe	104
PID 2752 wrote to memory of 5084	2752	msedge.exe	104
PID 2752 wrote to memory of 940	2752	msedge.exe	105
PID 2752 wrote to memory of 940	2752	msedge.exe	105
PID 2752 wrote to memory of 940	2752	msedge.exe	105
PID 2752 wrote to memory of 940	2752	msedge.exe	105

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\60f172403738997a3e49ba5b7b247854bc45b42db5895c47d43b0b0ed86588c1.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3996

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1492
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9D80E3B3DF23CAF42C71103AC641098C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3728
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-5669a1f8-8b25-4f9b-8458-6044553abd4a\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:2924
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3904
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start msedge https://www.med.unc.edu/webguide/wp-content/uploads/sites/419/2019/07/AdobePDF.pdf
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.med.unc.edu/webguide/wp-content/uploads/sites/419/2019/07/AdobePDF.pdf
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2752
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcebf946f8,0x7ffcebf94708,0x7ffcebf94718
        5⤵
        
        PID:3452
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1964,17857928929568599128,3669000991538893712,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1976 /prefetch:2
        5⤵
        
        PID:2948
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1964,17857928929568599128,3669000991538893712,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5084
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1964,17857928929568599128,3669000991538893712,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
        5⤵
        
        PID:940
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,17857928929568599128,3669000991538893712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
        5⤵
        
        PID:1316
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,17857928929568599128,3669000991538893712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
        5⤵
        
        PID:2360
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,17857928929568599128,3669000991538893712,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
        5⤵
        
        PID:1080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --field-trial-handle=1964,17857928929568599128,3669000991538893712,131072 --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=5072 /prefetch:6
        5⤵
        
        PID:1352
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1964,17857928929568599128,3669000991538893712,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5616 /prefetch:8
        5⤵
        
        PID:1148
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1964,17857928929568599128,3669000991538893712,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5616 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1472
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,17857928929568599128,3669000991538893712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
        5⤵
        
        PID:3736
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,17857928929568599128,3669000991538893712,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
        5⤵
        
        PID:4124
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,17857928929568599128,3669000991538893712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
        5⤵
        
        PID:5336
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,17857928929568599128,3669000991538893712,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
        5⤵
        
        PID:5344
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1964,17857928929568599128,3669000991538893712,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4048 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3000
- - C:\Users\Admin\AppData\Local\Temp\MW-5669a1f8-8b25-4f9b-8458-6044553abd4a\files\install86.exe
    "C:\Users\Admin\AppData\Local\Temp\MW-5669a1f8-8b25-4f9b-8458-6044553abd4a\files\install86.exe" /VERYSILENT /VERYSILENT
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2868
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Microsoft\Windows\systemtask.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1148
  - - C:\Windows\SysWOW64\systeminfo.exe
      systeminfo
      4⤵
      System Location Discovery: System Language Discovery
      Gathers system information
      PID:5624

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4840

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3172

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

File and Directory Permissions Modification

T1222

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
306e5694be381544bd2df05155c37078

SHA1
22d16d97551e9853aa79520b1a28b97c7c5bba8c

SHA256
5abbc3cecd936ddd9bd0973f20db472abd35e2f311019d439ba67ad0cbe87cc2

SHA512
6f90580e9df2139f6597310e79d935c9b37f3bd0cf5663ff0f52f584b626a0c6afa92abad4a3b15751e24ae69a52a7da759ae8b0d6a178e953d1174d09141bb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a5fda08b82816af1a922a4076d173658

SHA1
f7b5cfe170012ff7ba401f9b7936c63d3b2257f8

SHA256
040768fe22314af5944c9d69fa038910a3a50f658b967bd27ce5ac7d653ea856

SHA512
85ab2de5e73b20350dcf3b305e56c5a7c230cb54ac3fe61a3474999b685b61b9563ad8ce1d7589a3e72e9bfd234751c4dd955d571d083fd6c6e054da2f067e6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4d54b253c54bef50417a01cf344a4944

SHA1
cba89bc58c764eb394a1be92bf5268461042fa75

SHA256
30507e6934c17ba84c9f1ddc6af3731aaa68c1409c119c1ba0da8d579c379df2

SHA512
549803df85fc102b278926295d5a5d4d5db130e01de438a96ea585252dc3e90ce29460f0916e00294796fc1ff45e8cc6ea7958473c24c435f8d8328a7963fafa

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-5669a1f8-8b25-4f9b-8458-6044553abd4a\files.cab

Filesize
1.6MB

MD5
32ae8557d0880ecf9d0120578c3d4262

SHA1
06b7e7c8ffdbbbda50982135c5966b248d882535

SHA256
6f8cc33cb74cf753413e56b40aca479b6aa5a88edc02c8aa26a2b902f448f862

SHA512
181ebfa32f8906a9b7032b0417262b13240310e40edd76f6b45ddeb6bf3c02a083105256d0aa7b028c9c32d87b92c1add298b5e01aa38d756f2cdd386e41fa39

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-5669a1f8-8b25-4f9b-8458-6044553abd4a\msiwrapper.ini

Filesize
1KB

MD5
f3e9183f1e950390dc3e11fc6153c514

SHA1
ae4ea1b45874a22064f4354b0e6cf1e07410b319

SHA256
808a964d2fa4ee2ddf24a3960f032ae69f5c283231a764fe0816d5635e5852f5

SHA512
7dc6dd6a9a21b00488ae6fc191ae8ac2d63255f1515956785ca9f2f1792d843ca63dab68478fa197e79e3978501af3cc0573e5cb607f97391680be5c92455354

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-5669a1f8-8b25-4f9b-8458-6044553abd4a\msiwrapper.ini

Filesize
1KB

MD5
0958a25522970ea71c36de5e6e4b8181

SHA1
2b21e3842b0840f5c60a39298217b6030cde8c63

SHA256
0ecae21348cad6abbc34605dc262869d0d81878331e18d2399d0eb73f0f4e044

SHA512
24b176268c2cb170562f84c18838c426e0fe72207ebda7b38e120206901e0c68ffe098b0ef894112829fa6c0dd1dad6c4fcf3998a87424ff9225df5d3b541e65

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b4bwb0vu.nfr.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\Installer\MSIE1A5.tmp

Filesize
208KB

MD5
0c8921bbcc37c6efd34faf44cf3b0cb5

SHA1
dcfa71246157edcd09eecaf9d4c5e360b24b3e49

SHA256
fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1

SHA512
ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.1MB

MD5
653a976401c0e4842d4b2a0826b77f8c

SHA1
7905117c49b6f1f163053a9e2c2104f79c91995c

SHA256
b5499e476e99ff1dc485d35a01410817389674fc85aa610c6c44c07c70c96c81

SHA512
562ae95c274547f5865d2efb225b72196e451bdbf3d52f22e32ef23834ea798bb17badac979213ff57f2670167c93966df9f5a802e67bb88c95b5542e28a75cf

Download Submit
\??\Volume{62c5c1e3-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{a2c3de5f-527f-4045-9f64-b4e812512b51}_OnDiskSnapshotProp

Filesize
6KB

MD5
29391c6639e6b68efff755a790736992

SHA1
fc33cf690d93bcd228d9424e3ff552fedcaa25fd

SHA256
1ea55ef01f5171c7d5d1adefdddef21e7a0a0c23b7febda743cf85bc4e91691d

SHA512
331a6cfda4b1981dd213a34b4eed335926d77cd51397fd88f2261025980328e59f3efde28045437c48c9128850e0f664aa2e819a9bc032729fcf2e204ae63bb0

Download Submit
memory/1148-184-0x00000000060B0000-0x0000000006116000-memory.dmp

Filesize
408KB

Download
memory/1148-210-0x00000000078C0000-0x0000000007963000-memory.dmp

Filesize
652KB

Download
memory/1148-182-0x0000000005720000-0x0000000005742000-memory.dmp

Filesize
136KB

Download
memory/1148-183-0x0000000005840000-0x00000000058A6000-memory.dmp

Filesize
408KB

Download
memory/1148-180-0x0000000002DA0000-0x0000000002DD6000-memory.dmp

Filesize
216KB

Download
memory/1148-219-0x0000000007C80000-0x0000000007C88000-memory.dmp

Filesize
32KB

Download
memory/1148-195-0x0000000006220000-0x0000000006574000-memory.dmp

Filesize
3.3MB

Download
memory/1148-196-0x00000000066C0000-0x00000000066DE000-memory.dmp

Filesize
120KB

Download
memory/1148-197-0x0000000006700000-0x000000000674C000-memory.dmp

Filesize
304KB

Download
memory/1148-199-0x000000006EC50000-0x000000006EC9C000-memory.dmp

Filesize
304KB

Download
memory/1148-198-0x0000000006CA0000-0x0000000006CD2000-memory.dmp

Filesize
200KB

Download
memory/1148-181-0x00000000058D0000-0x0000000005EF8000-memory.dmp

Filesize
6.2MB

Download
memory/1148-209-0x0000000006CE0000-0x0000000006CFE000-memory.dmp

Filesize
120KB

Download
memory/1148-211-0x0000000008040000-0x00000000086BA000-memory.dmp

Filesize
6.5MB

Download
memory/1148-212-0x0000000007A00000-0x0000000007A1A000-memory.dmp

Filesize
104KB

Download
memory/1148-213-0x0000000007A60000-0x0000000007A6A000-memory.dmp

Filesize
40KB

Download
memory/1148-214-0x0000000007C90000-0x0000000007D26000-memory.dmp

Filesize
600KB

Download
memory/1148-215-0x0000000007C00000-0x0000000007C11000-memory.dmp

Filesize
68KB

Download
memory/1148-216-0x0000000007C30000-0x0000000007C3E000-memory.dmp

Filesize
56KB

Download
memory/1148-217-0x0000000007C40000-0x0000000007C54000-memory.dmp

Filesize
80KB

Download
memory/1148-218-0x0000000007D50000-0x0000000007D6A000-memory.dmp

Filesize
104KB

Download
memory/2868-175-0x0000000010000000-0x0000000010731000-memory.dmp

Filesize
7.2MB

Download