metastealer | dde8620f2939fee20bb2ce914a18589c77010ffa5058e70aebea3ff1286d3d94

Analysis

max time kernel
146s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2024 09:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

441e504c70e28d1d46194ce389141db7.msi
Size

2.0MB
MD5

441e504c70e28d1d46194ce389141db7
SHA1

876fe9fec362419c809eec1ef97682f0045f62a7
SHA256

dde8620f2939fee20bb2ce914a18589c77010ffa5058e70aebea3ff1286d3d94
SHA512

1b68c24b4f2fee2f100d9ef2f477bcd83ca07457967abb4cd4d4bd15312959a60b1ae3b8da7e6d692c12b078ae4ce079fed4a4ba9bdb437e3948776e49b9389b
SSDEEP

24576:Kt9cpVDhbkEUnIVp7w4dXR7yu2tTUMseARcqqfZNy3V/3xdurB7F/1O:9pRhbUnIVpZB7Mzoc7NS/3xdurndO

Score

10^/10

metastealer discovery execution persistence privilege_escalation spyware stealer

Malware Config

Extracted

Family

metastealer

kiyaqoimsiieeyqa.xyz

ssqsmisuowqcwsqo.xyz

ykqmwgsuummieaug.xyz

ewukeskgqswqesiw.xyz

cscqcsgewmwwaaui.xyz

cyoksykiamiscyia.xyz

okgomokemoucqeso.xyz

ikwacuakiqeimwua.xyz

aawcsqqaywckiwmi.xyz

aiqasksgmyeqocei.xyz

qgumcuisgaeyuqqe.xyz

eiesoycamyqqgcea.xyz

ywceswakicsqomqw.xyz

auaieuewouawygku.xyz

cmiascusccywowcs.xyz

uiqkkomkaceqacec.xyz

quqeciymqmkqccqw.xyz

ssqsauuuyyigouou.xyz

aogaakukuugqswcy.xyz

ucgwcwsuqsuwewgc.xyz

Attributes

dga_seed
21845
domain_length
16
num_dga_domains
10000
port
443

Signatures

Meta Stealer
Meta Stealer steals passwords stored in browsers, written in C++.
stealer metastealer

MetaStealer payload 1 IoCs

resource	yara_rule
behavioral2/memory/1136-173-0x0000000010000000-0x0000000010731000-memory.dmp	family_metastealer

Metastealer family
metastealer

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1052	powershell.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3416	ICACLS.EXE

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	cmd.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAB72.tmp	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	EXPAND.EXE
File created	C:\Windows\Installer\e57aa78.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{BAB34B4B-2906-4079-A176-CFE81AC61423}	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	EXPAND.EXE
File opened for modification	C:\Windows\Installer\e57aa78.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Executes dropped EXE 1 IoCs

pid	Process
1136	installs2.exe

Loads dropped DLL 1 IoCs

pid	Process
4776	MsiExec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4480	msiexec.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installs2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ICACLS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXPAND.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e6cf55ff94a5976e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e6cf55ff0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900e6cf55ff000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de6cf55ff000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000e6cf55ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
5752	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
412	msiexec.exe
412	msiexec.exe
2908	msedge.exe
2908	msedge.exe
4988	msedge.exe
4988	msedge.exe
5196	identity_helper.exe
5196	identity_helper.exe
1052	powershell.exe
1052	powershell.exe
1052	powershell.exe
1136	installs2.exe
1136	installs2.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4480	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4480	msiexec.exe
Token: SeSecurityPrivilege	412	msiexec.exe
Token: SeCreateTokenPrivilege	4480	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4480	msiexec.exe
Token: SeLockMemoryPrivilege	4480	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4480	msiexec.exe
Token: SeMachineAccountPrivilege	4480	msiexec.exe
Token: SeTcbPrivilege	4480	msiexec.exe
Token: SeSecurityPrivilege	4480	msiexec.exe
Token: SeTakeOwnershipPrivilege	4480	msiexec.exe
Token: SeLoadDriverPrivilege	4480	msiexec.exe
Token: SeSystemProfilePrivilege	4480	msiexec.exe
Token: SeSystemtimePrivilege	4480	msiexec.exe
Token: SeProfSingleProcessPrivilege	4480	msiexec.exe
Token: SeIncBasePriorityPrivilege	4480	msiexec.exe
Token: SeCreatePagefilePrivilege	4480	msiexec.exe
Token: SeCreatePermanentPrivilege	4480	msiexec.exe
Token: SeBackupPrivilege	4480	msiexec.exe
Token: SeRestorePrivilege	4480	msiexec.exe
Token: SeShutdownPrivilege	4480	msiexec.exe
Token: SeDebugPrivilege	4480	msiexec.exe
Token: SeAuditPrivilege	4480	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4480	msiexec.exe
Token: SeChangeNotifyPrivilege	4480	msiexec.exe
Token: SeRemoteShutdownPrivilege	4480	msiexec.exe
Token: SeUndockPrivilege	4480	msiexec.exe
Token: SeSyncAgentPrivilege	4480	msiexec.exe
Token: SeEnableDelegationPrivilege	4480	msiexec.exe
Token: SeManageVolumePrivilege	4480	msiexec.exe
Token: SeImpersonatePrivilege	4480	msiexec.exe
Token: SeCreateGlobalPrivilege	4480	msiexec.exe
Token: SeBackupPrivilege	2228	vssvc.exe
Token: SeRestorePrivilege	2228	vssvc.exe
Token: SeAuditPrivilege	2228	vssvc.exe
Token: SeBackupPrivilege	412	msiexec.exe
Token: SeRestorePrivilege	412	msiexec.exe
Token: SeRestorePrivilege	412	msiexec.exe
Token: SeTakeOwnershipPrivilege	412	msiexec.exe
Token: SeRestorePrivilege	412	msiexec.exe
Token: SeTakeOwnershipPrivilege	412	msiexec.exe
Token: SeBackupPrivilege	2544	srtasks.exe
Token: SeRestorePrivilege	2544	srtasks.exe
Token: SeSecurityPrivilege	2544	srtasks.exe
Token: SeTakeOwnershipPrivilege	2544	srtasks.exe
Token: SeBackupPrivilege	2544	srtasks.exe
Token: SeRestorePrivilege	2544	srtasks.exe
Token: SeSecurityPrivilege	2544	srtasks.exe
Token: SeTakeOwnershipPrivilege	2544	srtasks.exe
Token: SeDebugPrivilege	1052	powershell.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4480	msiexec.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 412 wrote to memory of 2544	412	msiexec.exe	97
PID 412 wrote to memory of 2544	412	msiexec.exe	97
PID 412 wrote to memory of 4776	412	msiexec.exe	99
PID 412 wrote to memory of 4776	412	msiexec.exe	99
PID 412 wrote to memory of 4776	412	msiexec.exe	99
PID 4776 wrote to memory of 3416	4776	MsiExec.exe	100
PID 4776 wrote to memory of 3416	4776	MsiExec.exe	100
PID 4776 wrote to memory of 3416	4776	MsiExec.exe	100
PID 4776 wrote to memory of 2072	4776	MsiExec.exe	102
PID 4776 wrote to memory of 2072	4776	MsiExec.exe	102
PID 4776 wrote to memory of 2072	4776	MsiExec.exe	102
PID 4776 wrote to memory of 4584	4776	MsiExec.exe	108
PID 4776 wrote to memory of 4584	4776	MsiExec.exe	108
PID 4776 wrote to memory of 4584	4776	MsiExec.exe	108
PID 4584 wrote to memory of 4988	4584	cmd.exe	110
PID 4584 wrote to memory of 4988	4584	cmd.exe	110
PID 4988 wrote to memory of 5012	4988	msedge.exe	111
PID 4988 wrote to memory of 5012	4988	msedge.exe	111
PID 4988 wrote to memory of 1560	4988	msedge.exe	113
PID 4988 wrote to memory of 1560	4988	msedge.exe	113
PID 4988 wrote to memory of 1560	4988	msedge.exe	113
PID 4988 wrote to memory of 1560	4988	msedge.exe	113
PID 4988 wrote to memory of 1560	4988	msedge.exe	113
PID 4988 wrote to memory of 1560	4988	msedge.exe	113
PID 4988 wrote to memory of 1560	4988	msedge.exe	113
PID 4988 wrote to memory of 1560	4988	msedge.exe	113
PID 4988 wrote to memory of 1560	4988	msedge.exe	113
PID 4988 wrote to memory of 1560	4988	msedge.exe	113
PID 4988 wrote to memory of 1560	4988	msedge.exe	113
PID 4988 wrote to memory of 1560	4988	msedge.exe	113
PID 4988 wrote to memory of 1560	4988	msedge.exe	113
PID 4988 wrote to memory of 1560	4988	msedge.exe	113
PID 4988 wrote to memory of 1560	4988	msedge.exe	113
PID 4988 wrote to memory of 1560	4988	msedge.exe	113
PID 4988 wrote to memory of 1560	4988	msedge.exe	113
PID 4988 wrote to memory of 1560	4988	msedge.exe	113
PID 4988 wrote to memory of 1560	4988	msedge.exe	113
PID 4988 wrote to memory of 1560	4988	msedge.exe	113
PID 4988 wrote to memory of 1560	4988	msedge.exe	113
PID 4988 wrote to memory of 1560	4988	msedge.exe	113
PID 4988 wrote to memory of 1560	4988	msedge.exe	113
PID 4988 wrote to memory of 1560	4988	msedge.exe	113
PID 4988 wrote to memory of 1560	4988	msedge.exe	113
PID 4988 wrote to memory of 1560	4988	msedge.exe	113
PID 4988 wrote to memory of 1560	4988	msedge.exe	113
PID 4988 wrote to memory of 1560	4988	msedge.exe	113
PID 4988 wrote to memory of 1560	4988	msedge.exe	113
PID 4988 wrote to memory of 1560	4988	msedge.exe	113
PID 4988 wrote to memory of 1560	4988	msedge.exe	113
PID 4988 wrote to memory of 1560	4988	msedge.exe	113
PID 4988 wrote to memory of 1560	4988	msedge.exe	113
PID 4988 wrote to memory of 1560	4988	msedge.exe	113
PID 4988 wrote to memory of 1560	4988	msedge.exe	113
PID 4988 wrote to memory of 1560	4988	msedge.exe	113
PID 4988 wrote to memory of 1560	4988	msedge.exe	113
PID 4988 wrote to memory of 1560	4988	msedge.exe	113
PID 4988 wrote to memory of 1560	4988	msedge.exe	113
PID 4988 wrote to memory of 1560	4988	msedge.exe	113
PID 4988 wrote to memory of 2908	4988	msedge.exe	114
PID 4988 wrote to memory of 2908	4988	msedge.exe	114
PID 4988 wrote to memory of 4752	4988	msedge.exe	115
PID 4988 wrote to memory of 4752	4988	msedge.exe	115
PID 4988 wrote to memory of 4752	4988	msedge.exe	115
PID 4988 wrote to memory of 4752	4988	msedge.exe	115

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\441e504c70e28d1d46194ce389141db7.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4480

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:412
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2544
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 87DC00115382457575E5B8B0D7FCCF4B
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4776
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-8ac5f131-6e3d-4984-a630-0cac9672102a\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:3416
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2072
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start msedge https://s28.q4cdn.com/392171258/files/doc_downloads/test.pdf
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://s28.q4cdn.com/392171258/files/doc_downloads/test.pdf
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4988
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffef9a746f8,0x7ffef9a74708,0x7ffef9a74718
        5⤵
        
        PID:5012
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,15860040927332498580,11143746833695401399,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
        5⤵
        
        PID:1560
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,15860040927332498580,11143746833695401399,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2908
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,15860040927332498580,11143746833695401399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
        5⤵
        
        PID:4752
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,15860040927332498580,11143746833695401399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
        5⤵
        
        PID:3828
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,15860040927332498580,11143746833695401399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
        5⤵
        
        PID:4524
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,15860040927332498580,11143746833695401399,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
        5⤵
        
        PID:3272
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --field-trial-handle=2208,15860040927332498580,11143746833695401399,131072 --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=4868 /prefetch:6
        5⤵
        
        PID:2072
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,15860040927332498580,11143746833695401399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
        5⤵
        
        PID:1140
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,15860040927332498580,11143746833695401399,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
        5⤵
        
        PID:812
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,15860040927332498580,11143746833695401399,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3364 /prefetch:8
        5⤵
        
        PID:1888
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,15860040927332498580,11143746833695401399,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3364 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5196
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,15860040927332498580,11143746833695401399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
        5⤵
        
        PID:5328
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,15860040927332498580,11143746833695401399,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
        5⤵
        
        PID:5336
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,15860040927332498580,11143746833695401399,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3552 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1248
- - C:\Users\Admin\AppData\Local\Temp\MW-8ac5f131-6e3d-4984-a630-0cac9672102a\files\installs2.exe
    "C:\Users\Admin\AppData\Local\Temp\MW-8ac5f131-6e3d-4984-a630-0cac9672102a\files\installs2.exe" /VERYSILENT /VERYSILENT
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1136
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Microsoft\Windows\systemtask.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1052
  - - C:\Windows\SysWOW64\systeminfo.exe
      systeminfo
      4⤵
      System Location Discovery: System Language Discovery
      Gathers system information
      PID:5752

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2256

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

File and Directory Permissions Modification

T1222

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
181B

MD5
1cd1076ea49dca53e30d29edcb76ca12

SHA1
62e13a81796399aeb854bf13bfbc1d3284ec74b4

SHA256
cd7b129236a194ac9c78db5fa3afd8804d8a0eff7e2908854dc921e27ed8eedf

SHA512
e14a785692afdab6703dd4df35060d69ab5aa1fc513070c75087572884cd80eaf2456bb9234492bc9e6a505f6681fd7985d76625765f02a04381413105f7822a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e9207447acab08341ed3ba5575a2d793

SHA1
ecb5f188d83f6522a5289aaf4b7d75cba071baba

SHA256
2b2ec50e7c7979813607916ba6128d9536fd150ecd4ee65f51345e05aa603311

SHA512
d9fffe47e3c8e6c74633b16cdc72b902ccd58cc3650ddb067bafb58a9139c19b7eb42fad96b4720a6d75744852dbb0f4dcf53814d418eefda0489d0b0a2a3a18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
472d8c33e6cd5e536c0e18c63d4cdbe0

SHA1
82dd369a06374c8ff28beb650e11f40d0e212a50

SHA256
6a735c894b9d57526e528f341d73d02684f8b360db14c207251a9d2abb465e39

SHA512
4e7c4a8d556098e55ad1c6ce927e5882929dc016f4bc6a6617ab3459b47d9e22136d8a92d43f7591aab7d25152e2e643e6114f9572de0b0eee9498d29daed4c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2e67dfcde80aabb2eb3b372c65620c43

SHA1
c8fdc8454461344ee065f057301e3560f6bdeaba

SHA256
51a902b9a008c13ed6c3b542bca64a2693f6bd4c214f72ea00458e1e2a93735c

SHA512
2c26eb5c128fd0651caee5f482590a3fed9cacd42bd1875469848fe171f813adc28d392fdbc4a014968de2687a5136b5f675752be1a1de2f5d5f3c7253265fe3

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-8ac5f131-6e3d-4984-a630-0cac9672102a\files.cab

Filesize
1.7MB

MD5
e3146abb462f5c2fa3d129a36501db63

SHA1
d059b5dd83852cba19ceb0fee1bfda56fc574c94

SHA256
996a889903d82c2e219425a1b8a73fce9642637a3876ab9a4e24102d4ba801bc

SHA512
ec7130c017b808cad4ceed16e887af4f67a581ecc73074e0193fbd30e20d5332f2325ee4fdcbd53f8232c0f045f7e0a95c79c97c88fda19536229b040bf5c226

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-8ac5f131-6e3d-4984-a630-0cac9672102a\msiwrapper.ini

Filesize
1KB

MD5
b1c5e466668593a99df8fdb143125004

SHA1
e707af04ff49900828590beca3cfc4438ea40d6d

SHA256
d9e580d6904f5a83647ed335f5ffe79a42ca16d6707af98d7ee6b755df9f8169

SHA512
5467f37f3517109e4cc2f916b9a284bd2b6879431b19188f1d69c39486f9a3f0dd4b39a21053504d46e89e8959a588fba16f3ff4aa9af013d503bcd2bdc8a7b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vrnybnne.ita.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\Installer\MSIAB72.tmp

Filesize
208KB

MD5
0c8921bbcc37c6efd34faf44cf3b0cb5

SHA1
dcfa71246157edcd09eecaf9d4c5e360b24b3e49

SHA256
fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1

SHA512
ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.1MB

MD5
311afdab205bcfb05203774c4b7ee0b9

SHA1
393925576c3a3acd56e046574fb3677fa862e0d4

SHA256
676652c6fe22d2e42c5ccf5710a39fa94e47a2e5814ecef5a9a06377bb591d0b

SHA512
ba11fca167c52a5c46760b8eaf11422b2faaa4e9ad44f50b2547eedc65391c2786b1d8df92b1ce1d71b9f06e38016648adb86f64c25200357a9f9f257586eaa9

Download Submit
\??\Volume{ff55cfe6-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{c7fd0434-f8c1-424d-ab36-38fae70c7336}_OnDiskSnapshotProp

Filesize
6KB

MD5
13089b423b6c74759ac6bda5e7e0a7bd

SHA1
81d5d71cf3f45851a7dcececf0ee3352cb846abf

SHA256
a3276fed41a05401f04b51d15cdf233d74a331047048e1e0efdbcc0c085fe97a

SHA512
410d4e62ac3f7a82d8378e77a8d2d34f6fcd9d583c78ba0d5ef8d4f108f6031d7e76732df95e3e7b53a04ec1f188860f90974931a02e12a49841060f05663cb1

Download Submit
memory/1052-182-0x0000000005AE0000-0x0000000005B46000-memory.dmp

Filesize
408KB

Download
memory/1052-207-0x0000000007330000-0x000000000734E000-memory.dmp

Filesize
120KB

Download
memory/1052-180-0x00000000052C0000-0x00000000052E2000-memory.dmp

Filesize
136KB

Download
memory/1052-181-0x0000000005A70000-0x0000000005AD6000-memory.dmp

Filesize
408KB

Download
memory/1052-178-0x0000000002830000-0x0000000002866000-memory.dmp

Filesize
216KB

Download
memory/1052-217-0x0000000007700000-0x0000000007708000-memory.dmp

Filesize
32KB

Download
memory/1052-193-0x0000000005C50000-0x0000000005FA4000-memory.dmp

Filesize
3.3MB

Download
memory/1052-194-0x0000000006150000-0x000000000616E000-memory.dmp

Filesize
120KB

Download
memory/1052-195-0x0000000006190000-0x00000000061DC000-memory.dmp

Filesize
304KB

Download
memory/1052-197-0x000000006F130000-0x000000006F17C000-memory.dmp

Filesize
304KB

Download
memory/1052-196-0x0000000006720000-0x0000000006752000-memory.dmp

Filesize
200KB

Download
memory/1052-179-0x0000000005390000-0x00000000059B8000-memory.dmp

Filesize
6.2MB

Download
memory/1052-208-0x0000000007350000-0x00000000073F3000-memory.dmp

Filesize
652KB

Download
memory/1052-209-0x0000000007AC0000-0x000000000813A000-memory.dmp

Filesize
6.5MB

Download
memory/1052-210-0x0000000007480000-0x000000000749A000-memory.dmp

Filesize
104KB

Download
memory/1052-211-0x00000000074E0000-0x00000000074EA000-memory.dmp

Filesize
40KB

Download
memory/1052-212-0x0000000007710000-0x00000000077A6000-memory.dmp

Filesize
600KB

Download
memory/1052-213-0x0000000007680000-0x0000000007691000-memory.dmp

Filesize
68KB

Download
memory/1052-214-0x00000000076B0000-0x00000000076BE000-memory.dmp

Filesize
56KB

Download
memory/1052-215-0x00000000076C0000-0x00000000076D4000-memory.dmp

Filesize
80KB

Download
memory/1052-216-0x00000000077D0000-0x00000000077EA000-memory.dmp

Filesize
104KB

Download
memory/1136-173-0x0000000010000000-0x0000000010731000-memory.dmp

Filesize
7.2MB

Download