hxxps://www[.]google[.]com/url?sa=t&source=web&rct=j&opi=89978449&url=hxxps://github[.]com/Smug246/Luna-Grabber&ved=2ahUKEwibxO_GsqaGAxUY0QIHHU-CBacQFnoECAYQAQ&usg=AOvVaw214mJQWcDWLlffgSu6y_H7

Analysis

max time kernel
270s
max time network
273s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
24/05/2024, 13:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://www.google.com/url?sa=t&source=web&rct=j&opi=89978449&url=https://github.com/Smug246/Luna-Grabber&ved=2ahUKEwibxO_GsqaGAxUY0QIHHU-CBacQFnoECAYQAQ&usg=AOvVaw214mJQWcDWLlffgSu6y_H7

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

flow	ioc
24	camo.githubusercontent.com
25	camo.githubusercontent.com
26	camo.githubusercontent.com
27	camo.githubusercontent.com
28	camo.githubusercontent.com
1	camo.githubusercontent.com
23	camo.githubusercontent.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3001105534-2705918504-2956618779-1000\{F9A00DE6-BC38-41D6-8A2E-0B3A2894E3E9}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Luna-Grabber-1.5.5-alpha.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2884	msedge.exe
2884	msedge.exe
1120	msedge.exe
1120	msedge.exe
4964	identity_helper.exe
4964	identity_helper.exe
1640	msedge.exe
1640	msedge.exe
4360	msedge.exe
4360	msedge.exe
3412	msedge.exe
3412	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1120 wrote to memory of 4392	1120	msedge.exe	79
PID 1120 wrote to memory of 4392	1120	msedge.exe	79
PID 1120 wrote to memory of 1240	1120	msedge.exe	80
PID 1120 wrote to memory of 1240	1120	msedge.exe	80
PID 1120 wrote to memory of 1240	1120	msedge.exe	80
PID 1120 wrote to memory of 1240	1120	msedge.exe	80
PID 1120 wrote to memory of 1240	1120	msedge.exe	80
PID 1120 wrote to memory of 1240	1120	msedge.exe	80
PID 1120 wrote to memory of 1240	1120	msedge.exe	80
PID 1120 wrote to memory of 1240	1120	msedge.exe	80
PID 1120 wrote to memory of 1240	1120	msedge.exe	80
PID 1120 wrote to memory of 1240	1120	msedge.exe	80
PID 1120 wrote to memory of 1240	1120	msedge.exe	80
PID 1120 wrote to memory of 1240	1120	msedge.exe	80
PID 1120 wrote to memory of 1240	1120	msedge.exe	80
PID 1120 wrote to memory of 1240	1120	msedge.exe	80
PID 1120 wrote to memory of 1240	1120	msedge.exe	80
PID 1120 wrote to memory of 1240	1120	msedge.exe	80
PID 1120 wrote to memory of 1240	1120	msedge.exe	80
PID 1120 wrote to memory of 1240	1120	msedge.exe	80
PID 1120 wrote to memory of 1240	1120	msedge.exe	80
PID 1120 wrote to memory of 1240	1120	msedge.exe	80
PID 1120 wrote to memory of 1240	1120	msedge.exe	80
PID 1120 wrote to memory of 1240	1120	msedge.exe	80
PID 1120 wrote to memory of 1240	1120	msedge.exe	80
PID 1120 wrote to memory of 1240	1120	msedge.exe	80
PID 1120 wrote to memory of 1240	1120	msedge.exe	80
PID 1120 wrote to memory of 1240	1120	msedge.exe	80
PID 1120 wrote to memory of 1240	1120	msedge.exe	80
PID 1120 wrote to memory of 1240	1120	msedge.exe	80
PID 1120 wrote to memory of 1240	1120	msedge.exe	80
PID 1120 wrote to memory of 1240	1120	msedge.exe	80
PID 1120 wrote to memory of 1240	1120	msedge.exe	80
PID 1120 wrote to memory of 1240	1120	msedge.exe	80
PID 1120 wrote to memory of 1240	1120	msedge.exe	80
PID 1120 wrote to memory of 1240	1120	msedge.exe	80
PID 1120 wrote to memory of 1240	1120	msedge.exe	80
PID 1120 wrote to memory of 1240	1120	msedge.exe	80
PID 1120 wrote to memory of 1240	1120	msedge.exe	80
PID 1120 wrote to memory of 1240	1120	msedge.exe	80
PID 1120 wrote to memory of 1240	1120	msedge.exe	80
PID 1120 wrote to memory of 1240	1120	msedge.exe	80
PID 1120 wrote to memory of 2884	1120	msedge.exe	81
PID 1120 wrote to memory of 2884	1120	msedge.exe	81
PID 1120 wrote to memory of 3644	1120	msedge.exe	82
PID 1120 wrote to memory of 3644	1120	msedge.exe	82
PID 1120 wrote to memory of 3644	1120	msedge.exe	82
PID 1120 wrote to memory of 3644	1120	msedge.exe	82
PID 1120 wrote to memory of 3644	1120	msedge.exe	82
PID 1120 wrote to memory of 3644	1120	msedge.exe	82
PID 1120 wrote to memory of 3644	1120	msedge.exe	82
PID 1120 wrote to memory of 3644	1120	msedge.exe	82
PID 1120 wrote to memory of 3644	1120	msedge.exe	82
PID 1120 wrote to memory of 3644	1120	msedge.exe	82
PID 1120 wrote to memory of 3644	1120	msedge.exe	82
PID 1120 wrote to memory of 3644	1120	msedge.exe	82
PID 1120 wrote to memory of 3644	1120	msedge.exe	82
PID 1120 wrote to memory of 3644	1120	msedge.exe	82
PID 1120 wrote to memory of 3644	1120	msedge.exe	82
PID 1120 wrote to memory of 3644	1120	msedge.exe	82
PID 1120 wrote to memory of 3644	1120	msedge.exe	82
PID 1120 wrote to memory of 3644	1120	msedge.exe	82
PID 1120 wrote to memory of 3644	1120	msedge.exe	82
PID 1120 wrote to memory of 3644	1120	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/url?sa=t&source=web&rct=j&opi=89978449&url=https://github.com/Smug246/Luna-Grabber&ved=2ahUKEwibxO_GsqaGAxUY0QIHHU-CBacQFnoECAYQAQ&usg=AOvVaw214mJQWcDWLlffgSu6y_H7
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff95b673cb8,0x7ff95b673cc8,0x7ff95b673cd8
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,4386170729511096443,9617635611612339450,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1888,4386170729511096443,9617635611612339450,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1888,4386170729511096443,9617635611612339450,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,4386170729511096443,9617635611612339450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,4386170729511096443,9617635611612339450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,4386170729511096443,9617635611612339450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3916 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1888,4386170729511096443,9617635611612339450,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1888,4386170729511096443,9617635611612339450,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,4386170729511096443,9617635611612339450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1888,4386170729511096443,9617635611612339450,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,4386170729511096443,9617635611612339450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,4386170729511096443,9617635611612339450,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,4386170729511096443,9617635611612339450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,4386170729511096443,9617635611612339450,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,4386170729511096443,9617635611612339450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,4386170729511096443,9617635611612339450,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,4386170729511096443,9617635611612339450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6440 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,4386170729511096443,9617635611612339450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6592 /prefetch:1
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,4386170729511096443,9617635611612339450,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6620 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,4386170729511096443,9617635611612339450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6676 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1888,4386170729511096443,9617635611612339450,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4616 /prefetch:8
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1888,4386170729511096443,9617635611612339450,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6624 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,4386170729511096443,9617635611612339450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6816 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,4386170729511096443,9617635611612339450,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4688 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,4386170729511096443,9617635611612339450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,4386170729511096443,9617635611612339450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1524 /prefetch:1
  2⤵
  PID:4940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1344

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
390187670cb1e0eb022f4f7735263e82

SHA1
ea1401ccf6bf54e688a0dc9e6946eae7353b26f1

SHA256
3e6c56356d6509a3fd4b2403555be55e251f4a962379b29735c1203e57230947

SHA512
602f64d74096d4fb7a23b23374603246d42b17cc854835e3b2f4d464997b73f289a3b40eb690e3ee707829d4ff886865e982f72155d96be6bc00166f44878062

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8294f1821fd3419c0a42b389d19ecfc6

SHA1
cd4982751377c2904a1d3c58e801fa013ea27533

SHA256
92a96c9309023c8b9e1396ff41f7d9d3ff8a3687972e76b9ebd70b04e3bf223a

SHA512
372d369f7ad1b0e07200d3aa6b2cfce5beafa7a97f63932d4c9b3b01a0e8b7eb39881867f87ded55a9973abea973b2d2c9b6fc4892f81cec644702b9edb1566d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
60b27a5272c1db8718535eff8270e420

SHA1
2d6860ac1397d40959be2513d994a8c42c3399fe

SHA256
1dc2d6efde2dd922b58f20a40168d335cd910b0dfc257336fd0ed6f111a88604

SHA512
0a9ef9ac766a14e938d51b8f5e1abf759eda787a5fb500a3bd275ed179d77238dd90f24a58411ff9685fea9d017c8e62d78c441f80bf4e1e63803ac8d46a8c15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
2c2a578ad8b3be4646743081501a1dc0

SHA1
259e104c0d3688ee0f195739cb4e6152b22f180f

SHA256
a15e1d774747900e22e2f6211aa58804708465b1225da4e7b5796478b75fc741

SHA512
4ee8f3f2616ab4c7c848881a1cbf308abcd3bb4edf8100ea1f14b9281390c243591ac09cb7e8ed291af3305587aeccf90f59517fc6a3a824b60a73ad78d8d27b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
7000980ff259d896ddca5398a1095fe1

SHA1
8beb1460405f40e9c813d569f9f5dcb9e9f9c62d

SHA256
5993b2ec154e1ce8b0fac8276e9be520b5a17466b200f8439c3cc8e3fffdfc31

SHA512
33bf8370953c55ab1c2cc11e7266a9e66993bd238779825f2f86e95c07af2d792743512f1e995e3260d47eccd1974fdd677a9d115b41f4a824de6a6652875bf0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
941B

MD5
e045d1a6a327af882ef4dfa9ab1a8541

SHA1
23af3dba05ca16775edc420b30b9f1e1d4c6d26a

SHA256
4846d93bee376aff06717003389331e083302bc85ff6d06e72dd7e5c17467843

SHA512
d99870c52a2f00a978fe6b9a67b90c7ee6b820205789008c0545f93a685e8dd4da0f9e149a01d513eba7775d571a45e62eab41dd28f05f92fc1430128d7238b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
20a771d4359f84bd6a2f1b2d474938b9

SHA1
20387ae967aca2cd03c5f8c39867b9f49f636a98

SHA256
7c0ed5adf03d0ed1c7887a50798147a2a34271fb83b9839346e7068f3bee7760

SHA512
c5a51e88cba99e7eb3359b7ae2780dfed9714cd426bb53bf93f7e6cd74bf16f5bbaafcb89f16c3b770190c86120e6fdaaea30123e49b667347bf3125128bd944

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cc7f29e7a565bd7234118f27b75fcc4a

SHA1
9b1995c21b37f0e3c860c2389fdfc43d3de8f583

SHA256
e1c84f14d7862ade1497a13a74b3f26249b6a444e8ec4267b4b288e45d1b341e

SHA512
1c6320731cd1b344cc344c234b648de9950394b018d0d78ab3fcde71a3e2f0e49aedafa8f188ab01bda990da4a61b96dce55b90c9412578bc9610e283042039b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4dee783de22cf745df3aea017be02fda

SHA1
aab43e076cbf5d9befe434834b2d7222f13ebd9c

SHA256
e4a427189fcd986cf72bd9f8b6f167a16724b37cce52a3df5dee01cd0077ca3f

SHA512
bb0c46bf0c28f7811d98cf5414711707f72a442913564a08f4e9344b1c2c12368dc621b7f4543e4f7183f653485123b898a61038671b3711b8a3c985c9455aef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a317024fc7b07becebeff8ece3b4e739

SHA1
afa864616d3fd85067b79d1439325782c119d48c

SHA256
4886d057316ae7686dc8eb83e3e9d882e68e8d32418996e90c23b8bc7013c3d3

SHA512
7d2fddf8a2eda5e75d5c6d91cf036d2f9ddbb87fa5d8e54c05cfba3627b0d7464f82e697c263807440df2cfa37f5ce5384a7ee4724b27519ecc45c772013ad86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
aff81b110b826a0a69b0c6af8841d455

SHA1
d4b7137c179b9fed3b83cb7556572c27151b61bf

SHA256
c243012e729c795a9ab4332b042d621523b837bcfb31ad7ab167eca053450ea4

SHA512
e68fe1d4f31423e902f3f3d284829dcf6088299c5dd0e19348bb22777257029d3c7019b9a1fcf65449d503151e26c313c0a5f2d5cf83595314b09a122f837051

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
720ba5e84b88e2b09e2568ec04196f98

SHA1
de1c1c1ca2d8d1e377a478f5779bb9d1cc03a824

SHA256
4cb33b3d521b23656d21ed9153274cd27d3f5a4ae687b51b171e4f1bc4a9c46e

SHA512
d46101b072ad8ad7ffe6da3cc126ce5cd6f7f22dcfd89e910cd3c62ab1d1d0c03584b873714f4b68f29ef35017f83d6552144af39d2ea4aeb301c15c385264e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b698a592c807372ac064e7b49277ee9a

SHA1
137b7d6d84b722dbfa18bad92109f7511a1689bc

SHA256
1b5817eeceb565306bcbf95249a627d92bc6c0d028a1e48544d8c0dedf5a1ccf

SHA512
a8c75bd3b4d7ee96153a7bfa1530a26b282bee555976ecc6cb450d04adfd91a962e2ed9f007d5e053aa5078c59aaf2aecc309a1a88e1dd1921904850e2142ba6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ffe944a62a9bf8f7228e7d1e311f9638

SHA1
8daf9dcb02bdd1e967bf87cd07b24837da5de74c

SHA256
97f4bd87e121819edfa30895069f978580af405437104f14034a5ddc48473930

SHA512
c4740741be837763961696027dde3c6f535e4dfe8b093a08a6fbc58f3f765c6f4a674efb4e1df7f364b658f081e683ba305ab1614c9ca95d60e093c25b2be3c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ccf5.TMP

Filesize
1KB

MD5
9fa136598eb325e5afa249afe34cb209

SHA1
5a9635d09304f5c8d659385f48f00e247bf14329

SHA256
4527ac49ebce3b16bbdf5c29172f31fca3e6314653742920ff01fe9e99ab48cb

SHA512
fa0871338494d661e93c2f8c6284e3d430be5528a9d46a0787a0651d75ffb75665081899d4e71d8d81b6fc8fa3b7c9ffac7e06d7be744ad4b4c8869b894225f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5564c9139a1abd7be9eeb6eb4636575a

SHA1
3910124e4070524e23bc2d4b9d242dfdbc3ca264

SHA256
aac7d9a612b04da1f0a369cc413c18a4fe452e2d11c1b1fca0eb0b678217b93b

SHA512
14e9846291873499bf0fae48b60b4cb6b59eb7ff57ffff3c61aafb356862d55bd8e545fa0b64203742ab3a22c28e1c6d750bb13ded6bf9bf537b3fe0425b30f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7954e25b87da020f8eb02ed619715a14

SHA1
fc78baabf17f4cefee01e4d59158ac4eae2a28c1

SHA256
be467cb6870f8faa12887d9975f7faac33af0b653b77a58ce9ef8e549a6aed7a

SHA512
afd356daedc519db2d01986687d40fdeb8d751e118fb36c16272de85a9a9f4a7b96ef4d5006a6e1deac0b3b2399658afd3a68e93ebf077baea3e990d38542072

Download Submit
C:\Users\Admin\Downloads\Luna-Grabber-1.5.5-alpha.zip

Filesize
51KB

MD5
ccc607d45de5d50c71ed018b5c1012c7

SHA1
310327cb901f9ae976732ae97d0b0d021f88efd6

SHA256
74bdec0a83536cbe6a47030bb06a8a223369028b4ba9608ae1beba0107b0381f

SHA512
67954d50f0ac196b89a7decc50df1e95ecd8108d5c17acdc07f330973b3f5da5aeac934322acca5ac594a2bdfc4c9f3df8926fd15ad49a6a36d1670c41aaba66

Download Submit
C:\Users\Admin\Downloads\Luna-Grabber-1.5.5-alpha.zip:Zone.Identifier

Filesize
188B

MD5
1dd609139a90b5ff460ac3168450e617

SHA1
15da174a6d693af2f40a1dbbd022087bf673d9e1

SHA256
2df96512c814027b1e1185763573bea2ecb1b22f748305dada3de72434507ed3

SHA512
93c3baf74f0ecdc441295bf4aad9d69b320fba365810ce7b22395769367c3631d898bbf00d7b8a8cbf109697b79a79c23418425b455e89721f6a94ef31904041

Download Submit