limerat | hxxps://gofile[.]io/d/OpjWBf

Analysis

max time kernel
275s
max time network
280s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
17-03-2023 17:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/OpjWBf

Score

10^/10

limerat rat

Malware Config

Extracted

Family

limerat

Attributes

aes_key
vamp
antivm
true
c2_url
https://pastebin.com/raw/DDTVwwbu
delay
3
download_payload
false
install
false
install_name
Wservices.exe
main_folder
Temp
pin_spread
false
sub_folder
\
usb_spread
false

Signatures

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\4e1dc068-43af-42cd-bd25-abe52c729989.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230317184032.pma	setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

Processes:

powershell.exemsedge.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

powershell.exemsedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	Process
5048	powershell.exe
5048	powershell.exe
1092	msedge.exe
1092	msedge.exe
32	msedge.exe
32	msedge.exe
5236	identity_helper.exe
5236	identity_helper.exe
4280	msedge.exe
4280	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

Processes:

msedge.exe

pid	Process
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exeMercurial Grabber V13.exe

description	pid	Process
Token: SeDebugPrivilege	5048	powershell.exe
Token: SeDebugPrivilege	5836	Mercurial Grabber V13.exe
Token: SeDebugPrivilege	5836	Mercurial Grabber V13.exe

Suspicious use of FindShellTrayWindow 18 IoCs

Processes:

msedge.exenotepad.exe

pid	Process
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
3648	notepad.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	Process	procid_target
PID 32 wrote to memory of 3672	32	msedge.exe	89
PID 32 wrote to memory of 3672	32	msedge.exe	89
PID 32 wrote to memory of 936	32	msedge.exe	90
PID 32 wrote to memory of 936	32	msedge.exe	90
PID 32 wrote to memory of 936	32	msedge.exe	90
PID 32 wrote to memory of 936	32	msedge.exe	90
PID 32 wrote to memory of 936	32	msedge.exe	90
PID 32 wrote to memory of 936	32	msedge.exe	90
PID 32 wrote to memory of 936	32	msedge.exe	90
PID 32 wrote to memory of 936	32	msedge.exe	90
PID 32 wrote to memory of 936	32	msedge.exe	90
PID 32 wrote to memory of 936	32	msedge.exe	90
PID 32 wrote to memory of 936	32	msedge.exe	90
PID 32 wrote to memory of 936	32	msedge.exe	90
PID 32 wrote to memory of 936	32	msedge.exe	90
PID 32 wrote to memory of 936	32	msedge.exe	90
PID 32 wrote to memory of 936	32	msedge.exe	90
PID 32 wrote to memory of 936	32	msedge.exe	90
PID 32 wrote to memory of 936	32	msedge.exe	90
PID 32 wrote to memory of 936	32	msedge.exe	90
PID 32 wrote to memory of 936	32	msedge.exe	90
PID 32 wrote to memory of 936	32	msedge.exe	90
PID 32 wrote to memory of 936	32	msedge.exe	90
PID 32 wrote to memory of 936	32	msedge.exe	90
PID 32 wrote to memory of 936	32	msedge.exe	90
PID 32 wrote to memory of 936	32	msedge.exe	90
PID 32 wrote to memory of 936	32	msedge.exe	90
PID 32 wrote to memory of 936	32	msedge.exe	90
PID 32 wrote to memory of 936	32	msedge.exe	90
PID 32 wrote to memory of 936	32	msedge.exe	90
PID 32 wrote to memory of 936	32	msedge.exe	90
PID 32 wrote to memory of 936	32	msedge.exe	90
PID 32 wrote to memory of 936	32	msedge.exe	90
PID 32 wrote to memory of 936	32	msedge.exe	90
PID 32 wrote to memory of 936	32	msedge.exe	90
PID 32 wrote to memory of 936	32	msedge.exe	90
PID 32 wrote to memory of 936	32	msedge.exe	90
PID 32 wrote to memory of 936	32	msedge.exe	90
PID 32 wrote to memory of 936	32	msedge.exe	90
PID 32 wrote to memory of 936	32	msedge.exe	90
PID 32 wrote to memory of 936	32	msedge.exe	90
PID 32 wrote to memory of 936	32	msedge.exe	90
PID 32 wrote to memory of 1092	32	msedge.exe	91
PID 32 wrote to memory of 1092	32	msedge.exe	91
PID 32 wrote to memory of 3316	32	msedge.exe	92
PID 32 wrote to memory of 3316	32	msedge.exe	92
PID 32 wrote to memory of 3316	32	msedge.exe	92
PID 32 wrote to memory of 3316	32	msedge.exe	92
PID 32 wrote to memory of 3316	32	msedge.exe	92
PID 32 wrote to memory of 3316	32	msedge.exe	92
PID 32 wrote to memory of 3316	32	msedge.exe	92
PID 32 wrote to memory of 3316	32	msedge.exe	92
PID 32 wrote to memory of 3316	32	msedge.exe	92
PID 32 wrote to memory of 3316	32	msedge.exe	92
PID 32 wrote to memory of 3316	32	msedge.exe	92
PID 32 wrote to memory of 3316	32	msedge.exe	92
PID 32 wrote to memory of 3316	32	msedge.exe	92
PID 32 wrote to memory of 3316	32	msedge.exe	92
PID 32 wrote to memory of 3316	32	msedge.exe	92
PID 32 wrote to memory of 3316	32	msedge.exe	92
PID 32 wrote to memory of 3316	32	msedge.exe	92
PID 32 wrote to memory of 3316	32	msedge.exe	92
PID 32 wrote to memory of 3316	32	msedge.exe	92
PID 32 wrote to memory of 3316	32	msedge.exe	92

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell start shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge https://gofile.io/d/OpjWBf
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-redirect=Windows.Launch https://gofile.io/d/OpjWBf
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:32
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb997046f8,0x7ffb99704708,0x7ffb99704718
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,211716640339147730,10379485885103289519,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,211716640339147730,10379485885103289519,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,211716640339147730,10379485885103289519,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,211716640339147730,10379485885103289519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3696 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,211716640339147730,10379485885103289519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3704 /prefetch:1
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,211716640339147730,10379485885103289519,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,211716640339147730,10379485885103289519,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,211716640339147730,10379485885103289519,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,211716640339147730,10379485885103289519,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,211716640339147730,10379485885103289519,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,211716640339147730,10379485885103289519,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6516 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,211716640339147730,10379485885103289519,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7036 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,211716640339147730,10379485885103289519,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6776 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,211716640339147730,10379485885103289519,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,211716640339147730,10379485885103289519,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,211716640339147730,10379485885103289519,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,211716640339147730,10379485885103289519,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,211716640339147730,10379485885103289519,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8072 /prefetch:1
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,211716640339147730,10379485885103289519,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8216 /prefetch:8
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:5972
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x7ff60ce45460,0x7ff60ce45470,0x7ff60ce45480
    3⤵
    PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,211716640339147730,10379485885103289519,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8216 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,211716640339147730,10379485885103289519,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7992 /prefetch:1
  2⤵
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,211716640339147730,10379485885103289519,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7532 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2120,211716640339147730,10379485885103289519,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6524 /prefetch:8
  2⤵
  PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,211716640339147730,10379485885103289519,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7248 /prefetch:1
  2⤵
  PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,211716640339147730,10379485885103289519,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7616 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3312

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1348

C:\Windows\system32\notepad.exe
"C:\Windows\system32\notepad.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:3648

C:\Users\Admin\Downloads\Mercurial Grabber V13\Mercurial Grabber V13\Mercurial Grabber V13.exe
"C:\Users\Admin\Downloads\Mercurial Grabber V13\Mercurial Grabber V13\Mercurial Grabber V13.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5836

C:\Users\Admin\Downloads\Mercurial Grabber V13\Mercurial Grabber V13\Mercurial Grabber V13.exe
"C:\Users\Admin\Downloads\Mercurial Grabber V13\Mercurial Grabber V13\Mercurial Grabber V13.exe"
1⤵
PID:5424

C:\Users\Admin\Downloads\Mercurial Grabber V13\Mercurial Grabber V13\Mercurial Grabber V13.exe
"C:\Users\Admin\Downloads\Mercurial Grabber V13\Mercurial Grabber V13\Mercurial Grabber V13.exe"
1⤵
PID:5660

C:\Users\Admin\Downloads\Mercurial Grabber V13\Mercurial Grabber V13\Mercurial Grabber V13.exe
"C:\Users\Admin\Downloads\Mercurial Grabber V13\Mercurial Grabber V13\Mercurial Grabber V13.exe"
1⤵
PID:752

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Mercurial Grabber V13.exe.log

Filesize
415B

MD5
657f403a19497b80aefa11dfb75f4600

SHA1
c2c296140be72560a9602b8e918133f7991f65b3

SHA256
415830b94630e82b4460b4ff755a3049cb5558f30a5660d6923f61f3af7cd53c

SHA512
346e28c3fbd3e92b8b9a4ececeb45278bff97091e45c3519a42b7348cb826840a131d35db77b11e7537fab6bbc8da3eb8a99eae31168812ca45f20f1eebcfe04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5a10efe23009825eadc90c37a38d9401

SHA1
fd98f2ca011408d4b43ed4dfd5b6906fbc7b87c0

SHA256
05e135dee0260b4f601a0486401b64ff8653875d74bf259c2da232550dbfb4f5

SHA512
89416a3f5bf50cd4a432ac72cd0a7fb79d5aeb10bdcc468c55bbfa79b9f43fab17141305d44cb1fe980ec76cc6575c27e2bcfcbad5ccd886d45b9de03fb9d6d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c1a3c45dc07f766430f7feaa3000fb18

SHA1
698a0485bcf0ab2a9283d4ebd31ade980b0661d1

SHA256
adaba08026551b1b8f6c120143686da79f916d02adbef4a8d1c184e32a19fd48

SHA512
9fc93f01ab4b14f555791d757ffe881787cc697102547c61847552e597e206e70c6d35fedff559c72a0a67d1b95e769095ecb0a8a7d4f07cf58a7a0d57d3e9f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
18d89c616a1a3c5400c8e53aac3841f8

SHA1
d4bc02432dd3c68894c144e1637dc91c58c50a43

SHA256
0064c8d25113df333b026812831c74fc09aa43ef69d81bf99ffb163565acbdef

SHA512
8d97503a70c44bb16fd5543473084d034109f6836e6d0a57e3a2aaff90ce6397a7561e6f37f585a8759deb6a503e5078487cb820c20f22960adcfb8e01c5a051

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe56fa53.TMP

Filesize
48B

MD5
9fabf49a7ad1844a241a38c6cd349fd4

SHA1
5e7ca99b2ba0a4106a9e049aa8a46af50123601f

SHA256
5180457d45419692491afbe750df272091a05740615d5db5d13198619438f6d4

SHA512
3663c5049ed16fc111d95daa3cfc1333ffc4b8e07c35a864c0fa629c3fd91f4945c58132744684b90e3eee4fc1b282459a9474d891ffd18ca367416d4a647556

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
992e57ad749918030e323ad03a3b35cb

SHA1
b7f6d6fb5f157dc9f7b9d696d50ea778473b0699

SHA256
ab05182a255ef30746f56375ae4af963264a9b6b5950b3530b9ac6d19afff2e3

SHA512
9136a0ae48fb6ebcba37ba703d624af680e02b1588013c12cda286e9144fe93f9bdcea385f8e8eb18fa510aedc2c80ab904cff617da56db6e42d0f5cdd0c1ed2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
10KB

MD5
c142b1537388acbc4402d92c173de091

SHA1
fdb43f58b5bbe7f06ea6445ffc779249392cccc5

SHA256
df370da287d4d83b18e5990e6900db33f589aed670ed7a41f31bc2887b2a74e7

SHA512
899777791b170f7ba8e980bc9947e4b16749090207e83ec01b0b7e3dec919b5ee9a147887eb516f6fdeb6d4bf5a6744df9b502d5ff574685c11e69d3800629d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
585975961185bad7b038c2d3e69b54fb

SHA1
64d9faa5e2928399e7325ea415befac3bf3511cd

SHA256
eb74209ada2cc32fe01ddc874a2278ee60c91e8d0b5e25c581561fa7201030bb

SHA512
5efc40b0896fcbf04d75b8096db033c2717575a70c8578f09e6458a8d24b6d3f252b7ca3b2a68737c82a738b121935dc8f13aaddd9a79d2bb607e24ae50c6690

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
411ac42e022357fd11e634f507014a37

SHA1
f9264ac26908e56d6b39f6ac115dcb1805644587

SHA256
4f6cc3f6079325a4feae4e2215af1406a1a5ba041d6911ecd2086d7bf28102a1

SHA512
ad80e8a82352cd05e8bd2a3dcbe5adb7599dabc343d8dbe364df6047d53c0f87d6feb6dcacbd0f30b25761780e5010fd55ec282500b47c61c6106ef41eb1f6e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
4c51d263267cee2aa53f0df3c01aa801

SHA1
fc0ba13b8e566e55cf19ba9959b972e1c4e35072

SHA256
e566386d3e9405c67608d2424d1c1729f83632a6cda7c0bd9a08ea623f6e0370

SHA512
6ef55c85c5e80efe6c9fc3b228adb09f14900647ea54e7e568847a0c6c98ad0430935d31d60c7cb6958cda65049428afb09a60b40b0018d3ae5166c934003506

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
80f4d497710743dbf58292d77c9e631f

SHA1
c71aebc3f01f388a7e4cd29de9bb8f923604d575

SHA256
fa2a7d7655dc15a62f9401c2d3692a274229a97baa7f290095b72f08fdbf2436

SHA512
8ea5475f456ee54871874f10133b2126cf83fcdf7594d1283ec824e993ecd2e0c810b8708c0ea989dce485091be1076bd8a9ac681786398d5d2f39a3343fc94f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5edab6d3ffbeee247ccb4423f929a323

SHA1
a4ad201d149d59392a2a3163bd86ee900e20f3d9

SHA256
460cddb95ea1d9bc8d95d295dd051b49a1436437a91ddec5f131235b2d516933

SHA512
263fa99f03ea1ef381ca19f10fbe0362c1f9c129502dc6b730b076cafcf34b40a70ee8a0ee9446ec9c89c3a2d9855450609ec0f8cf9d0a1b2aebdd12be58d38c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
5e11cd0f4c0de20be72f48b5603ab51c

SHA1
9602d53c1a4109f23565d4615a990aacec21f709

SHA256
766b4b6563af217d608b9acafdcb3ca7c0c895e57a87c32a767fd38773ed3738

SHA512
8c6480833aa7d5b46eeb931ef75b43edf0bfae0ce446fa089cddfaca853166c11fe7dfd651ebc15603a2aab91c1604d2f08f15f810501b4a09f103957036233e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe56f66b.TMP

Filesize
3KB

MD5
18647f6316bf26c9c72596dfc003229e

SHA1
6ffef8ea4b878855fc21f13919fdfce29baf8339

SHA256
67613462ed55eaa31170934d734dd684f69cc602eb90275ef7bd00445741b87f

SHA512
b1e36c9fc676dc92d7879a061bcb0f026b3146abed4ad0a78e637e3a267eadefca21d840b66bb8a3d238f1d6d0651955389924a320afb60342be012dad12b47f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
c8ed91d0023893e7d9e2c3ead7c59928

SHA1
bae2cb597dc4819fd41886a86343eafab90820e3

SHA256
9bff9e2cd6a1947e4ece744e3ee55b6ed0a509b68ca65b3738c6c34a83e821b1

SHA512
e4079abbdce85d570856c4bee48a4ae800314c61c9a1227b713c94e7b64a0a05b9eb95c7cc376abd8c0bed413c75e5be2c72372b112ff778a16e9b8d316d68fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
2fe2561418dd35fc5d944b627968a6f9

SHA1
309fa3b6338299bfd5119d4235abb12d0b1edcb8

SHA256
1139b20111d23afb5869aee45e812e4d45186a2943e8b97ca546db647d0f3409

SHA512
ade17e255723e17b3057ee949c8b51cc93a1497417b5f6e66c2bd63eec65c790ef57248b66936e6de522e978d2cce1ab320afb2a65bebf950b5adbed28e50d56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
95314d9320129851cfefde3310d00436

SHA1
7046391b379cc24a94133cb2552c1309f2213486

SHA256
2bca17e471dc3955fc3e9417d58e0a198667370a99c6fc877078b99c81019477

SHA512
bab9568a24f59f6a1cd8857c1266c129333b417cfe249600590acd5ce72a7409d2118a81bb04258d98b4df12d9c3bb183d3c11e6cf588d078077802be0f1b7be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
ba6df67bec176e81657ff226bf5e927b

SHA1
9a33cd5b1349b2ed611198255f4e9383ea2ce07e

SHA256
d5d75da1f2824f6aaa57fe1e84168538bdb1811efa78a4e32cea9beb7e41c68b

SHA512
00b32f3255f9936501af52067739156e79cd6ba067d37a3e4a6b11ff46ea447f4c2a7e9ae4ae856c9179d25f8f1e143a376cbecf3d5c0fe12e82a90f74658d10

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gm0upuue.s4u.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
6d2fa5cca8316fd8ebeaf2626da9c565

SHA1
c0947e4e829260933292b5d656fcaab59c1de6f2

SHA256
9451d497463591c26a3616e89e4d3aa7cd9e4e5c9e50a84342d44d73e6e16348

SHA512
f393a6f4c62bd180ac6f502c041f6fdc567865ca5007e85ff36c302d5e40012c2fa282ca2181d26ce2927f3865725341431f59833777405ccc0f237942bcda8e

Download Submit
\??\pipe\LOCAL\crashpad_32_VFCCMKTOWESDOJYO

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/752-694-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

Filesize
64KB

Download
memory/5048-133-0x0000020A49DF0000-0x0000020A49E12000-memory.dmp

Filesize
136KB

Download
memory/5048-145-0x0000020A304A0000-0x0000020A304B0000-memory.dmp

Filesize
64KB

Download
memory/5048-135-0x0000020A304A0000-0x0000020A304B0000-memory.dmp

Filesize
64KB

Download
memory/5048-134-0x0000020A304A0000-0x0000020A304B0000-memory.dmp

Filesize
64KB

Download
memory/5424-690-0x0000000005B30000-0x0000000005B40000-memory.dmp

Filesize
64KB

Download
memory/5660-693-0x0000000001820000-0x0000000001830000-memory.dmp

Filesize
64KB

Download
memory/5836-685-0x00000000051A0000-0x000000000523C000-memory.dmp

Filesize
624KB

Download
memory/5836-689-0x0000000002C70000-0x0000000002C80000-memory.dmp

Filesize
64KB

Download
memory/5836-688-0x0000000005E50000-0x00000000063F4000-memory.dmp

Filesize
5.6MB

Download
memory/5836-687-0x0000000002C70000-0x0000000002C80000-memory.dmp

Filesize
64KB

Download
memory/5836-686-0x0000000005270000-0x00000000052D6000-memory.dmp

Filesize
408KB

Download
memory/5836-684-0x0000000000810000-0x000000000081E000-memory.dmp

Filesize
56KB

Download