hxxps://github[.]com/NightfallGT/Mercurial-Grabber

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/NightfallGT/Mercurial-Grabber
Sample240823-e1meraxepn

Score

7^/10

agilenet discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5508	Mercurial.exe

Obfuscated with Agile.Net obfuscator 11 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral1/memory/5508-266-0x00000000055C0000-0x00000000055DC000-memory.dmp	agile_net
behavioral1/memory/5508-267-0x0000000005790000-0x00000000057B0000-memory.dmp	agile_net
behavioral1/memory/5508-269-0x00000000057F0000-0x0000000005800000-memory.dmp	agile_net
behavioral1/memory/5508-268-0x00000000057B0000-0x00000000057D0000-memory.dmp	agile_net
behavioral1/memory/5508-270-0x0000000005800000-0x0000000005814000-memory.dmp	agile_net
behavioral1/memory/5508-271-0x0000000005810000-0x000000000587E000-memory.dmp	agile_net
behavioral1/memory/5508-272-0x0000000005890000-0x00000000058AE000-memory.dmp	agile_net
behavioral1/memory/5508-273-0x00000000058D0000-0x0000000005906000-memory.dmp	agile_net
behavioral1/memory/5508-274-0x0000000005910000-0x000000000591E000-memory.dmp	agile_net
behavioral1/memory/5508-275-0x0000000005930000-0x000000000593E000-memory.dmp	agile_net
behavioral1/memory/5508-276-0x00000000061A0000-0x00000000062EA000-memory.dmp	agile_net

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mercurial.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 32 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Mercurial.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Mercurial.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Mercurial.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	Mercurial.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Documents"	Mercurial.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Mercurial.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "3"	Mercurial.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Mercurial.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	Mercurial.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	Mercurial.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	Mercurial.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Mercurial.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e80922b16d365937a46956b92703aca08af0000	Mercurial.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	Mercurial.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Mercurial.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	Mercurial.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Mercurial.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	Mercurial.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Mercurial.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	Mercurial.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	Mercurial.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	Mercurial.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	Mercurial.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	Mercurial.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	Mercurial.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	Mercurial.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	Mercurial.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Mercurial.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	Mercurial.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Mercurial.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	Mercurial.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
4904	msedge.exe
4904	msedge.exe
3564	msedge.exe
3564	msedge.exe
3404	identity_helper.exe
3404	identity_helper.exe
4832	msedge.exe
4832	msedge.exe
5508	Mercurial.exe
5508	Mercurial.exe
5508	Mercurial.exe
5508	Mercurial.exe
5508	Mercurial.exe
5508	Mercurial.exe
5508	Mercurial.exe
5508	Mercurial.exe
5508	Mercurial.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeRestorePrivilege	5320	7zG.exe
Token: 35	5320	7zG.exe
Token: SeSecurityPrivilege	5320	7zG.exe
Token: SeSecurityPrivilege	5320	7zG.exe
Token: SeDebugPrivilege	5508	Mercurial.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
5320	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5508	Mercurial.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 3396	3564	msedge.exe	84
PID 3564 wrote to memory of 3396	3564	msedge.exe	84
PID 3564 wrote to memory of 4768	3564	msedge.exe	85
PID 3564 wrote to memory of 4768	3564	msedge.exe	85
PID 3564 wrote to memory of 4768	3564	msedge.exe	85
PID 3564 wrote to memory of 4768	3564	msedge.exe	85
PID 3564 wrote to memory of 4768	3564	msedge.exe	85
PID 3564 wrote to memory of 4768	3564	msedge.exe	85
PID 3564 wrote to memory of 4768	3564	msedge.exe	85
PID 3564 wrote to memory of 4768	3564	msedge.exe	85
PID 3564 wrote to memory of 4768	3564	msedge.exe	85
PID 3564 wrote to memory of 4768	3564	msedge.exe	85
PID 3564 wrote to memory of 4768	3564	msedge.exe	85
PID 3564 wrote to memory of 4768	3564	msedge.exe	85
PID 3564 wrote to memory of 4768	3564	msedge.exe	85
PID 3564 wrote to memory of 4768	3564	msedge.exe	85
PID 3564 wrote to memory of 4768	3564	msedge.exe	85
PID 3564 wrote to memory of 4768	3564	msedge.exe	85
PID 3564 wrote to memory of 4768	3564	msedge.exe	85
PID 3564 wrote to memory of 4768	3564	msedge.exe	85
PID 3564 wrote to memory of 4768	3564	msedge.exe	85
PID 3564 wrote to memory of 4768	3564	msedge.exe	85
PID 3564 wrote to memory of 4768	3564	msedge.exe	85
PID 3564 wrote to memory of 4768	3564	msedge.exe	85
PID 3564 wrote to memory of 4768	3564	msedge.exe	85
PID 3564 wrote to memory of 4768	3564	msedge.exe	85
PID 3564 wrote to memory of 4768	3564	msedge.exe	85
PID 3564 wrote to memory of 4768	3564	msedge.exe	85
PID 3564 wrote to memory of 4768	3564	msedge.exe	85
PID 3564 wrote to memory of 4768	3564	msedge.exe	85
PID 3564 wrote to memory of 4768	3564	msedge.exe	85
PID 3564 wrote to memory of 4768	3564	msedge.exe	85
PID 3564 wrote to memory of 4768	3564	msedge.exe	85
PID 3564 wrote to memory of 4768	3564	msedge.exe	85
PID 3564 wrote to memory of 4768	3564	msedge.exe	85
PID 3564 wrote to memory of 4768	3564	msedge.exe	85
PID 3564 wrote to memory of 4768	3564	msedge.exe	85
PID 3564 wrote to memory of 4768	3564	msedge.exe	85
PID 3564 wrote to memory of 4768	3564	msedge.exe	85
PID 3564 wrote to memory of 4768	3564	msedge.exe	85
PID 3564 wrote to memory of 4768	3564	msedge.exe	85
PID 3564 wrote to memory of 4768	3564	msedge.exe	85
PID 3564 wrote to memory of 4904	3564	msedge.exe	86
PID 3564 wrote to memory of 4904	3564	msedge.exe	86
PID 3564 wrote to memory of 2964	3564	msedge.exe	87
PID 3564 wrote to memory of 2964	3564	msedge.exe	87
PID 3564 wrote to memory of 2964	3564	msedge.exe	87
PID 3564 wrote to memory of 2964	3564	msedge.exe	87
PID 3564 wrote to memory of 2964	3564	msedge.exe	87
PID 3564 wrote to memory of 2964	3564	msedge.exe	87
PID 3564 wrote to memory of 2964	3564	msedge.exe	87
PID 3564 wrote to memory of 2964	3564	msedge.exe	87
PID 3564 wrote to memory of 2964	3564	msedge.exe	87
PID 3564 wrote to memory of 2964	3564	msedge.exe	87
PID 3564 wrote to memory of 2964	3564	msedge.exe	87
PID 3564 wrote to memory of 2964	3564	msedge.exe	87
PID 3564 wrote to memory of 2964	3564	msedge.exe	87
PID 3564 wrote to memory of 2964	3564	msedge.exe	87
PID 3564 wrote to memory of 2964	3564	msedge.exe	87
PID 3564 wrote to memory of 2964	3564	msedge.exe	87
PID 3564 wrote to memory of 2964	3564	msedge.exe	87
PID 3564 wrote to memory of 2964	3564	msedge.exe	87
PID 3564 wrote to memory of 2964	3564	msedge.exe	87
PID 3564 wrote to memory of 2964	3564	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/NightfallGT/Mercurial-Grabber
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdc8c046f8,0x7ffdc8c04708,0x7ffdc8c04718
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,10581841507660687738,1709930064045203537,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,10581841507660687738,1709930064045203537,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,10581841507660687738,1709930064045203537,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,10581841507660687738,1709930064045203537,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,10581841507660687738,1709930064045203537,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2040,10581841507660687738,1709930064045203537,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,10581841507660687738,1709930064045203537,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,10581841507660687738,1709930064045203537,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,10581841507660687738,1709930064045203537,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2040,10581841507660687738,1709930064045203537,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,10581841507660687738,1709930064045203537,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,10581841507660687738,1709930064045203537,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,10581841507660687738,1709930064045203537,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,10581841507660687738,1709930064045203537,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,10581841507660687738,1709930064045203537,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1360 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1876

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:980

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4108

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Mercurial.Grabber.v1.03\" -spe -an -ai#7zMap763:108:7zEvent31120
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5320

C:\Users\Admin\Downloads\Mercurial.Grabber.v1.03\Mercurial.exe
"C:\Users\Admin\Downloads\Mercurial.Grabber.v1.03\Mercurial.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124
MD5 e4f80e7950cbd3bb11257d2000cb885e
SHA1 10ac643904d539042d8f7aa4a312b13ec2106035
SHA512 2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa
MD5 2dc1a9f2f3f8c3cfe51bb29b078166c5
SHA1 eaf3c3dad3c8dc6f18dc3e055b415da78b704402
SHA512 682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 80213c7e4a49b727e20c6f6612e29cb7906f79810174c3d10d95c934194aae06
MD5 581b508113851bee714c0bbad27980e1
SHA1 4923153bebdf28016194f954e071211ec0456975
SHA512 8a2a7771b227ee6cfac5c6eb583b6bd8b71fc23bd702622c156c49f6d3cc1842c3923b1c40cf804be6ccbe8e70b01a891163fd3f740c4a0daf284559056485e1
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 515B
SHA256 4058bfaa8d67a4690a6932d084e513f0a8cb8d8bebc4dfe4bfa5d268d8fa2987
MD5 cba96f70688c88a69739daee69b5336b
SHA1 65306c5315f7ef051a3fa4bf49f3cab9f2f72d1a
SHA512 eb6832777148f5f6ea22ce648adb3c9b5e02ddca4ee79e5dd33f93c3e714727fae01d3200967469f9ef078e3cfb6aa3c56fc145572e462db97a1df828cf4844e
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 f8e9c3df59b87dc9fe43ed089a02fb60f9a7ff77de57a697298045cf0cc16ace
MD5 8c9f0ec1bdcda7ab49fa883e0a2fd9a4
SHA1 ad1bc5d5865242ef4891fb54eb711fd842a9b037
SHA512 bdf33f8ec1598642a0dff0e56b938c27d09755535e97d3bb8af51498e27553e9b400d4705b86b80e5409f0909968f233470186cad4fb54b1ab98c6ab7cd16058
SSDEEP 96:nkik/F0g14cTtwpvWMoiVmdeHTbZbKUWQyV+VDCziEwb:n7k/nGSGWMX/8ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 3ddaf8a6e1966536e34417674d88d41549951de6374f11b63eb5c84d5e3331c0
MD5 a4ab12612435bf6f4699aa404e661528
SHA1 75ac357e7e03fcec5205e55fb31b62dc3bb04b9c
SHA512 9616feb320c3aa79a02c5a0eac0a5cc5d36c9bcf9dcbf9e73d1482b7b7d1fef93e40d2b690f1c214b94066deff2ca84c86502650b5d21ee043f8b25d09b29ae1
SSDEEP 96:nkik/F0g14ETtwpvWMoiVmdesul1jTbAbKUWQyV+VDCAiEwb:n7k/nGaGWM8ulh/jrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 e3549ae6adaaaa87aa93c5882cd3cb218ec670ddb1c5ecee6f86f46239628016
MD5 4c78a0e991302005ca32e57af4a65a00
SHA1 9b9f22f1789fcc0e058246118892002bd5ecba00
SHA512 e208d2d91d69f3aad3f54ec5ea529a3fdbd2a24517bd52f3c6558e8e29a1087e2669d01e88b9a10d1f0458396e2ea1d37cb89019c6d4c80e04c8c7a38b7c76bb
SSDEEP 96:nkik8sQF50g14ETtwpvWMoiVmde7wBjNTbDRKUWQyV+VD7AiEwb:n7ksDGaGWMLwBp/wrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 874B
SHA256 3de3b0de9d4b5231824937080ca0dd6bcf58e5444257452d82a06f724d35e50e
MD5 74ef25e1927a75d0ce40242fcb616f43
SHA1 c7ca682952349933362e0dd233072c4b5661de5f
SHA512 3a35ca7c17a2bbede9264ecc1a7db3b8a20070cff623bc0cd9bb4ef5e64a2f93441d1324b162b8050b0420dad122ee9a81249dc7f52fb94ec5475f74ee639c4d
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 874B
SHA256 092b477381001c7f2dbff5f95d0cbf8d240f0a1681548d65f6c5dff1c6832d7c
MD5 d6f0a886513abe614162d5fa6a1a6569
SHA1 385af9dd2c0e9aceaca2582f56e1e534a839bb22
SHA512 649ed688b5af36eadf976565f755a1fdf0b485c8c258616d0e1a3a3541c72b11c03f796d85238bcd0b218ae7d5228923b7a547e225de77ab8dbebf320c50d954
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 49b9da52f99e206f010a082792baf8a2df56239b9b581b3156b91970b3ac9bb7
MD5 99c1b4fe1ab6434ae3592fadaa067052
SHA1 d6b474383714c687e70c8507960f10ee1fd70dd2
SHA512 0ea2d5285cd69fa45d70f927525b02ec2a9301bf9deb3fef2aec9edfb56235498b8660e1217850b8bcdd49cd3e597f8626fec061975ebe3936862e8e91fab549
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupUhe2RUmkjBRw5Ytj9ZklqN:A9iIxuERzA83h09RZxYU1K6kLs+5N
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 1f1445a0193c142a558a0ea520626827fde13a2f4f92e476b52405d92495a063
MD5 5d82aa9932cdc436ef89bbcb14455643
SHA1 fccedf78208417ace21dc77657586616c47d97e8
SHA512 a4c8a4f8f8505bef38558fae7d83ca470adb9e52964b6ee2d6de7b843f2cdc6edeec32365e7e839b0757088501a7e1a7eccd3121dab9af5b4a0800855ab479a5
SSDEEP 192:MoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupBhe2RUmkj1Rw5Ytj9ZklqN:89iIxuERzA83h09RZxYB1K2kLs+5N
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mercurial.exe

Path C:\Users\Admin\Downloads\Mercurial.Grabber.v1.03\Mercurial.exe
Size 3.2MB
SHA256 890fd59af3370e2ce12e0d11916d1ad4ee9b9c267c434347dbed11e9572e8645
MD5 a9477b3e21018b96fc5d2264d4016e65
SHA1 493fa8da8bf89ea773aeb282215f78219a5401b7
SHA512 66529a656865400fe37d40ae125a1d057f8be5aa17da80d367ebbe1a9dcea38f5174870d0dc5b56771f6ca5a13e2fad22d803f5357f3ef59a46e3bdf0cc5ee9c
SSDEEP 98304:5kjozJ9/im8XVBKl6t1buVfRhq+5tXzgCa/T:lzJpjS346t1bIfuq07
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unconfirmed 143464.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 143464.crdownload
Size 2.9MB
SHA256 3759744039346620e9613f40f90e8f318e5f54ad49c070e2bd23b667f7e65bf6
MD5 635903bad1ada856d701f34d3070ccd9
SHA1 3ff98d91b9a3a47bf9f64bdf161efb9c5ac99fb0
SHA512 fee2c64124c47bcb1251b7b87969a1ff493e24bc196633e3a301565b126f5ed2e2967d4d1426ff5d9be9466c852bacf405229308acf946368e00ca887a4ef015
SSDEEP 49152:lYtbFd+FwSjhWaqv7yBSw9i4b1g8lDZxu0TR9TlqdqjxaNOH:qkwSVef4NDW8qEfH
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/5508-263-0x0000000005BA0000-0x0000000006144000-memory.dmp

Download

memory/5508-272-0x0000000005890000-0x00000000058AE000-memory.dmp

Download

memory/5508-265-0x0000000005540000-0x000000000554A000-memory.dmp

Download

memory/5508-266-0x00000000055C0000-0x00000000055DC000-memory.dmp

Download

memory/5508-267-0x0000000005790000-0x00000000057B0000-memory.dmp

Download

memory/5508-269-0x00000000057F0000-0x0000000005800000-memory.dmp

Download

memory/5508-268-0x00000000057B0000-0x00000000057D0000-memory.dmp

Download

memory/5508-270-0x0000000005800000-0x0000000005814000-memory.dmp

Download

memory/5508-271-0x0000000005810000-0x000000000587E000-memory.dmp

Download

memory/5508-264-0x00000000055F0000-0x0000000005682000-memory.dmp

Download

memory/5508-273-0x00000000058D0000-0x0000000005906000-memory.dmp

Download

memory/5508-274-0x0000000005910000-0x000000000591E000-memory.dmp

Download

memory/5508-275-0x0000000005930000-0x000000000593E000-memory.dmp

Download

memory/5508-276-0x00000000061A0000-0x00000000062EA000-memory.dmp

Download

memory/5508-277-0x00000000062F0000-0x0000000006406000-memory.dmp

Download

memory/5508-278-0x0000000006160000-0x0000000006190000-memory.dmp

Download

memory/5508-279-0x0000000008F50000-0x0000000008F58000-memory.dmp

Download

memory/5508-262-0x0000000000800000-0x0000000000B3A000-memory.dmp

Download