metastealer | hxxp://35[.]188[.]13[.]52[:]8080/gift/setup4391[.]msi

Analysis

max time kernel
873s
max time network
884s
platform
windows11-21h2_x64
resource
win11-20250217-en
resource tags

arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system
submitted
06/03/2025, 19:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://35.188.13.52:8080/gift/setup4391.msi

Score

10^/10

metastealer discovery execution spyware stealer

Malware Config

Extracted

Family

metastealer

kagkimuoakomksww.xyz

cwikwiiisuyqymso.xyz

qgimwqowkmuicoos.xyz

kuueskmwqmwoocuq.xyz

eaeueussigokssqg.xyz

eoyqkgcyoesysssk.xyz

ocmmqamiyucswwik.xyz

eimemucysaammomg.xyz

iwomsoekyisuymws.xyz

mqykiccmwokeumes.xyz

iqqcgqqseysecuum.xyz

iqmoyikmqymsmcwm.xyz

aseuqoqgaueaymyo.xyz

wycuamkomemmigmy.xyz

ceiyeqaoscmsamim.xyz

skcqkaykccckqyam.xyz

kaycmqwocuyyuqyg.xyz

mqssyaeoeeucegqy.xyz

ywqamawcqumaqiyq.xyz

skscsegicyqikqww.xyz

Attributes

dga_seed
12914
domain_length
16
num_dga_domains
10000
port
443

Signatures

Meta Stealer
Meta Stealer steals passwords stored in browsers, written in C++.
stealer metastealer

MetaStealer payload 1 IoCs

resource	yara_rule
behavioral1/memory/1820-437-0x0000000010000000-0x0000000010738000-memory.dmp	family_metastealer

Metastealer family
metastealer

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3884	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
1820	setup4927.exe

Loads dropped DLL 1 IoCs

pid	Process
3468	MsiExec.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4088	ICACLS.EXE

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{1F512436-83C6-45F0-98EC-7149844A7B98}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF46CCD355FEA70E65.TMP	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB3545C239AEB8CBA.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIED3E.tmp	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	EXPAND.EXE
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	EXPAND.EXE
File created	C:\Windows\Installer\e57ec83.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57ec83.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXPAND.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup4927.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ICACLS.EXE

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000008628da5cf44c13110000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800008628da5c0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809008628da5c000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d8628da5c000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000008628da5c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
4284	systeminfo.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\setup4391.msi:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2828	msiexec.exe
2828	msiexec.exe
3884	powershell.exe
3884	powershell.exe
1820	setup4927.exe
1820	setup4927.exe

Suspicious use of AdjustPrivilegeToken 53 IoCs

description	pid	Process
Token: SeDebugPrivilege	1480	firefox.exe
Token: SeDebugPrivilege	1480	firefox.exe
Token: SeDebugPrivilege	1480	firefox.exe
Token: SeShutdownPrivilege	3160	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3160	msiexec.exe
Token: SeSecurityPrivilege	2828	msiexec.exe
Token: SeCreateTokenPrivilege	3160	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3160	msiexec.exe
Token: SeLockMemoryPrivilege	3160	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3160	msiexec.exe
Token: SeMachineAccountPrivilege	3160	msiexec.exe
Token: SeTcbPrivilege	3160	msiexec.exe
Token: SeSecurityPrivilege	3160	msiexec.exe
Token: SeTakeOwnershipPrivilege	3160	msiexec.exe
Token: SeLoadDriverPrivilege	3160	msiexec.exe
Token: SeSystemProfilePrivilege	3160	msiexec.exe
Token: SeSystemtimePrivilege	3160	msiexec.exe
Token: SeProfSingleProcessPrivilege	3160	msiexec.exe
Token: SeIncBasePriorityPrivilege	3160	msiexec.exe
Token: SeCreatePagefilePrivilege	3160	msiexec.exe
Token: SeCreatePermanentPrivilege	3160	msiexec.exe
Token: SeBackupPrivilege	3160	msiexec.exe
Token: SeRestorePrivilege	3160	msiexec.exe
Token: SeShutdownPrivilege	3160	msiexec.exe
Token: SeDebugPrivilege	3160	msiexec.exe
Token: SeAuditPrivilege	3160	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3160	msiexec.exe
Token: SeChangeNotifyPrivilege	3160	msiexec.exe
Token: SeRemoteShutdownPrivilege	3160	msiexec.exe
Token: SeUndockPrivilege	3160	msiexec.exe
Token: SeSyncAgentPrivilege	3160	msiexec.exe
Token: SeEnableDelegationPrivilege	3160	msiexec.exe
Token: SeManageVolumePrivilege	3160	msiexec.exe
Token: SeImpersonatePrivilege	3160	msiexec.exe
Token: SeCreateGlobalPrivilege	3160	msiexec.exe
Token: SeBackupPrivilege	3092	vssvc.exe
Token: SeRestorePrivilege	3092	vssvc.exe
Token: SeAuditPrivilege	3092	vssvc.exe
Token: SeBackupPrivilege	2828	msiexec.exe
Token: SeRestorePrivilege	2828	msiexec.exe
Token: SeRestorePrivilege	2828	msiexec.exe
Token: SeTakeOwnershipPrivilege	2828	msiexec.exe
Token: SeRestorePrivilege	2828	msiexec.exe
Token: SeTakeOwnershipPrivilege	2828	msiexec.exe
Token: SeBackupPrivilege	5064	srtasks.exe
Token: SeRestorePrivilege	5064	srtasks.exe
Token: SeSecurityPrivilege	5064	srtasks.exe
Token: SeTakeOwnershipPrivilege	5064	srtasks.exe
Token: SeBackupPrivilege	5064	srtasks.exe
Token: SeRestorePrivilege	5064	srtasks.exe
Token: SeSecurityPrivilege	5064	srtasks.exe
Token: SeTakeOwnershipPrivilege	5064	srtasks.exe
Token: SeDebugPrivilege	3884	powershell.exe

Suspicious use of FindShellTrayWindow 22 IoCs

pid	Process
1480	firefox.exe
1480	firefox.exe
1480	firefox.exe
1480	firefox.exe
1480	firefox.exe
1480	firefox.exe
1480	firefox.exe
1480	firefox.exe
1480	firefox.exe
1480	firefox.exe
1480	firefox.exe
1480	firefox.exe
1480	firefox.exe
1480	firefox.exe
1480	firefox.exe
1480	firefox.exe
1480	firefox.exe
1480	firefox.exe
1480	firefox.exe
1480	firefox.exe
1480	firefox.exe
3160	msiexec.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1480	firefox.exe
1480	firefox.exe
1480	firefox.exe
1480	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 1480	1176	firefox.exe	81
PID 1176 wrote to memory of 1480	1176	firefox.exe	81
PID 1176 wrote to memory of 1480	1176	firefox.exe	81
PID 1176 wrote to memory of 1480	1176	firefox.exe	81
PID 1176 wrote to memory of 1480	1176	firefox.exe	81
PID 1176 wrote to memory of 1480	1176	firefox.exe	81
PID 1176 wrote to memory of 1480	1176	firefox.exe	81
PID 1176 wrote to memory of 1480	1176	firefox.exe	81
PID 1176 wrote to memory of 1480	1176	firefox.exe	81
PID 1176 wrote to memory of 1480	1176	firefox.exe	81
PID 1176 wrote to memory of 1480	1176	firefox.exe	81
PID 1480 wrote to memory of 4240	1480	firefox.exe	82
PID 1480 wrote to memory of 4240	1480	firefox.exe	82
PID 1480 wrote to memory of 4240	1480	firefox.exe	82
PID 1480 wrote to memory of 4240	1480	firefox.exe	82
PID 1480 wrote to memory of 4240	1480	firefox.exe	82
PID 1480 wrote to memory of 4240	1480	firefox.exe	82
PID 1480 wrote to memory of 4240	1480	firefox.exe	82
PID 1480 wrote to memory of 4240	1480	firefox.exe	82
PID 1480 wrote to memory of 4240	1480	firefox.exe	82
PID 1480 wrote to memory of 4240	1480	firefox.exe	82
PID 1480 wrote to memory of 4240	1480	firefox.exe	82
PID 1480 wrote to memory of 4240	1480	firefox.exe	82
PID 1480 wrote to memory of 4240	1480	firefox.exe	82
PID 1480 wrote to memory of 4240	1480	firefox.exe	82
PID 1480 wrote to memory of 4240	1480	firefox.exe	82
PID 1480 wrote to memory of 4240	1480	firefox.exe	82
PID 1480 wrote to memory of 4240	1480	firefox.exe	82
PID 1480 wrote to memory of 4240	1480	firefox.exe	82
PID 1480 wrote to memory of 4240	1480	firefox.exe	82
PID 1480 wrote to memory of 4240	1480	firefox.exe	82
PID 1480 wrote to memory of 4240	1480	firefox.exe	82
PID 1480 wrote to memory of 4240	1480	firefox.exe	82
PID 1480 wrote to memory of 4240	1480	firefox.exe	82
PID 1480 wrote to memory of 4240	1480	firefox.exe	82
PID 1480 wrote to memory of 4240	1480	firefox.exe	82
PID 1480 wrote to memory of 4240	1480	firefox.exe	82
PID 1480 wrote to memory of 4240	1480	firefox.exe	82
PID 1480 wrote to memory of 4240	1480	firefox.exe	82
PID 1480 wrote to memory of 4240	1480	firefox.exe	82
PID 1480 wrote to memory of 4240	1480	firefox.exe	82
PID 1480 wrote to memory of 4240	1480	firefox.exe	82
PID 1480 wrote to memory of 4240	1480	firefox.exe	82
PID 1480 wrote to memory of 4240	1480	firefox.exe	82
PID 1480 wrote to memory of 4240	1480	firefox.exe	82
PID 1480 wrote to memory of 4240	1480	firefox.exe	82
PID 1480 wrote to memory of 4240	1480	firefox.exe	82
PID 1480 wrote to memory of 4240	1480	firefox.exe	82
PID 1480 wrote to memory of 4240	1480	firefox.exe	82
PID 1480 wrote to memory of 4240	1480	firefox.exe	82
PID 1480 wrote to memory of 4240	1480	firefox.exe	82
PID 1480 wrote to memory of 4240	1480	firefox.exe	82
PID 1480 wrote to memory of 4240	1480	firefox.exe	82
PID 1480 wrote to memory of 4240	1480	firefox.exe	82
PID 1480 wrote to memory of 4240	1480	firefox.exe	82
PID 1480 wrote to memory of 4240	1480	firefox.exe	82
PID 1480 wrote to memory of 648	1480	firefox.exe	83
PID 1480 wrote to memory of 648	1480	firefox.exe	83
PID 1480 wrote to memory of 648	1480	firefox.exe	83
PID 1480 wrote to memory of 648	1480	firefox.exe	83
PID 1480 wrote to memory of 648	1480	firefox.exe	83
PID 1480 wrote to memory of 648	1480	firefox.exe	83
PID 1480 wrote to memory of 648	1480	firefox.exe	83
PID 1480 wrote to memory of 648	1480	firefox.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://35.188.13.52:8080/gift/setup4391.msi"
1⤵
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://35.188.13.52:8080/gift/setup4391.msi
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1944 -parentBuildID 20240401114208 -prefsHandle 1860 -prefMapHandle 1836 -prefsLen 27661 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4f06af47-1a01-4a76-ad76-9dd10a493ff9} 1480 "\\.\pipe\gecko-crash-server-pipe.1480" gpu
    3⤵
    PID:4240
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2360 -parentBuildID 20240401114208 -prefsHandle 2352 -prefMapHandle 2348 -prefsLen 28581 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bd06c481-9e31-42fa-8ea9-c5214dd5e574} 1480 "\\.\pipe\gecko-crash-server-pipe.1480" socket
    3⤵
    - Checks processor information in registry
    PID:648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3040 -childID 1 -isForBrowser -prefsHandle 2992 -prefMapHandle 2840 -prefsLen 22746 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c42240f4-b2c1-4ce2-bf41-f04e630fd885} 1480 "\\.\pipe\gecko-crash-server-pipe.1480" tab
    3⤵
    PID:1676
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3680 -childID 2 -isForBrowser -prefsHandle 3676 -prefMapHandle 3672 -prefsLen 33071 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fc132303-6d45-4966-8ede-62c17d7bf0c0} 1480 "\\.\pipe\gecko-crash-server-pipe.1480" tab
    3⤵
    PID:2232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4740 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4656 -prefMapHandle 4688 -prefsLen 33071 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c782b099-0c3f-4a12-8fdc-94388405a0c7} 1480 "\\.\pipe\gecko-crash-server-pipe.1480" utility
    3⤵
    - Checks processor information in registry
    PID:692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5236 -childID 3 -isForBrowser -prefsHandle 5780 -prefMapHandle 5760 -prefsLen 27266 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1af37e36-e64b-4c0b-8d2a-c95e692eec42} 1480 "\\.\pipe\gecko-crash-server-pipe.1480" tab
    3⤵
    PID:4816
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6016 -childID 4 -isForBrowser -prefsHandle 6008 -prefMapHandle 5940 -prefsLen 27266 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {44ef71d6-bc59-4f16-8b78-96e9c3a7f25e} 1480 "\\.\pipe\gecko-crash-server-pipe.1480" tab
    3⤵
    PID:3952
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6140 -childID 5 -isForBrowser -prefsHandle 5920 -prefMapHandle 5916 -prefsLen 27266 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d9bf8f8-f100-46a9-b7d8-11439d625193} 1480 "\\.\pipe\gecko-crash-server-pipe.1480" tab
    3⤵
    PID:1548

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\setup4391.msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3160

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2828
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5064
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 4126B0F01B39F16AFEEFA2B336CD84AB
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3468
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-a5ee6aee-0b15-4e04-945b-20df96c287a4\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:4088
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2596
- - C:\Users\Admin\AppData\Local\Temp\MW-a5ee6aee-0b15-4e04-945b-20df96c287a4\files\setup4927.exe
    "C:\Users\Admin\AppData\Local\Temp\MW-a5ee6aee-0b15-4e04-945b-20df96c287a4\files\setup4927.exe" /VERYSILENT /VERYSILENT
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1820
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Microsoft\Windows\search.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3884
  - - C:\Windows\SysWOW64\systeminfo.exe
      systeminfo
      4⤵
      System Location Discovery: System Language Discovery
      Gathers system information
      PID:4284

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\t35pww33.default-release\activity-stream.discovery_stream.json

Filesize
21KB

MD5
dbdf305c9fb8660272e6190fcfeab019

SHA1
cd82248c386523db5912f9f86a00999165dd78d5

SHA256
3a435fdecad5fee1d7d1dc193d66a6040e5fa737c2263874bd3bf008421b525d

SHA512
adf6458065276b0ba6cf3179b6e7868ca9e547988ddd01cf02547e3f1e6e94cabaf69aa0a3a6af9e5c299de91b58bc40f85b5b9501feee311372ca4791d88a5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-a5ee6aee-0b15-4e04-945b-20df96c287a4\files.cab

Filesize
1.6MB

MD5
3b871741602b195c754d0b3b6a22abc2

SHA1
fa6b6ea31fa798ce6333bc6d2c371b096d4d4edb

SHA256
454fb1907187784f0551da5102af6d4d95230dd93e23692d6dae2247631b9226

SHA512
d063027267e72962123dfe7c173914a13a72e34bc66e6d0d3dec8bb9771999caed307ea4b21f2e9fbe006536fe9d0e596bcfa8745c41b7921cf18d37415ec71d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-a5ee6aee-0b15-4e04-945b-20df96c287a4\msiwrapper.ini

Filesize
390B

MD5
95ead6c84e2d3c77e8697607138f7504

SHA1
3687c3efc2851327c33d044e9003b79ce24f4d2c

SHA256
a333694db28b534af300caa8b6f6ba75ccc1ef778ce841bf85a6a59070bf06f5

SHA512
485d88ac5c8fa8962784d369a2465a572ecd9d5b8165f4b7fa68d735150a540a3f1bf2205d8c9f1a94ec3b011ae4f636b76ca3d036c1374789111e176f5864be

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-a5ee6aee-0b15-4e04-945b-20df96c287a4\msiwrapper.ini

Filesize
1KB

MD5
e8776db39ad1299d551f19bb3d8a20e9

SHA1
46bafadac1ea680097e374a717be03d8dfc9c9bd

SHA256
86bae4af7a9fa52e3147e7be24d0c6c53d8cbe174fe875fd77adefa5dd283d62

SHA512
0f61b7a0f8368333f1f3ebc4bc34b5eadf1d7025d215d2ec351ed8b85daaffb9812d7068ce174bfeaf054ca1fe10ee51898835454ffe4ca0e0614d7d0ed9c850

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xqbuk0ki.5uw.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t35pww33.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
5dcea15bf8787931e0bb40f1807fa73e

SHA1
d475b833c234749b67fdcf36f1d60e5f96fe0a3b

SHA256
541883da6bfd0062d6b329c52f3fc02051171e28493f443ba9f29c5e2f5e3a49

SHA512
09076a36c7fde2aa4fb62264e51e7e9fbeed7798a01a38b5ec1376276fc4ee979901ef9cc3b8f74a8cb4e1d16b022d71eaa0d414be34f8e8b438afe6a8a6044a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t35pww33.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
280aa4707b250565e18484aec84e67c5

SHA1
afa60d59c0c9b9ab198be6f578f8653bcf3dacb8

SHA256
ff55308187dde8bce34db4f2827ff6e864816835fd024da745277e9bfec99d4e

SHA512
24895723f76679d8088f5837c1aee042e7d353ab5bfed550b6cc062a48f0f87211e5d09dda093557b23b58372851985d23671f8951d8ac0603af29bd65b51c47

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t35pww33.default-release\datareporting\glean\db\data.safe.tmp

Filesize
17KB

MD5
d3ced77fc8c7ae6cfe31e8260f37bed0

SHA1
d1be64ae2d847e5c429626c3c50a1c85dede7c25

SHA256
83cbe3a2ac6f686623bb0050b24f431ea46d47633f53c39576303c017a035f70

SHA512
3b478fef461b2f6144fb9d2203e47489890e3af82248b3a4674c3be5aeac2d2a1e3f3ac611c5fb5ad9fff30ff592d3be41d3d5ca7203f2492d0b9f45e1a1386e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t35pww33.default-release\datareporting\glean\pending_pings\94d29be0-ef2a-44ff-9536-18aa0083bdc7

Filesize
25KB

MD5
baf61d259588aec822af8761a2c8badf

SHA1
33054b50346351aa62ff77f331e27b67fd272efa

SHA256
d739803f223ec661eef410baf4d4f758dfdd69de4891d4ee39c309a6fe2d9bd8

SHA512
9d53b7ba2e39354906db18a53a55703d7813354f29100891b1a00719c4a30f82482fa2fba52a132b5de0f2ba5801baea0a809bb75714e50010b38f0e8961a48b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t35pww33.default-release\datareporting\glean\pending_pings\a2b86f20-f509-44e7-9a61-63c69ef9cd75

Filesize
982B

MD5
72937df1d40d596d31d6885ead35ef9a

SHA1
f23517d8b39675e3ea9df722c34cb6b3efb3cfc8

SHA256
f2f6795f65c13e18539506d7ac7b978f5a9b96287e7db5df6df39b6f35afd60e

SHA512
3b9e04fe7fec96f19e499385c21a2998166b50d36bf0ca28c7e93c8b213977d0e0745d642119dce3c55d0759bff28b744c132ded0217e7f7da8a8d361717a488

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t35pww33.default-release\datareporting\glean\pending_pings\b780d4c9-7e20-485e-a1cd-7553dbf4a9b1

Filesize
671B

MD5
3b6b084c73cd09706e6ded05fbc036b1

SHA1
8c01cb8270562a14f756c0ac7c7123437bcaf155

SHA256
c2e8f7aacd6863fb4658602befbdaae447fc7de214a51ffe5729877f5faf7571

SHA512
2835d8a30b9717f43aa137ff640107ebc8701c970f8ffd7bca0ef10bc521ef45bf4bc891bb47e80d94fc8a1f98c678aac1ec3cf870f40ac0feeb4cae9bfb98d8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t35pww33.default-release\prefs-1.js

Filesize
10KB

MD5
b29d2112ecc6826b3cf69af2c3c87618

SHA1
199845d0a4223eb273a91930e76d042c4137cd6a

SHA256
8c9ed61f215a90d854bf5c0871150a77ae5fc55c7a593e0b6dfbf3ca53b9d0a4

SHA512
f64bbd1a8c1dd09112a0d762fcbcd34ffe872d2ea938f5b4d21298433ad14492471aa961f309879da91cb58f16a2d12c9cf15e458f290601f3ad75acc4d96d9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t35pww33.default-release\sessionCheckpoints.json.tmp

Filesize
259B

MD5
700fe59d2eb10b8cd28525fcc46bc0cc

SHA1
339badf0e1eba5332bff317d7cf8a41d5860390d

SHA256
4f5d849bdf4a5eeeb5da8836589e064e31c8e94129d4e55b1c69a6f98fb9f9ea

SHA512
3fa1b3fd4277d5900140e013b1035cb4c72065afcc6b6a8595b43101cfe7d09e75554a877e4a01bb80b0d7a58cdcfe553c4a9ef308c5695c5e77cb0ea99bada4

Download Submit
C:\Users\Admin\Downloads\setup4391.okZcBZbf.msi.part

Filesize
1.9MB

MD5
cb07e30a581656a057cd4a4e2a0044b9

SHA1
3411cfa59efdadc2899d5d9b7512989cfb4b9f82

SHA256
8718d3bb23a8216bc4ac54ae8f9d348a0030025bfb4163812e73ec514db6de11

SHA512
aad3319a7abebd22b0a75368a2e1956d9cf072edbdcf93cc54147e92703fbedfae62d8d0c19187eb86928cb958689c2b75d38626e073567e98d450d6d3b06012

Download Submit
C:\Windows\Installer\MSIED3E.tmp

Filesize
208KB

MD5
0c8921bbcc37c6efd34faf44cf3b0cb5

SHA1
dcfa71246157edcd09eecaf9d4c5e360b24b3e49

SHA256
fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1

SHA512
ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.6MB

MD5
9fb1ce9ccf7a4a496a26a2177b3adfe2

SHA1
343718e6bd74a75334b0d5dafa94de242cf755f6

SHA256
be9bb70209beb3073ac8fea3fc332a9e81407f6b12a9ad0ec7f16e7b42832395

SHA512
605bd404a53fc1355740fc8dd9edf29056f1b09a623893b00289d7a33717ad8763698ba4519af3bf05fc3468ef9eecf705b69c2e8ba162e3e07392921c91b889

Download Submit
\??\Volume{5cda2886-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{048b7281-daae-4fa0-9db4-c574866a5cad}_OnDiskSnapshotProp

Filesize
6KB

MD5
b458f673136c64c407e8ac0c38817f42

SHA1
30098ede05dfff9a6e5d57a3842a1167244d49db

SHA256
0240840ba7e1a9851698994405b764a61b17ae9f4b5cf945e569810a8d87a240

SHA512
e388a1a619725f2a3ee9290251e2379b37d8ef02985a186f84157582f7c84d7be79449b13514bf0a059591e946b97b5bb73a5b86c7440d1fe002cc6c51b945e4

Download Submit
memory/1820-437-0x0000000010000000-0x0000000010738000-memory.dmp

Filesize
7.2MB

Download
memory/3884-443-0x0000000005B30000-0x000000000615A000-memory.dmp

Filesize
6.2MB

Download
memory/3884-469-0x0000000006BB0000-0x0000000006BCE000-memory.dmp

Filesize
120KB

Download
memory/3884-445-0x00000000058D0000-0x0000000005936000-memory.dmp

Filesize
408KB

Download
memory/3884-446-0x0000000005A40000-0x0000000005AA6000-memory.dmp

Filesize
408KB

Download
memory/3884-442-0x0000000002DC0000-0x0000000002DF6000-memory.dmp

Filesize
216KB

Download
memory/3884-455-0x0000000006160000-0x00000000064B7000-memory.dmp

Filesize
3.3MB

Download
memory/3884-457-0x00000000065D0000-0x00000000065EE000-memory.dmp

Filesize
120KB

Download
memory/3884-458-0x0000000006680000-0x00000000066CC000-memory.dmp

Filesize
304KB

Download
memory/3884-460-0x000000006E890000-0x000000006E8DC000-memory.dmp

Filesize
304KB

Download
memory/3884-459-0x0000000007580000-0x00000000075B4000-memory.dmp

Filesize
208KB

Download
memory/3884-470-0x00000000075D0000-0x0000000007674000-memory.dmp

Filesize
656KB

Download
memory/3884-444-0x0000000005730000-0x0000000005752000-memory.dmp

Filesize
136KB

Download
memory/3884-471-0x0000000007F70000-0x00000000085EA000-memory.dmp

Filesize
6.5MB

Download
memory/3884-472-0x0000000007930000-0x000000000794A000-memory.dmp

Filesize
104KB

Download
memory/3884-473-0x00000000079A0000-0x00000000079AA000-memory.dmp

Filesize
40KB

Download
memory/3884-474-0x0000000007BD0000-0x0000000007C66000-memory.dmp

Filesize
600KB

Download
memory/3884-475-0x0000000007B40000-0x0000000007B51000-memory.dmp

Filesize
68KB

Download
memory/3884-476-0x0000000007B80000-0x0000000007B8E000-memory.dmp

Filesize
56KB

Download
memory/3884-477-0x0000000007B90000-0x0000000007BA5000-memory.dmp

Filesize
84KB

Download
memory/3884-478-0x0000000007C90000-0x0000000007CAA000-memory.dmp

Filesize
104KB

Download
memory/3884-479-0x0000000007C70000-0x0000000007C78000-memory.dmp

Filesize
32KB

Download