| File name: | 5c322c.msi |
| Full analysis: | https://app.any.run/tasks/850cbf91-a4e8-4b8b-ae21-94a16281f65c |
| Verdict: | Malicious activity |
| Threats: | MetaStealer is an info-stealing malware primarily targeting sensitive data like login credentials, payment details, and browser history. It typically infects systems via phishing emails or malicious downloads and can exfiltrate data to a command and control (C2) server. MetaStealer is known for its stealthy techniques, including evasion and persistence mechanisms, which make it difficult to detect. This malware has been actively used in various cyberattacks, particularly for financial theft and credential harvesting from individuals and organizations. |
| Analysis date: | December 12, 2024, 11:19:48 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-msi |
| File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Google Chrome 125.0.6422.113, Subject: Google Chrome, Author: Google LLC, Keywords: Installer, Template: Intel;1033, Revision Number: {CC659C51-85CC-445F-B840-187BCCCBE876}, Create Time/Date: Thu Jan 11 14:59:44 2024, Last Saved Time/Date: Thu Jan 11 14:59:44 2024, Number of Pages: 200, Number of Words: 12, Name of Creating Application: MSI Wrapper (11.0.53.0), Security: 2 |
| MD5: | EBF9AEC610FFB1A4CF2BC72722D2B7AA |
| SHA1: | C59E7409EBA5429321B9F1741DB9336DCDF6897D |
| SHA256: | 66D7083B0C8F714AAA89BF29EAF6B26F8FBDE249948401D777F75C99865A9AE3 |
| SSDEEP: | 49152:eUEEDU0piMGINrKoeqCT7ZhHV9lpIlVBiwYJ8u+7gMDs6nR4B9V3NcAQKWDQuuI/:eU3Z91eBbzScJ8/gMDsW4Jtl9yJn |
MALICIOUS
Bypass User Account Control (ComputerDefaults)
- ComputerDefaults.exe (PID: 3040)
Adds path to the Windows Defender exclusion list
- systemtask.exe (PID: 4932)
METASTEALER has been detected (SURICATA)
- systemtask.exe (PID: 4932)
Actions looks like stealing of personal data
- systemtask.exe (PID: 4932)
SUSPICIOUS
Executes as Windows Service
- VSSVC.exe (PID: 6280)
Reads the Windows owner or organization settings
- msiexec.exe (PID: 6196)
Unpacks CAB file
- expand.exe (PID: 3540)
Reads security settings of Internet Explorer
- msiexec.exe (PID: 3032)
Script adds exclusion path to Windows Defender
- systemtask.exe (PID: 4932)
Starts POWERSHELL.EXE for commands execution
- systemtask.exe (PID: 4932)
Uses SYSTEMINFO.EXE to read the environment
- systemtask.exe (PID: 4932)
INFO
Manages system restore points
- SrTasks.exe (PID: 6252)
Checks supported languages
- msiexec.exe (PID: 6196)
- setup.exe (PID: 4640)
- msiexec.exe (PID: 3032)
Reads the computer name
- msiexec.exe (PID: 6196)
- msiexec.exe (PID: 3032)
- systemtask.exe (PID: 4932)
- setup.exe (PID: 4640)
An automatically generated document
- msiexec.exe (PID: 6004)
Reads the machine GUID from the registry
- msiexec.exe (PID: 3032)
The process uses the downloaded file
- msiexec.exe (PID: 3032)
- powershell.exe (PID: 7024)
Create files in a temporary directory
- msiexec.exe (PID: 3032)
Executable content was dropped or overwritten
- msiexec.exe (PID: 6196)
Process checks computer location settings
- msiexec.exe (PID: 3032)
Script raised an exception (POWERSHELL)
- powershell.exe (PID: 7024)
Checks if a key exists in the options dictionary (POWERSHELL)
- powershell.exe (PID: 7024)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .msi | | | Microsoft Installer (100) |
|---|
EXIF
FlashPix
| Title: | Google Chrome 125.0.6422.113 |
|---|---|
| Subject: | Google Chrome |
| Author: | Google LLC |
| Keywords: | Installer |
| Template: | Intel;1033 |
| RevisionNumber: | {CC659C51-85CC-445F-B840-187BCCCBE876} |
| CreateDate: | 2024:01:11 14:59:44 |
| ModifyDate: | 2024:01:11 14:59:44 |
| Pages: | 200 |
| Words: | 12 |
| Software: | MSI Wrapper (11.0.53.0) |
| Security: | Read-only recommended |
| CodePage: | Windows Cyrillic |
| LocaleIndicator: | 1033 |
| Company: | Google LLC |
Total processes
151
Monitored processes
18
Malicious processes
4
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2192 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3032 | C:\Windows\syswow64\MsiExec.exe -Embedding 147974643A02EF2543D3926F82C981A2 | C:\Windows\SysWOW64\msiexec.exe | — | msiexec.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 0 Version: 5.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3040 | "C:\WINDOWS\system32\computerdefaults.exe" | C:\Windows\System32\ComputerDefaults.exe | setup.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Set Program Access and Computer Defaults Control Panel Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3540 | "C:\WINDOWS\system32\EXPAND.EXE" -R files.cab -F:* files | C:\Windows\SysWOW64\expand.exe | — | msiexec.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: LZ Expansion Utility Exit code: 0 Version: 5.00 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4556 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | expand.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4640 | "C:\Users\admin\AppData\Local\Temp\MW-2bd2962c-91b0-4eae-9ba2-b23e8754c29f\files\setup.exe" /VERYSILENT /VERYSILENT | C:\Users\admin\AppData\Local\Temp\MW-2bd2962c-91b0-4eae-9ba2-b23e8754c29f\files\setup.exe | msiexec.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 4824 | C:\WINDOWS\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3989_none_7ddb45627cb30e03\TiWorker.exe -Embedding | C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3989_none_7ddb45627cb30e03\TiWorker.exe | — | svchost.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows Modules Installer Worker Version: 10.0.19041.3989 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4932 | C:\Users\admin\AppData\Local\Microsoft\Windows\systemtask.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\systemtask.exe | ComputerDefaults.exe | ||||||||||||
User: admin Integrity Level: HIGH Modules
| |||||||||||||||
| 5892 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | SrTasks.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6004 | "C:\Windows\System32\msiexec.exe" /i C:\Users\admin\AppData\Local\Temp\5c322c.msi | C:\Windows\System32\msiexec.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 1603 Version: 5.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
14 807
Read events
14 622
Write events
172
Delete events
13
Modification events
| (PID) Process: | (6196) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore |
| Operation: | write | Name: | SrCreateRp (Enter) |
Value: 480000000000000073D3CCC4874CDB013418000078180000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (6196) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP |
| Operation: | write | Name: | SppGetSnapshots (Enter) |
Value: 48000000000000004936CFC4874CDB013418000078180000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (6196) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP |
| Operation: | write | Name: | SppGetSnapshots (Leave) |
Value: 480000000000000017C629C5874CDB013418000078180000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (6196) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP |
| Operation: | write | Name: | SppEnumGroups (Enter) |
Value: 480000000000000017C629C5874CDB013418000078180000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (6196) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP |
| Operation: | write | Name: | SppEnumGroups (Leave) |
Value: 48000000000000005A8E2EC5874CDB013418000078180000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (6196) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP |
| Operation: | write | Name: | SppCreate (Enter) |
Value: 480000000000000026F430C5874CDB013418000078180000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (6196) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP |
| Operation: | write | Name: | LastIndex |
Value: 11 | |||
| (PID) Process: | (6196) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP |
| Operation: | write | Name: | SppGatherWriterMetadata (Enter) |
Value: 4800000000000000FDAFB1C5874CDB013418000078180000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (6196) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher |
| Operation: | write | Name: | IDENTIFY (Enter) |
Value: 4800000000000000D314B4C5874CDB0134180000FC180000E8030000010000000000000000000000A200C9A1153C4249B8AE52DF578EEF5500000000000000000000000000000000 | |||
| (PID) Process: | (6280) VSSVC.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer |
| Operation: | write | Name: | IDENTIFY (Enter) |
Value: 4800000000000000A5F7BFC5874CDB0188180000A4180000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
Executable files
3
Suspicious files
19
Text files
6
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6196 | msiexec.exe | C:\System Volume Information\SPP\metadata-2 | — | |
MD5:— | SHA256:— | |||
| 3540 | expand.exe | C:\Users\admin\AppData\Local\Temp\MW-2bd2962c-91b0-4eae-9ba2-b23e8754c29f\files\setup.exe | — | |
MD5:— | SHA256:— | |||
| 4640 | setup.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\systemtask.exe | — | |
MD5:— | SHA256:— | |||
| 6196 | msiexec.exe | C:\Windows\Installer\13b857.msi | executable | |
MD5:EBF9AEC610FFB1A4CF2BC72722D2B7AA | SHA256:66D7083B0C8F714AAA89BF29EAF6B26F8FBDE249948401D777F75C99865A9AE3 | |||
| 6196 | msiexec.exe | C:\Windows\Temp\~DFE4CC6218DF91C6E1.TMP | binary | |
MD5:BF619EAC0CDF3F68D496EA9344137E8B | SHA256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560 | |||
| 6196 | msiexec.exe | C:\Windows\Installer\SourceHash{DADE2BD7-BC4C-4ACE-B904-5FBC1A7D8DC6} | binary | |
MD5:96F481F0903FBFA6470F299193FD0E02 | SHA256:F4EA5339832E75AC11C4AC2440FF1AD0A2DFAE9619F75EBC18D3CA97F021F4EA | |||
| 6196 | msiexec.exe | C:\Windows\Temp\~DF1E22285839AE6E24.TMP | binary | |
MD5:070143859E2576DD146EA3695C8C1DB0 | SHA256:FBE0B897534B47D23756E7447C95706D8CEF6D40C9DC164667B196D59A999AA6 | |||
| 6196 | msiexec.exe | C:\Windows\Temp\~DF24C3ED3D32087BBA.TMP | binary | |
MD5:BF619EAC0CDF3F68D496EA9344137E8B | SHA256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560 | |||
| 6196 | msiexec.exe | C:\Windows\Temp\~DFBC0B32881F66D55A.TMP | binary | |
MD5:E38DB566EA4411D8584F3877C710C5A1 | SHA256:AC11C4C79EAE788416255EBB143F4E5CEF587F0F86C0C0548531BEDFBA73BBA9 | |||
| 6196 | msiexec.exe | C:\Windows\Temp\~DF36813DE4E7EF63A1.TMP | binary | |
MD5:671B813BE0EBDE53D56E439D703E4F43 | SHA256:BB91B3203491E1B2CF60D71E3FC8DDDBA4F67402D58346357C976C3C3FB7C504 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
42
DNS requests
564
Threats
13
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 2.16.241.12:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
716 | svchost.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
5064 | SearchApp.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
6672 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | whitelisted |
1176 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
4932 | systemtask.exe | GET | — | 166.1.160.237:443 | http://aikmouciiqgecoqi.xyz:443/avast_update | unknown | — | — | unknown |
3208 | SIHClient.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
3208 | SIHClient.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
4932 | systemtask.exe | GET | 200 | 166.1.160.237:443 | http://aikmouciiqgecoqi.xyz:443/api/client_hello | unknown | — | — | unknown |
4640 | setup.exe | GET | 200 | 166.1.160.237:443 | http://aikmouciiqgecoqi.xyz:443/api/client_hello | unknown | — | — | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
440 | RUXIMICS.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
716 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
716 | svchost.exe | 2.16.241.12:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
716 | svchost.exe | 95.101.149.131:80 | www.microsoft.com | Akamai International B.V. | NL | whitelisted |
5064 | SearchApp.exe | 2.23.209.187:443 | www.bing.com | Akamai International B.V. | GB | whitelisted |
5064 | SearchApp.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
1176 | svchost.exe | 20.190.159.23:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
www.bing.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
login.live.com |
| whitelisted |
go.microsoft.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
4932 | systemtask.exe | Misc activity | ET HUNTING EXE Base64 Encoded potential malware |
4932 | systemtask.exe | Potentially Bad Traffic | ET POLICY HTTP traffic on port 443 (POST) |
4932 | systemtask.exe | Potentially Bad Traffic | ET POLICY HTTP traffic on port 443 (POST) |
4932 | systemtask.exe | Potentially Bad Traffic | ET POLICY HTTP traffic on port 443 (POST) |
4932 | systemtask.exe | Potentially Bad Traffic | ET POLICY HTTP traffic on port 443 (POST) |
4932 | systemtask.exe | Potentially Bad Traffic | ET POLICY HTTP traffic on port 443 (POST) |
7 ETPRO signatures available at the full report