metastealer | 2a6978db146ea87b8da5cb48b821c8219ac05d6d3f33cbff8571f5ff4141d198

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/12/2024, 02:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a6978db146ea87b8da5cb48b821c8219ac05d6d3f33cbff8571f5ff4141d198.msi
Size

1.8MB
MD5

a08ac9d031b2c05b4ad646e76867f2c2
SHA1

49e8cd403932e528db6ab8fea229dac7dc2064af
SHA256

2a6978db146ea87b8da5cb48b821c8219ac05d6d3f33cbff8571f5ff4141d198
SHA512

3acdb495d5ecf2579d54e7fe30d4e3686f3aab65b6fbf3b39c9e73bead09bd9de422dc91baba45f235baef6c326b5d1c8a58d1e68b2c9ba62a1497f3378ee922
SSDEEP

24576:Kt9cpVDhmldE4LOTVE+2gDcVYBII/g7M3z:9pRhmkthkQIbM

Score

10^/10

metastealer discovery execution persistence privilege_escalation spyware stealer

Malware Config

Extracted

Family

metastealer

kiyaqoimsiieeyqa.xyz

ssqsmisuowqcwsqo.xyz

ykqmwgsuummieaug.xyz

ewukeskgqswqesiw.xyz

cscqcsgewmwwaaui.xyz

cyoksykiamiscyia.xyz

okgomokemoucqeso.xyz

ikwacuakiqeimwua.xyz

aawcsqqaywckiwmi.xyz

aiqasksgmyeqocei.xyz

qgumcuisgaeyuqqe.xyz

eiesoycamyqqgcea.xyz

ywceswakicsqomqw.xyz

auaieuewouawygku.xyz

cmiascusccywowcs.xyz

uiqkkomkaceqacec.xyz

quqeciymqmkqccqw.xyz

ssqsauuuyyigouou.xyz

aogaakukuugqswcy.xyz

ucgwcwsuqsuwewgc.xyz

Attributes

dga_seed
21845
domain_length
16
num_dga_domains
10000
port
443

Signatures

Meta Stealer
Meta Stealer steals passwords stored in browsers, written in C++.
stealer metastealer

MetaStealer payload 1 IoCs

resource	yara_rule
behavioral2/memory/1636-175-0x0000000010000000-0x0000000010731000-memory.dmp	family_metastealer

Metastealer family
metastealer

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
6136	powershell.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2060	ICACLS.EXE

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	cmd.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e57efde.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57efde.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	EXPAND.EXE
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{1C447779-2A69-4A18-8AA7-5CA40A2E3221}	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF08A.tmp	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	EXPAND.EXE

Executes dropped EXE 1 IoCs

pid	Process
1636	setup.exe

Loads dropped DLL 1 IoCs

pid	Process
3952	MsiExec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2176	msiexec.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXPAND.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ICACLS.EXE

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000f59c2d6185d8bf0c0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000f59c2d610000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900f59c2d61000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1df59c2d61000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000f59c2d6100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
696	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
1204	msiexec.exe
1204	msiexec.exe
4224	msedge.exe
4224	msedge.exe
3560	msedge.exe
3560	msedge.exe
1516	identity_helper.exe
1516	identity_helper.exe
6136	powershell.exe
6136	powershell.exe
6136	powershell.exe
1636	setup.exe
1636	setup.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2176	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2176	msiexec.exe
Token: SeSecurityPrivilege	1204	msiexec.exe
Token: SeCreateTokenPrivilege	2176	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2176	msiexec.exe
Token: SeLockMemoryPrivilege	2176	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2176	msiexec.exe
Token: SeMachineAccountPrivilege	2176	msiexec.exe
Token: SeTcbPrivilege	2176	msiexec.exe
Token: SeSecurityPrivilege	2176	msiexec.exe
Token: SeTakeOwnershipPrivilege	2176	msiexec.exe
Token: SeLoadDriverPrivilege	2176	msiexec.exe
Token: SeSystemProfilePrivilege	2176	msiexec.exe
Token: SeSystemtimePrivilege	2176	msiexec.exe
Token: SeProfSingleProcessPrivilege	2176	msiexec.exe
Token: SeIncBasePriorityPrivilege	2176	msiexec.exe
Token: SeCreatePagefilePrivilege	2176	msiexec.exe
Token: SeCreatePermanentPrivilege	2176	msiexec.exe
Token: SeBackupPrivilege	2176	msiexec.exe
Token: SeRestorePrivilege	2176	msiexec.exe
Token: SeShutdownPrivilege	2176	msiexec.exe
Token: SeDebugPrivilege	2176	msiexec.exe
Token: SeAuditPrivilege	2176	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2176	msiexec.exe
Token: SeChangeNotifyPrivilege	2176	msiexec.exe
Token: SeRemoteShutdownPrivilege	2176	msiexec.exe
Token: SeUndockPrivilege	2176	msiexec.exe
Token: SeSyncAgentPrivilege	2176	msiexec.exe
Token: SeEnableDelegationPrivilege	2176	msiexec.exe
Token: SeManageVolumePrivilege	2176	msiexec.exe
Token: SeImpersonatePrivilege	2176	msiexec.exe
Token: SeCreateGlobalPrivilege	2176	msiexec.exe
Token: SeBackupPrivilege	3840	vssvc.exe
Token: SeRestorePrivilege	3840	vssvc.exe
Token: SeAuditPrivilege	3840	vssvc.exe
Token: SeBackupPrivilege	1204	msiexec.exe
Token: SeRestorePrivilege	1204	msiexec.exe
Token: SeRestorePrivilege	1204	msiexec.exe
Token: SeTakeOwnershipPrivilege	1204	msiexec.exe
Token: SeRestorePrivilege	1204	msiexec.exe
Token: SeTakeOwnershipPrivilege	1204	msiexec.exe
Token: SeBackupPrivilege	3916	srtasks.exe
Token: SeRestorePrivilege	3916	srtasks.exe
Token: SeSecurityPrivilege	3916	srtasks.exe
Token: SeTakeOwnershipPrivilege	3916	srtasks.exe
Token: SeBackupPrivilege	3916	srtasks.exe
Token: SeRestorePrivilege	3916	srtasks.exe
Token: SeSecurityPrivilege	3916	srtasks.exe
Token: SeTakeOwnershipPrivilege	3916	srtasks.exe
Token: SeDebugPrivilege	6136	powershell.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2176	msiexec.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 3916	1204	msiexec.exe	98
PID 1204 wrote to memory of 3916	1204	msiexec.exe	98
PID 1204 wrote to memory of 3952	1204	msiexec.exe	100
PID 1204 wrote to memory of 3952	1204	msiexec.exe	100
PID 1204 wrote to memory of 3952	1204	msiexec.exe	100
PID 3952 wrote to memory of 2060	3952	MsiExec.exe	101
PID 3952 wrote to memory of 2060	3952	MsiExec.exe	101
PID 3952 wrote to memory of 2060	3952	MsiExec.exe	101
PID 3952 wrote to memory of 5104	3952	MsiExec.exe	106
PID 3952 wrote to memory of 5104	3952	MsiExec.exe	106
PID 3952 wrote to memory of 5104	3952	MsiExec.exe	106
PID 3952 wrote to memory of 4876	3952	MsiExec.exe	109
PID 3952 wrote to memory of 4876	3952	MsiExec.exe	109
PID 3952 wrote to memory of 4876	3952	MsiExec.exe	109
PID 4876 wrote to memory of 3560	4876	cmd.exe	111
PID 4876 wrote to memory of 3560	4876	cmd.exe	111
PID 3560 wrote to memory of 3900	3560	msedge.exe	112
PID 3560 wrote to memory of 3900	3560	msedge.exe	112
PID 3560 wrote to memory of 380	3560	msedge.exe	114
PID 3560 wrote to memory of 380	3560	msedge.exe	114
PID 3560 wrote to memory of 380	3560	msedge.exe	114
PID 3560 wrote to memory of 380	3560	msedge.exe	114
PID 3560 wrote to memory of 380	3560	msedge.exe	114
PID 3560 wrote to memory of 380	3560	msedge.exe	114
PID 3560 wrote to memory of 380	3560	msedge.exe	114
PID 3560 wrote to memory of 380	3560	msedge.exe	114
PID 3560 wrote to memory of 380	3560	msedge.exe	114
PID 3560 wrote to memory of 380	3560	msedge.exe	114
PID 3560 wrote to memory of 380	3560	msedge.exe	114
PID 3560 wrote to memory of 380	3560	msedge.exe	114
PID 3560 wrote to memory of 380	3560	msedge.exe	114
PID 3560 wrote to memory of 380	3560	msedge.exe	114
PID 3560 wrote to memory of 380	3560	msedge.exe	114
PID 3560 wrote to memory of 380	3560	msedge.exe	114
PID 3560 wrote to memory of 380	3560	msedge.exe	114
PID 3560 wrote to memory of 380	3560	msedge.exe	114
PID 3560 wrote to memory of 380	3560	msedge.exe	114
PID 3560 wrote to memory of 380	3560	msedge.exe	114
PID 3560 wrote to memory of 380	3560	msedge.exe	114
PID 3560 wrote to memory of 380	3560	msedge.exe	114
PID 3560 wrote to memory of 380	3560	msedge.exe	114
PID 3560 wrote to memory of 380	3560	msedge.exe	114
PID 3560 wrote to memory of 380	3560	msedge.exe	114
PID 3560 wrote to memory of 380	3560	msedge.exe	114
PID 3560 wrote to memory of 380	3560	msedge.exe	114
PID 3560 wrote to memory of 380	3560	msedge.exe	114
PID 3560 wrote to memory of 380	3560	msedge.exe	114
PID 3560 wrote to memory of 380	3560	msedge.exe	114
PID 3560 wrote to memory of 380	3560	msedge.exe	114
PID 3560 wrote to memory of 380	3560	msedge.exe	114
PID 3560 wrote to memory of 380	3560	msedge.exe	114
PID 3560 wrote to memory of 380	3560	msedge.exe	114
PID 3560 wrote to memory of 380	3560	msedge.exe	114
PID 3560 wrote to memory of 380	3560	msedge.exe	114
PID 3560 wrote to memory of 380	3560	msedge.exe	114
PID 3560 wrote to memory of 380	3560	msedge.exe	114
PID 3560 wrote to memory of 380	3560	msedge.exe	114
PID 3560 wrote to memory of 380	3560	msedge.exe	114
PID 3560 wrote to memory of 4224	3560	msedge.exe	115
PID 3560 wrote to memory of 4224	3560	msedge.exe	115
PID 3560 wrote to memory of 4016	3560	msedge.exe	116
PID 3560 wrote to memory of 4016	3560	msedge.exe	116
PID 3560 wrote to memory of 4016	3560	msedge.exe	116
PID 3560 wrote to memory of 4016	3560	msedge.exe	116

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\2a6978db146ea87b8da5cb48b821c8219ac05d6d3f33cbff8571f5ff4141d198.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2176

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3916
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0C182CF624CCEBE6C1909478892268DC
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3952
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-ba6bb1db-b69f-40de-b60d-de8e592ebd49\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:2060
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:5104
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start msedge https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdf
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdf
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:3560
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffaf15846f8,0x7ffaf1584708,0x7ffaf1584718
        5⤵
        
        PID:3900
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,3058715973966090912,10026454697555247801,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:2
        5⤵
        
        PID:380
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2228,3058715973966090912,10026454697555247801,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4224
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2228,3058715973966090912,10026454697555247801,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
        5⤵
        
        PID:4016
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,3058715973966090912,10026454697555247801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
        5⤵
        
        PID:928
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,3058715973966090912,10026454697555247801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
        5⤵
        
        PID:232
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,3058715973966090912,10026454697555247801,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
        5⤵
        
        PID:4600
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,3058715973966090912,10026454697555247801,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1516
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,3058715973966090912,10026454697555247801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
        5⤵
        
        PID:2368
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,3058715973966090912,10026454697555247801,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
        5⤵
        
        PID:2060
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,3058715973966090912,10026454697555247801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
        5⤵
        
        PID:5200
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,3058715973966090912,10026454697555247801,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
        5⤵
        
        PID:5208
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,3058715973966090912,10026454697555247801,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2396 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4164
- - C:\Users\Admin\AppData\Local\Temp\MW-ba6bb1db-b69f-40de-b60d-de8e592ebd49\files\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\MW-ba6bb1db-b69f-40de-b60d-de8e592ebd49\files\setup.exe" /VERYSILENT /VERYSILENT
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1636
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Microsoft\Windows\systemtask.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6136
  - - C:\Windows\SysWOW64\systeminfo.exe
      systeminfo
      4⤵
      System Location Discovery: System Language Discovery
      Gathers system information
      PID:696

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3840

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

File and Directory Permissions Modification

T1222

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
443a627d539ca4eab732bad0cbe7332b

SHA1
86b18b906a1acd2a22f4b2c78ac3564c394a9569

SHA256
1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

SHA512
923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
99afa4934d1e3c56bbce114b356e8a99

SHA1
3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

SHA256
08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

SHA512
76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
184B

MD5
0144f813407aa0fe300436850b359a93

SHA1
335b4016acb582f6110429d8742e639a007f61dc

SHA256
50d8020d11f3876e18a3fd05209f5962ed94f352efe00e30aa2e7ebc20424d9b

SHA512
de88771cc91785f7ae776a4e4bbdc2573d9ba209304577eff120521dcc806fdbf86bc33d66cef4c8ed8252e47a3abb65bb9813efe18085be74dce6fa4e7268bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dfa384df7d3888888fa325652550b5da

SHA1
870b3c9374d8de981dc1d23bbe0f7e7df2314a52

SHA256
59d85f365370321a4fda163a76dc3ab2d3145cb3b19bc89585dcdc38d5b7deae

SHA512
e2a5d45f48516ce296da68a8640d6ed6a60ecfdece0f14fbf5649d2d0d0851f36396e2c0d966c469aaeeca9ad30014944f93b57b087e906989414e2cf464d2e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ebdb75355355f6ce6280ebf1f7377ae8

SHA1
09b8391cf0f0edc10e6c43ec5011bfe13ba7e1f2

SHA256
0cc51a38d55860045a68536e73c438e24849fb1f8b7e0d32a773b6686e87d8f5

SHA512
42d81ac0b4c5183cb28b04a03528944cae27605da6c86219abbab10df0720c764ac2642a62734ccb99c42f59287291f316140310b79b641be7ae57bfb12aeafd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b9fc0f5d89879109537b4c5a1619ad10

SHA1
8efe2553396a206d89dd05850ce75d5a75d5c50f

SHA256
3350ad9283768bb24aa3723e375724b31d46393eb71c0ab1c39b3c10dab8f8b4

SHA512
84a47198e105c1e18597c0c79eb2fc86a74d1eb63ca1a72563b6a3f6ecc0dd1e55b4152b915150c63f77377a182b6e6bd3c0a6066319e7980fd303f03ac5c52f

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-ba6bb1db-b69f-40de-b60d-de8e592ebd49\files.cab

Filesize
1.5MB

MD5
6ea1c4d2c75ee362820e814110f3dc90

SHA1
6f73fda661df49c64f6d8d2b66bef5a2f1939775

SHA256
8d1a7eafd0eb76d2aa0b522c6a98240489692fd1ca82565ad85d65be64b05d94

SHA512
5335ac317d7aeb93f509f073442e65a5be2bf0aed5fd88839d69a6b72360560ed227975fac062ab8d2476074417288dfd53eddfb3b12667ae0a8677e73f7a495

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-ba6bb1db-b69f-40de-b60d-de8e592ebd49\msiwrapper.ini

Filesize
380B

MD5
f0064a2f7c934e338afdd6198154cb7b

SHA1
6ee0b6071f5ef6dfbb3ddd3f6203e5ce10822301

SHA256
86e19ca05e55783c3939861d7fb416a281e545e28bb68522e1c641f371c3bcb8

SHA512
3e5e454221d51f511c34aae0d19a724e4461b10f04a39e4a47a21eeb212e99627aab2475e8ab6761b9a21f5c7c1d939dd47ca4b7c495a859f3750a2c112dfafe

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-ba6bb1db-b69f-40de-b60d-de8e592ebd49\msiwrapper.ini

Filesize
1KB

MD5
28b114bf37d3576b6b936dcf2ade54b1

SHA1
1484adaca79131c67aff26462aa1a14dff110562

SHA256
1581e35650c2146905c00ed9cf3c37e37d0586e5b4cf29618773023e8def3162

SHA512
4904fb46825780497d155d19bcb68540be0386ba15a68d2e072bf7abb12d1fb8705972319a601b615ffeb20f22864c89a12bf96309cb1e8b291a8ef6c17d0a0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-ba6bb1db-b69f-40de-b60d-de8e592ebd49\msiwrapper.ini

Filesize
1KB

MD5
c90021aac4032d4878b1c01ff42ec1df

SHA1
00e6e34e9af7c03f75a60c7cde256271f3381699

SHA256
6d8e5ae0c82b3890a6be4c3c6daa649e339a95a0a6cb3e58208753d42cab7046

SHA512
ef04634e600bd9dfb582b21ebd91e4b88e0a28bd6d569daf5aa1749ed1d0488556f14eae564bb038751c8d2105e188f8607a350f29a2c2f5c91e839acbe670a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_km31ik4z.ci0.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\Installer\MSIF08A.tmp

Filesize
208KB

MD5
0c8921bbcc37c6efd34faf44cf3b0cb5

SHA1
dcfa71246157edcd09eecaf9d4c5e360b24b3e49

SHA256
fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1

SHA512
ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.1MB

MD5
d26abfd262764730a95f38d061d0b099

SHA1
41ad7104604c1eca031c31745b8d850bd6c0bdca

SHA256
4311261a5f0bd9093c48e67bb0cd5328506ddb425a5a0a910338f0f54a43fb81

SHA512
f9745ae8feeea7bfba4680b5b2596e642fca7bb42ed6ec226747aed3f046ed57b51d60d3422cc44fb0b977b66a8e35a72798e16ab38c14a5e2ffce75e5770ed9

Download Submit
\??\Volume{612d9cf5-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{200af845-b04b-414d-b00b-761f806c4abf}_OnDiskSnapshotProp

Filesize
6KB

MD5
0b2672266872065210684ea41e9dc338

SHA1
f959cef023eabd7c299c17f524bcf54af77736e6

SHA256
976481944e5b4571d47dd05b0e920846a447918d0c5d81e5ab26ce3fb8da6310

SHA512
23d5f0dd54b1d0634e085164fc8cbc0d236efa183145e095298c955d43becd190be9f57620f9000de5d26a9f7649edf7ef779d8520f0957971841a2d88f8da36

Download Submit
memory/1636-175-0x0000000010000000-0x0000000010731000-memory.dmp

Filesize
7.2MB

Download
memory/6136-183-0x00000000059C0000-0x00000000059E2000-memory.dmp

Filesize
136KB

Download
memory/6136-211-0x0000000008200000-0x000000000887A000-memory.dmp

Filesize
6.5MB

Download
memory/6136-185-0x0000000006210000-0x0000000006276000-memory.dmp

Filesize
408KB

Download
memory/6136-181-0x0000000005A40000-0x0000000006068000-memory.dmp

Filesize
6.2MB

Download
memory/6136-195-0x0000000006280000-0x00000000065D4000-memory.dmp

Filesize
3.3MB

Download
memory/6136-196-0x0000000006860000-0x000000000687E000-memory.dmp

Filesize
120KB

Download
memory/6136-197-0x00000000068A0000-0x00000000068EC000-memory.dmp

Filesize
304KB

Download
memory/6136-198-0x0000000007830000-0x0000000007862000-memory.dmp

Filesize
200KB

Download
memory/6136-199-0x000000006E2C0000-0x000000006E30C000-memory.dmp

Filesize
304KB

Download
memory/6136-209-0x0000000006E60000-0x0000000006E7E000-memory.dmp

Filesize
120KB

Download
memory/6136-210-0x0000000007A80000-0x0000000007B23000-memory.dmp

Filesize
652KB

Download
memory/6136-184-0x00000000061A0000-0x0000000006206000-memory.dmp

Filesize
408KB

Download
memory/6136-212-0x0000000007BB0000-0x0000000007BCA000-memory.dmp

Filesize
104KB

Download
memory/6136-213-0x0000000007C10000-0x0000000007C1A000-memory.dmp

Filesize
40KB

Download
memory/6136-214-0x0000000007E40000-0x0000000007ED6000-memory.dmp

Filesize
600KB

Download
memory/6136-215-0x0000000007DB0000-0x0000000007DC1000-memory.dmp

Filesize
68KB

Download
memory/6136-216-0x0000000007DE0000-0x0000000007DEE000-memory.dmp

Filesize
56KB

Download
memory/6136-217-0x0000000007DF0000-0x0000000007E04000-memory.dmp

Filesize
80KB

Download
memory/6136-218-0x0000000007F00000-0x0000000007F1A000-memory.dmp

Filesize
104KB

Download
memory/6136-219-0x0000000007E30000-0x0000000007E38000-memory.dmp

Filesize
32KB

Download
memory/6136-180-0x00000000052B0000-0x00000000052E6000-memory.dmp

Filesize
216KB

Download