metastealer | 86f2fe4cb375e8a8ac2770c82050a135761a3b58e19232f8eaad3756c6ae94a7

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-12-2024 17:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setup.msi
Size

2.0MB
MD5

c4fd4e278fa9213069e5e786606e5120
SHA1

452403f6f96b7d61201bd29b1139d65e6e81ad47
SHA256

86f2fe4cb375e8a8ac2770c82050a135761a3b58e19232f8eaad3756c6ae94a7
SHA512

f0cf5633ec56fb2b88aa8b10119c3b2c2b4af7dc9c216c43c43954225ac9111eb47199adff0b361a0549a4035bc0f9c937a2bd7f4195d5432940bff9089758eb
SSDEEP

24576:tt9cpVDh4l3/heB1MMe49nn9avnA/4a/JnFVWNCJGEuST:ipRh45/hefMbInP4axQZST

Score

10^/10

metastealer discovery execution persistence privilege_escalation spyware stealer

Malware Config

Extracted

Family

metastealer

kiyaqoimsiieeyqa.xyz

ssqsmisuowqcwsqo.xyz

ykqmwgsuummieaug.xyz

ewukeskgqswqesiw.xyz

cscqcsgewmwwaaui.xyz

cyoksykiamiscyia.xyz

okgomokemoucqeso.xyz

ikwacuakiqeimwua.xyz

aawcsqqaywckiwmi.xyz

aiqasksgmyeqocei.xyz

qgumcuisgaeyuqqe.xyz

eiesoycamyqqgcea.xyz

ywceswakicsqomqw.xyz

auaieuewouawygku.xyz

cmiascusccywowcs.xyz

uiqkkomkaceqacec.xyz

quqeciymqmkqccqw.xyz

ssqsauuuyyigouou.xyz

aogaakukuugqswcy.xyz

ucgwcwsuqsuwewgc.xyz

Attributes

dga_seed
21845
domain_length
16
num_dga_domains
10000
port
443

Signatures

Meta Stealer
Meta Stealer steals passwords stored in browsers, written in C++.
stealer metastealer

MetaStealer payload 1 IoCs

resource	yara_rule
behavioral2/memory/4948-185-0x0000000010000000-0x0000000010731000-memory.dmp	family_metastealer

Metastealer family
metastealer

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5204	powershell.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2272	ICACLS.EXE

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	cmd.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	EXPAND.EXE
File created	C:\Windows\Installer\e57b3ee.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57b3ee.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{750EC30E-4A82-4376-AEC4-8635FDEAFE3F}	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB4AA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	EXPAND.EXE

Executes dropped EXE 1 IoCs

pid	Process
4948	setup.exe

Loads dropped DLL 1 IoCs

pid	Process
1700	MsiExec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
5060	msiexec.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ICACLS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXPAND.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e3c1c56297b3270b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e3c1c5620000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900e3c1c562000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de3c1c562000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000e3c1c56200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2736	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
4628	msiexec.exe
4628	msiexec.exe
1432	msedge.exe
1432	msedge.exe
2612	msedge.exe
2612	msedge.exe
1416	identity_helper.exe
1416	identity_helper.exe
5204	powershell.exe
5204	powershell.exe
5204	powershell.exe
4948	setup.exe
4948	setup.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5060	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5060	msiexec.exe
Token: SeSecurityPrivilege	4628	msiexec.exe
Token: SeCreateTokenPrivilege	5060	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5060	msiexec.exe
Token: SeLockMemoryPrivilege	5060	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5060	msiexec.exe
Token: SeMachineAccountPrivilege	5060	msiexec.exe
Token: SeTcbPrivilege	5060	msiexec.exe
Token: SeSecurityPrivilege	5060	msiexec.exe
Token: SeTakeOwnershipPrivilege	5060	msiexec.exe
Token: SeLoadDriverPrivilege	5060	msiexec.exe
Token: SeSystemProfilePrivilege	5060	msiexec.exe
Token: SeSystemtimePrivilege	5060	msiexec.exe
Token: SeProfSingleProcessPrivilege	5060	msiexec.exe
Token: SeIncBasePriorityPrivilege	5060	msiexec.exe
Token: SeCreatePagefilePrivilege	5060	msiexec.exe
Token: SeCreatePermanentPrivilege	5060	msiexec.exe
Token: SeBackupPrivilege	5060	msiexec.exe
Token: SeRestorePrivilege	5060	msiexec.exe
Token: SeShutdownPrivilege	5060	msiexec.exe
Token: SeDebugPrivilege	5060	msiexec.exe
Token: SeAuditPrivilege	5060	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5060	msiexec.exe
Token: SeChangeNotifyPrivilege	5060	msiexec.exe
Token: SeRemoteShutdownPrivilege	5060	msiexec.exe
Token: SeUndockPrivilege	5060	msiexec.exe
Token: SeSyncAgentPrivilege	5060	msiexec.exe
Token: SeEnableDelegationPrivilege	5060	msiexec.exe
Token: SeManageVolumePrivilege	5060	msiexec.exe
Token: SeImpersonatePrivilege	5060	msiexec.exe
Token: SeCreateGlobalPrivilege	5060	msiexec.exe
Token: SeBackupPrivilege	1200	vssvc.exe
Token: SeRestorePrivilege	1200	vssvc.exe
Token: SeAuditPrivilege	1200	vssvc.exe
Token: SeBackupPrivilege	4628	msiexec.exe
Token: SeRestorePrivilege	4628	msiexec.exe
Token: SeRestorePrivilege	4628	msiexec.exe
Token: SeTakeOwnershipPrivilege	4628	msiexec.exe
Token: SeRestorePrivilege	4628	msiexec.exe
Token: SeTakeOwnershipPrivilege	4628	msiexec.exe
Token: SeBackupPrivilege	1788	srtasks.exe
Token: SeRestorePrivilege	1788	srtasks.exe
Token: SeSecurityPrivilege	1788	srtasks.exe
Token: SeTakeOwnershipPrivilege	1788	srtasks.exe
Token: SeBackupPrivilege	1788	srtasks.exe
Token: SeRestorePrivilege	1788	srtasks.exe
Token: SeSecurityPrivilege	1788	srtasks.exe
Token: SeTakeOwnershipPrivilege	1788	srtasks.exe
Token: SeDebugPrivilege	5204	powershell.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
5060	msiexec.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 1788	4628	msiexec.exe	92
PID 4628 wrote to memory of 1788	4628	msiexec.exe	92
PID 4628 wrote to memory of 1700	4628	msiexec.exe	94
PID 4628 wrote to memory of 1700	4628	msiexec.exe	94
PID 4628 wrote to memory of 1700	4628	msiexec.exe	94
PID 1700 wrote to memory of 2272	1700	MsiExec.exe	95
PID 1700 wrote to memory of 2272	1700	MsiExec.exe	95
PID 1700 wrote to memory of 2272	1700	MsiExec.exe	95
PID 1700 wrote to memory of 4924	1700	MsiExec.exe	97
PID 1700 wrote to memory of 4924	1700	MsiExec.exe	97
PID 1700 wrote to memory of 4924	1700	MsiExec.exe	97
PID 1700 wrote to memory of 1628	1700	MsiExec.exe	101
PID 1700 wrote to memory of 1628	1700	MsiExec.exe	101
PID 1700 wrote to memory of 1628	1700	MsiExec.exe	101
PID 1628 wrote to memory of 2612	1628	cmd.exe	103
PID 1628 wrote to memory of 2612	1628	cmd.exe	103
PID 2612 wrote to memory of 3824	2612	msedge.exe	104
PID 2612 wrote to memory of 3824	2612	msedge.exe	104
PID 2612 wrote to memory of 4040	2612	msedge.exe	106
PID 2612 wrote to memory of 4040	2612	msedge.exe	106
PID 2612 wrote to memory of 4040	2612	msedge.exe	106
PID 2612 wrote to memory of 4040	2612	msedge.exe	106
PID 2612 wrote to memory of 4040	2612	msedge.exe	106
PID 2612 wrote to memory of 4040	2612	msedge.exe	106
PID 2612 wrote to memory of 4040	2612	msedge.exe	106
PID 2612 wrote to memory of 4040	2612	msedge.exe	106
PID 2612 wrote to memory of 4040	2612	msedge.exe	106
PID 2612 wrote to memory of 4040	2612	msedge.exe	106
PID 2612 wrote to memory of 4040	2612	msedge.exe	106
PID 2612 wrote to memory of 4040	2612	msedge.exe	106
PID 2612 wrote to memory of 4040	2612	msedge.exe	106
PID 2612 wrote to memory of 4040	2612	msedge.exe	106
PID 2612 wrote to memory of 4040	2612	msedge.exe	106
PID 2612 wrote to memory of 4040	2612	msedge.exe	106
PID 2612 wrote to memory of 4040	2612	msedge.exe	106
PID 2612 wrote to memory of 4040	2612	msedge.exe	106
PID 2612 wrote to memory of 4040	2612	msedge.exe	106
PID 2612 wrote to memory of 4040	2612	msedge.exe	106
PID 2612 wrote to memory of 4040	2612	msedge.exe	106
PID 2612 wrote to memory of 4040	2612	msedge.exe	106
PID 2612 wrote to memory of 4040	2612	msedge.exe	106
PID 2612 wrote to memory of 4040	2612	msedge.exe	106
PID 2612 wrote to memory of 4040	2612	msedge.exe	106
PID 2612 wrote to memory of 4040	2612	msedge.exe	106
PID 2612 wrote to memory of 4040	2612	msedge.exe	106
PID 2612 wrote to memory of 4040	2612	msedge.exe	106
PID 2612 wrote to memory of 4040	2612	msedge.exe	106
PID 2612 wrote to memory of 4040	2612	msedge.exe	106
PID 2612 wrote to memory of 4040	2612	msedge.exe	106
PID 2612 wrote to memory of 4040	2612	msedge.exe	106
PID 2612 wrote to memory of 4040	2612	msedge.exe	106
PID 2612 wrote to memory of 4040	2612	msedge.exe	106
PID 2612 wrote to memory of 4040	2612	msedge.exe	106
PID 2612 wrote to memory of 4040	2612	msedge.exe	106
PID 2612 wrote to memory of 4040	2612	msedge.exe	106
PID 2612 wrote to memory of 4040	2612	msedge.exe	106
PID 2612 wrote to memory of 4040	2612	msedge.exe	106
PID 2612 wrote to memory of 4040	2612	msedge.exe	106
PID 2612 wrote to memory of 1432	2612	msedge.exe	107
PID 2612 wrote to memory of 1432	2612	msedge.exe	107
PID 2612 wrote to memory of 540	2612	msedge.exe	108
PID 2612 wrote to memory of 540	2612	msedge.exe	108
PID 2612 wrote to memory of 540	2612	msedge.exe	108
PID 2612 wrote to memory of 540	2612	msedge.exe	108

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\setup.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5060

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1788
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B51EF4EB8EFA831136DE0A47C73D6886
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1700
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-e1daba9e-df72-4d97-9425-49c0be50346a\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:2272
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4924
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start msedge https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdf
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdf
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2612
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffcbcb46f8,0x7fffcbcb4708,0x7fffcbcb4718
        5⤵
        
        PID:3824
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,11582797930644026051,3233807727013261635,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
        5⤵
        
        PID:4040
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,11582797930644026051,3233807727013261635,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,11582797930644026051,3233807727013261635,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
        5⤵
        
        PID:540
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,11582797930644026051,3233807727013261635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
        5⤵
        
        PID:1292
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,11582797930644026051,3233807727013261635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
        5⤵
        
        PID:2708
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,11582797930644026051,3233807727013261635,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
        5⤵
        
        PID:1792
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,11582797930644026051,3233807727013261635,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1416
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,11582797930644026051,3233807727013261635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
        5⤵
        
        PID:1492
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,11582797930644026051,3233807727013261635,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
        5⤵
        
        PID:452
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,11582797930644026051,3233807727013261635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:1
        5⤵
        
        PID:5240
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,11582797930644026051,3233807727013261635,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
        5⤵
        
        PID:5248
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,11582797930644026051,3233807727013261635,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5780
- - C:\Users\Admin\AppData\Local\Temp\MW-e1daba9e-df72-4d97-9425-49c0be50346a\files\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\MW-e1daba9e-df72-4d97-9425-49c0be50346a\files\setup.exe" /VERYSILENT /VERYSILENT
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4948
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Microsoft\Windows\systemtask.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5204
  - - C:\Windows\SysWOW64\systeminfo.exe
      systeminfo
      4⤵
      System Location Discovery: System Language Discovery
      Gathers system information
      PID:2736

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3188

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

File and Directory Permissions Modification

T1222

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
184B

MD5
0144f813407aa0fe300436850b359a93

SHA1
335b4016acb582f6110429d8742e639a007f61dc

SHA256
50d8020d11f3876e18a3fd05209f5962ed94f352efe00e30aa2e7ebc20424d9b

SHA512
de88771cc91785f7ae776a4e4bbdc2573d9ba209304577eff120521dcc806fdbf86bc33d66cef4c8ed8252e47a3abb65bb9813efe18085be74dce6fa4e7268bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
085f61505a9b6e6095bb8b8211366d1e

SHA1
c8ff4eae5de4886cc923e449beb9124c80dea82a

SHA256
98548c5b517362e1371865444bc29a21aad9c61e2e8a7e2e09f44f5907cf7606

SHA512
4b79d74f0b53ab4ce0583abe2375bd2911c2b218a046c91a40055cf49481906c8f6db7ad9ea9660ae0aff4a8cc9826a7118a323544e23a1b8e4c77930db8740e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
37b0b4e956e02e26f1fc7415739c43ab

SHA1
341cfc121f8fe8a55a1caed99082c80723ae1a57

SHA256
8b13881ad8563559a7679ec07f0047642d52a5fcc9f770c264d40f718c559f6a

SHA512
49faf13b0ee5426d773ee08e322175c3d96019c70c4945b0fb2d308ae4a857f2b8726cb94e9a9523ef24ac01d5f580fe085c4f828255533731755abd27f14deb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2c2205df900bb01882ff2eb7bc0503e1

SHA1
c68b5cfa06b26cc3232522705850d1e0aebda2a6

SHA256
08559e096e96f74cf6cc60fd21cc516635c896bc1ca5bc57cf0bca85629ea43e

SHA512
72e6505528b8a7f6e6229c00904d78ea694ef97ac919a9418c53b6b0560d7ce345eb340192d667bd8be70c68b46f4c25d070d71b1bae85082cc7c1581012a37b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-e1daba9e-df72-4d97-9425-49c0be50346a\files.cab

Filesize
1.7MB

MD5
c2e7c01653046e6b379dab9b2e3aea77

SHA1
3b6b2d7e88189b8b59b42bfca97daf8c861ea9db

SHA256
1f8097cd8c16b83efe4f41bc3ac9137bab69dcbf912cf6ff0e68ddb19318a45a

SHA512
a02ce1b231b16f0e1b4fbd3fc880147e3d84388e293976a6d712ee647e51dc7ac8742ad49471df0e3fd5956919f63a97df66e1f8e239ef4be828abf17504fcb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-e1daba9e-df72-4d97-9425-49c0be50346a\msiwrapper.ini

Filesize
1KB

MD5
f5cbe76b4b2c437481c98ed98cc3b2d6

SHA1
6731ccd16b95509a54a47fbf368c4835d92ef99d

SHA256
af33312d28d9bbeca726b69188484c9b56e8038abcd358194100a4ea6a5c5525

SHA512
515a13fecb2c9e221fc4cefc2aea27fbec20b0040f5376a9406d22278e9a39747655dc7d527d728d43ba2648296a5b1dfbef66a9da6e96fe1189f5917a46f300

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-e1daba9e-df72-4d97-9425-49c0be50346a\msiwrapper.ini

Filesize
1KB

MD5
01f8e4893ae0583cfdee4868b328403b

SHA1
e580957c641d944a6c8736872e19672f0bcc7cfe

SHA256
4e685ee07bde1bb749d503aea062a2c9febb1bd05fbcb9bae5793d3564d1fe32

SHA512
e7b1c99693450357c24c57d62e34f2e7012d7ef6534ed6373c3bedef9f7025ad278a0c71e4d08906bbd8138b6763c2d77e96802ac7833d6ef6c5dd00b1c62ce5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2ybwxiww.qpr.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\Installer\MSIB4AA.tmp

Filesize
208KB

MD5
0c8921bbcc37c6efd34faf44cf3b0cb5

SHA1
dcfa71246157edcd09eecaf9d4c5e360b24b3e49

SHA256
fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1

SHA512
ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.1MB

MD5
302bf5094fd4bdf9220512f79b83eedd

SHA1
a9f4879585bd7f1a750d66cc8de17c9d805dbe7e

SHA256
a8fe6a662b3df0dcecfec3b13b1cd79a8b8323df12667a4c37ec6930ddc0a631

SHA512
1a3eb03aeab9ae68565203851c7674e56da86f19850b4eb15bb82f1ce3bd43dbf39916271177bb3d55bc9a71983e456ec2e46ad1ad98a43d7bf30703a0786f0e

Download Submit
\??\Volume{62c5c1e3-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{a523e0c3-01da-4997-955a-89aa3d236049}_OnDiskSnapshotProp

Filesize
6KB

MD5
9a45115d67263157ba44ea10f479b852

SHA1
4fafbab27a6d602b59ddd22bcd18675123223279

SHA256
7852b6321fe37d2775172b19ccf65e7b6ad684f192448742030d79303be71471

SHA512
6d95570be2ac1edda7a1de835c528d0c68471337fe41ea1b504a6ab7684b80ed9a255fe5f2bbfb78613606389ee1a73b6b445bc93369fc19f02150408c15be60

Download Submit
memory/4948-185-0x0000000010000000-0x0000000010731000-memory.dmp

Filesize
7.2MB

Download
memory/5204-193-0x00000000057C0000-0x0000000005826000-memory.dmp

Filesize
408KB

Download
memory/5204-220-0x0000000006F80000-0x0000000007023000-memory.dmp

Filesize
652KB

Download
memory/5204-191-0x00000000050E0000-0x0000000005708000-memory.dmp

Filesize
6.2MB

Download
memory/5204-194-0x0000000005960000-0x00000000059C6000-memory.dmp

Filesize
408KB

Download
memory/5204-190-0x00000000026B0000-0x00000000026E6000-memory.dmp

Filesize
216KB

Download
memory/5204-204-0x0000000005AD0000-0x0000000005E24000-memory.dmp

Filesize
3.3MB

Download
memory/5204-206-0x0000000005F80000-0x0000000005F9E000-memory.dmp

Filesize
120KB

Download
memory/5204-207-0x0000000006030000-0x000000000607C000-memory.dmp

Filesize
304KB

Download
memory/5204-209-0x000000006E350000-0x000000006E39C000-memory.dmp

Filesize
304KB

Download
memory/5204-208-0x0000000006F40000-0x0000000006F72000-memory.dmp

Filesize
200KB

Download
memory/5204-219-0x0000000006560000-0x000000000657E000-memory.dmp

Filesize
120KB

Download
memory/5204-192-0x0000000005720000-0x0000000005742000-memory.dmp

Filesize
136KB

Download
memory/5204-221-0x00000000079B0000-0x000000000802A000-memory.dmp

Filesize
6.5MB

Download
memory/5204-222-0x00000000070A0000-0x00000000070BA000-memory.dmp

Filesize
104KB

Download
memory/5204-223-0x0000000007100000-0x000000000710A000-memory.dmp

Filesize
40KB

Download
memory/5204-224-0x0000000007540000-0x00000000075D6000-memory.dmp

Filesize
600KB

Download
memory/5204-225-0x00000000074B0000-0x00000000074C1000-memory.dmp

Filesize
68KB

Download
memory/5204-226-0x00000000074E0000-0x00000000074EE000-memory.dmp

Filesize
56KB

Download
memory/5204-227-0x00000000074F0000-0x0000000007504000-memory.dmp

Filesize
80KB

Download
memory/5204-229-0x0000000007530000-0x0000000007538000-memory.dmp

Filesize
32KB

Download
memory/5204-228-0x0000000007600000-0x000000000761A000-memory.dmp

Filesize
104KB

Download