hxxps://github[.]com/NightfallGT/Mercurial-Grabber/releases/download/v1[.]0/Mercurial[.]Grabber[.]v1[.]03[.]rar

Resubmissions

21/03/2025, 04:46

250321-fectvsttex 10

21/03/2025, 04:43

250321-fcmlaattdw 8

01/03/2024, 05:33

240301-f9c34sdh27 7

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/03/2024, 05:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/NightfallGT/Mercurial-Grabber/releases/download/v1.0/Mercurial.Grabber.v1.03.rar

Score

7^/10

agilenet

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3624	Mercurial.exe

Obfuscated with Agile.Net obfuscator 11 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral1/memory/3624-86-0x0000000005520000-0x000000000553C000-memory.dmp	agile_net
behavioral1/memory/3624-87-0x0000000005550000-0x0000000005570000-memory.dmp	agile_net
behavioral1/memory/3624-88-0x0000000005570000-0x0000000005590000-memory.dmp	agile_net
behavioral1/memory/3624-89-0x00000000055C0000-0x00000000055D0000-memory.dmp	agile_net
behavioral1/memory/3624-90-0x00000000055D0000-0x00000000055E4000-memory.dmp	agile_net
behavioral1/memory/3624-91-0x00000000055E0000-0x000000000564E000-memory.dmp	agile_net
behavioral1/memory/3624-92-0x0000000005660000-0x000000000567E000-memory.dmp	agile_net
behavioral1/memory/3624-93-0x00000000056A0000-0x00000000056D6000-memory.dmp	agile_net
behavioral1/memory/3624-94-0x00000000056E0000-0x00000000056EE000-memory.dmp	agile_net
behavioral1/memory/3624-95-0x0000000005700000-0x000000000570E000-memory.dmp	agile_net
behavioral1/memory/3624-96-0x0000000006070000-0x00000000061BA000-memory.dmp	agile_net

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3270530367-132075249-2153716227-1000\{B7F6E7F0-6D46-455B-8443-52D106986FB7}	msedge.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4560	msedge.exe
4560	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4440	identity_helper.exe
4440	identity_helper.exe
1092	msedge.exe
1092	msedge.exe
3624	Mercurial.exe
3624	Mercurial.exe
3624	Mercurial.exe
3624	Mercurial.exe
3624	Mercurial.exe
3624	Mercurial.exe
3624	Mercurial.exe
3624	Mercurial.exe
3624	Mercurial.exe
6024	msedge.exe
6024	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
760	7zFM.exe
3624	Mercurial.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	760	7zFM.exe
Token: 35	760	7zFM.exe
Token: SeSecurityPrivilege	760	7zFM.exe
Token: SeDebugPrivilege	3624	Mercurial.exe

Suspicious use of FindShellTrayWindow 48 IoCs

pid	Process
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
760	7zFM.exe
760	7zFM.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 3912	4740	msedge.exe	89
PID 4740 wrote to memory of 3912	4740	msedge.exe	89
PID 4740 wrote to memory of 3120	4740	msedge.exe	90
PID 4740 wrote to memory of 3120	4740	msedge.exe	90
PID 4740 wrote to memory of 3120	4740	msedge.exe	90
PID 4740 wrote to memory of 3120	4740	msedge.exe	90
PID 4740 wrote to memory of 3120	4740	msedge.exe	90
PID 4740 wrote to memory of 3120	4740	msedge.exe	90
PID 4740 wrote to memory of 3120	4740	msedge.exe	90
PID 4740 wrote to memory of 3120	4740	msedge.exe	90
PID 4740 wrote to memory of 3120	4740	msedge.exe	90
PID 4740 wrote to memory of 3120	4740	msedge.exe	90
PID 4740 wrote to memory of 3120	4740	msedge.exe	90
PID 4740 wrote to memory of 3120	4740	msedge.exe	90
PID 4740 wrote to memory of 3120	4740	msedge.exe	90
PID 4740 wrote to memory of 3120	4740	msedge.exe	90
PID 4740 wrote to memory of 3120	4740	msedge.exe	90
PID 4740 wrote to memory of 3120	4740	msedge.exe	90
PID 4740 wrote to memory of 3120	4740	msedge.exe	90
PID 4740 wrote to memory of 3120	4740	msedge.exe	90
PID 4740 wrote to memory of 3120	4740	msedge.exe	90
PID 4740 wrote to memory of 3120	4740	msedge.exe	90
PID 4740 wrote to memory of 3120	4740	msedge.exe	90
PID 4740 wrote to memory of 3120	4740	msedge.exe	90
PID 4740 wrote to memory of 3120	4740	msedge.exe	90
PID 4740 wrote to memory of 3120	4740	msedge.exe	90
PID 4740 wrote to memory of 3120	4740	msedge.exe	90
PID 4740 wrote to memory of 3120	4740	msedge.exe	90
PID 4740 wrote to memory of 3120	4740	msedge.exe	90
PID 4740 wrote to memory of 3120	4740	msedge.exe	90
PID 4740 wrote to memory of 3120	4740	msedge.exe	90
PID 4740 wrote to memory of 3120	4740	msedge.exe	90
PID 4740 wrote to memory of 3120	4740	msedge.exe	90
PID 4740 wrote to memory of 3120	4740	msedge.exe	90
PID 4740 wrote to memory of 3120	4740	msedge.exe	90
PID 4740 wrote to memory of 3120	4740	msedge.exe	90
PID 4740 wrote to memory of 3120	4740	msedge.exe	90
PID 4740 wrote to memory of 3120	4740	msedge.exe	90
PID 4740 wrote to memory of 3120	4740	msedge.exe	90
PID 4740 wrote to memory of 3120	4740	msedge.exe	90
PID 4740 wrote to memory of 3120	4740	msedge.exe	90
PID 4740 wrote to memory of 3120	4740	msedge.exe	90
PID 4740 wrote to memory of 4560	4740	msedge.exe	91
PID 4740 wrote to memory of 4560	4740	msedge.exe	91
PID 4740 wrote to memory of 4408	4740	msedge.exe	92
PID 4740 wrote to memory of 4408	4740	msedge.exe	92
PID 4740 wrote to memory of 4408	4740	msedge.exe	92
PID 4740 wrote to memory of 4408	4740	msedge.exe	92
PID 4740 wrote to memory of 4408	4740	msedge.exe	92
PID 4740 wrote to memory of 4408	4740	msedge.exe	92
PID 4740 wrote to memory of 4408	4740	msedge.exe	92
PID 4740 wrote to memory of 4408	4740	msedge.exe	92
PID 4740 wrote to memory of 4408	4740	msedge.exe	92
PID 4740 wrote to memory of 4408	4740	msedge.exe	92
PID 4740 wrote to memory of 4408	4740	msedge.exe	92
PID 4740 wrote to memory of 4408	4740	msedge.exe	92
PID 4740 wrote to memory of 4408	4740	msedge.exe	92
PID 4740 wrote to memory of 4408	4740	msedge.exe	92
PID 4740 wrote to memory of 4408	4740	msedge.exe	92
PID 4740 wrote to memory of 4408	4740	msedge.exe	92
PID 4740 wrote to memory of 4408	4740	msedge.exe	92
PID 4740 wrote to memory of 4408	4740	msedge.exe	92
PID 4740 wrote to memory of 4408	4740	msedge.exe	92
PID 4740 wrote to memory of 4408	4740	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/NightfallGT/Mercurial-Grabber/releases/download/v1.0/Mercurial.Grabber.v1.03.rar
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd704a46f8,0x7ffd704a4708,0x7ffd704a4718
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,12106170884398702482,5814889082044504247,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,12106170884398702482,5814889082044504247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,12106170884398702482,5814889082044504247,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12106170884398702482,5814889082044504247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12106170884398702482,5814889082044504247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,12106170884398702482,5814889082044504247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,12106170884398702482,5814889082044504247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12106170884398702482,5814889082044504247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4512 /prefetch:1
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12106170884398702482,5814889082044504247,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4380 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2132,12106170884398702482,5814889082044504247,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4236 /prefetch:8
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12106170884398702482,5814889082044504247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12106170884398702482,5814889082044504247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12106170884398702482,5814889082044504247,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2132,12106170884398702482,5814889082044504247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1092
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Mercurial.Grabber.v1.03.rar"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:760
- - C:\Users\Admin\AppData\Local\Temp\7zO8F2CD727\Mercurial.exe
    "C:\Users\Admin\AppData\Local\Temp\7zO8F2CD727\Mercurial.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12106170884398702482,5814889082044504247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12106170884398702482,5814889082044504247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2132,12106170884398702482,5814889082044504247,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4444 /prefetch:8
  2⤵
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2132,12106170884398702482,5814889082044504247,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4436 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12106170884398702482,5814889082044504247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12106170884398702482,5814889082044504247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12106170884398702482,5814889082044504247,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2868 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,12106170884398702482,5814889082044504247,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5892 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12106170884398702482,5814889082044504247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3076 /prefetch:1
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12106170884398702482,5814889082044504247,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12106170884398702482,5814889082044504247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12106170884398702482,5814889082044504247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4368 /prefetch:1
  2⤵
  PID:5844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12106170884398702482,5814889082044504247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1048 /prefetch:1
  2⤵
  PID:3312

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4556

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cbec32729772aa6c576e97df4fef48f5

SHA1
6ec173d5313f27ba1e46ad66c7bbe7c0a9767dba

SHA256
d34331aa91a21e127bbe68f55c4c1898c429d9d43545c3253d317ffb105aa24e

SHA512
425b3638fed70da3bc16bba8b9878de528aca98669203f39473b931f487a614d3f66073b8c3d9bc2211e152b4bbdeceb2777001467954eec491f862912f3c7a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
279e783b0129b64a8529800a88fbf1ee

SHA1
204c62ec8cef8467e5729cad52adae293178744f

SHA256
3619c3b82a8cbdce37bfd88b66d4fdfcd728a1112b05eb26998bea527d187932

SHA512
32730d9124dd28c196bd4abcfd6a283a04553f3f6b050c057264bc883783d30d6602781137762e66e1f90847724d0e994bddf6e729de11a809f263f139023d3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
2986f81928411ece2fd793df67bb2cd9

SHA1
560a4548a3e55a79e716f5a122bb719c4926d66b

SHA256
ce5021d103f72b86a4a892cace9f7fd62b46871ed245ef2ca18273cd9de20ea0

SHA512
2188b1de78cf73f6b4338b4606b9fd15c837be7600b8693810d3ae4ecff892515a069341be7979526507ac08ba179fae84ddaefb45b558c5812eda62609ec27c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
372dfc5a8dd1fa9c27164d8f18838062

SHA1
052197dea09db72f0299b9cfe3b34c55af21c251

SHA256
583daa5f95a06b60913fd1d27baec988ece5c9614b53e059f3fc60e37f848e19

SHA512
4b1ea7e597014f997c12f61efd866bce5742815a7dd00e54beab3d278e576ad58bcf2953e7b8cf90f4dceb06428f691e34a0014b578c2dbf173eda24dbcf5393

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
265B

MD5
f5cd008cf465804d0e6f39a8d81f9a2d

SHA1
6b2907356472ed4a719e5675cc08969f30adc855

SHA256
fcea95cc39dc6c2a925f5aed739dbedaa405ee4ce127f535fcf1c751b2b8fb5d

SHA512
dc97034546a4c94bdaa6f644b5cfd1e477209de9a03a5b02a360c254a406c1d647d6f90860f385e27387b35631c41f0886cb543ede9116436941b9af6cd3285d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
553B

MD5
6df55f2ab71d556ce56591dc7ca90635

SHA1
7b043fad9d3cace164c616f700e53a27e8aacd13

SHA256
f93c0cbb7da1d7e7b13f5ba9e8030dceb34dc4d363f6dc6e1bba3df076f74ea9

SHA512
5e2a515bd83c4af23ee9e8fd0a983d508e35713b3cbd569375c7b5eee63747a3ac46bb14338ff510fae2ac156c54ebc639f8cb094a32ff5a6f5fc5d1337f3123

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
60980a69d694ace4a8d73babd4821aad

SHA1
4d7d57748db273f5359a441ca7006237813af9f4

SHA256
5a988b1fdaf3b0fc6eee401afc93d0733bbe0e499cf0c04de51dde00dc31e75a

SHA512
8a84405584ff3e9cd3e98f84fe7f37dfc359c9ffe4af830f623913fe90580f2895a14ca34c1cebc913d34878b22f0462693d256f83579be8181e299d9745142a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bc65ce691e5e690496437ca7902b4846

SHA1
ac5fb276cc45cfc4e4d9460e4f4e5d5cae1470c5

SHA256
cddbb21fe8c200aeb85d610fbeed83f351bd1762d03395f28db326a1cfea24cb

SHA512
ab32e6d60aa7d0c8c0e178f6610eae66022ff990ade0b92cbcec1643a5a8458e49ee95888f21835089f4eefe7434752764f5371574de2143c8a0083ab4e7414f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
76c72cbef4e2987efc8bcfda16e5709d

SHA1
9f0a17a5c84d9c1de4e606ea07bcdd80239b07cb

SHA256
4773018c12327089c441486a9349800769420dba1b13008184879ba97d58d406

SHA512
4d7564e19fdcdac2cc93d865a585bb208b41a3d4080bf4f7c9056f97b073927d9f08c17700446fe9ec5ee9a4e874c2ef6332687e9a23c9cbe45dc6c114421cbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
fb593c867511ff949a28e221a51e19a7

SHA1
414611139a4d4155124f6902e74928aabbdf2e78

SHA256
4895038570071b450597ee2d55dc3dfb5ce2fd86a8802a435f976ee4692616cf

SHA512
48abb774bbfd4536d7321b705100df3c104b59956178a6eb35140100849ebe54090488d2e709e9e596d773391492b7e1a5aa6341e135a2e8a1693afce6d902fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f57fe15da78f0232d799f7fce940fa2c

SHA1
4d91ecb05411bbcae4ca53ef69c660260b8b9060

SHA256
c59bf2227dc2eb48a560efbaa45c40d25b61cb5e2f6362bc61ba60c676bf138f

SHA512
704741eccb87a9ddf6150b744d53078b51b5bd8d1ef212289c8bb569915b4979c70125d8e39c042520edd30052a9089c77efc38101d82a5d1a4e3ec402455e97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
742d6e301aa18e3b725034ec11c8ee09

SHA1
0ea6d184455423fc26095c6b9edd9242830bc0bc

SHA256
73e25d30591d9f2fda73a672a8896795dd4bb1178a8e498f99fc00a1db392897

SHA512
d392c26db4b0eb348f67fe0defacc5a7813adc91705e1fa8461bf9611001f238819361efb87efc165a77fd92eaeb44ebd6cb297cd2d2210a0953b970195f3a3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5857c0.TMP

Filesize
203B

MD5
fb73401a0dc0943f023d15337c38dfe1

SHA1
3eabeef344a53ebb6418262bf360223ac2801085

SHA256
33748ed19079a1b280fe9be95ae2c57d3a0e60067e1380b18f9a282c1ec1e7e9

SHA512
dfbe3788a9b30191492f92a3d9b04187ce46ab5078c999348beeafa63d0e4c23b0dcccdd0bee2d6a1f266a784380bd8093f802a371e3a1658bcb7718e1b999b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
92cbc5e9ad71d3ba08f66174c63084ec

SHA1
a753c1f58a08b3e21d7028b6326d09b41df203b7

SHA256
6100c00422ad28b4c6f704273485cbfc4c75069c7cd6ea7ccd92a0d4d37ef036

SHA512
da6f4de16018a5a6ba8a7d921e0e2d25462b476017e0cebc111d7b75adb905e2366555d2e7c3314cef4c2f4e74a917255373365b3314003631e39ea4c42096ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
83739ae0d332cbe3697d90b40da08ff1

SHA1
f53ed07c5990c6d45bb86df8c934869fb8cd9bb6

SHA256
97e9c2194b5aeac556a23c6ecd8549e4e7afaf49f30267a0b510107e9c17e2a2

SHA512
bfcd8d2c4700766dc4720b2f33c0593d786d15cc0e234cf169cc13044651876bbd46d1e1aaef152e60883b98b3c19c6c503f1912f198893e7ee52b6f7bce78b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
413a267c67ae990cd95e1fe3e123b5a4

SHA1
56b24ff3dcad05d10211e47e89c05ddb9be0726d

SHA256
d3bb089951331ae8c97fe7ab0050c6635a75af7441c57381c7f1b1056019c6c8

SHA512
378ed11d50d05462193c976d4b81638049c2aa3d39a0b3fb8c127d77203b71463e7aeb7e4db8b6abd8f770398a8e65399716832647f48f162e658d4a72e952ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO8F2CD727\Mercurial.exe

Filesize
3.2MB

MD5
a9477b3e21018b96fc5d2264d4016e65

SHA1
493fa8da8bf89ea773aeb282215f78219a5401b7

SHA256
890fd59af3370e2ce12e0d11916d1ad4ee9b9c267c434347dbed11e9572e8645

SHA512
66529a656865400fe37d40ae125a1d057f8be5aa17da80d367ebbe1a9dcea38f5174870d0dc5b56771f6ca5a13e2fad22d803f5357f3ef59a46e3bdf0cc5ee9c

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 19616.crdownload

Filesize
2.9MB

MD5
635903bad1ada856d701f34d3070ccd9

SHA1
3ff98d91b9a3a47bf9f64bdf161efb9c5ac99fb0

SHA256
3759744039346620e9613f40f90e8f318e5f54ad49c070e2bd23b667f7e65bf6

SHA512
fee2c64124c47bcb1251b7b87969a1ff493e24bc196633e3a301565b126f5ed2e2967d4d1426ff5d9be9466c852bacf405229308acf946368e00ca887a4ef015

Download Submit
memory/3624-94-0x00000000056E0000-0x00000000056EE000-memory.dmp

Filesize
56KB

Download
memory/3624-123-0x0000000005300000-0x0000000005310000-memory.dmp

Filesize
64KB

Download
memory/3624-93-0x00000000056A0000-0x00000000056D6000-memory.dmp

Filesize
216KB

Download
memory/3624-91-0x00000000055E0000-0x000000000564E000-memory.dmp

Filesize
440KB

Download
memory/3624-95-0x0000000005700000-0x000000000570E000-memory.dmp

Filesize
56KB

Download
memory/3624-96-0x0000000006070000-0x00000000061BA000-memory.dmp

Filesize
1.3MB

Download
memory/3624-97-0x0000000006220000-0x0000000006336000-memory.dmp

Filesize
1.1MB

Download
memory/3624-98-0x0000000005880000-0x00000000058B0000-memory.dmp

Filesize
192KB

Download
memory/3624-99-0x0000000008D20000-0x0000000008D28000-memory.dmp

Filesize
32KB

Download
memory/3624-100-0x0000000005300000-0x0000000005310000-memory.dmp

Filesize
64KB

Download
memory/3624-90-0x00000000055D0000-0x00000000055E4000-memory.dmp

Filesize
80KB

Download
memory/3624-119-0x0000000074410000-0x0000000074BC0000-memory.dmp

Filesize
7.7MB

Download
memory/3624-120-0x0000000005300000-0x0000000005310000-memory.dmp

Filesize
64KB

Download
memory/3624-92-0x0000000005660000-0x000000000567E000-memory.dmp

Filesize
120KB

Download
memory/3624-124-0x0000000005300000-0x0000000005310000-memory.dmp

Filesize
64KB

Download
memory/3624-125-0x0000000005300000-0x0000000005310000-memory.dmp

Filesize
64KB

Download
memory/3624-126-0x0000000005300000-0x0000000005310000-memory.dmp

Filesize
64KB

Download
memory/3624-89-0x00000000055C0000-0x00000000055D0000-memory.dmp

Filesize
64KB

Download
memory/3624-88-0x0000000005570000-0x0000000005590000-memory.dmp

Filesize
128KB

Download
memory/3624-87-0x0000000005550000-0x0000000005570000-memory.dmp

Filesize
128KB

Download
memory/3624-86-0x0000000005520000-0x000000000553C000-memory.dmp

Filesize
112KB

Download
memory/3624-85-0x00000000054A0000-0x00000000054AA000-memory.dmp

Filesize
40KB

Download
memory/3624-84-0x0000000005300000-0x0000000005310000-memory.dmp

Filesize
64KB

Download
memory/3624-83-0x0000000005310000-0x00000000053A2000-memory.dmp

Filesize
584KB

Download
memory/3624-82-0x00000000058C0000-0x0000000005E64000-memory.dmp

Filesize
5.6MB

Download
memory/3624-81-0x00000000005C0000-0x00000000008FA000-memory.dmp

Filesize
3.2MB

Download
memory/3624-80-0x0000000074410000-0x0000000074BC0000-memory.dmp

Filesize
7.7MB

Download