limerat | 62d8ea970a9efd1beee95e835087648f401f1837d28f7ab805c0e75e5432e87d

Analysis

max time kernel
139s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-10-2024 22:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

62d8ea970a9efd1beee95e835087648f401f1837d28f7ab805c0e75e5432e87d.exe
Size

1.1MB
MD5

02142683680b38f68f401846f3a52f65
SHA1

157bbe25a752be3b91f2a65d2761b048ed312a36
SHA256

62d8ea970a9efd1beee95e835087648f401f1837d28f7ab805c0e75e5432e87d
SHA512

f7a10bd9e55c74e0e6f124ab0ad9823379b2ab9f089e21c18fa4e2b2a660363aa51fcd2729c62329c4d2a286d406ea792d37cb599e39cae870d0b3f9da3f467e
SSDEEP

6144:BPsHNEssgUq82IvtmxTJLTVpEcejwCDZW9uVRWJ+omWOGZIieG:bmVJLRacsWcG

Score

10^/10

limerat discovery rat

Malware Config

Extracted

Family

limerat

Attributes

aes_key
Estelionato Digital
antivm
false
c2_url
https://pastebin.com/raw/ntJXRvq3
delay
3
download_payload
false
install
true
install_name
svchost.exe
main_folder
Temp
pin_spread
false
sub_folder
\System\
usb_spread
true

Signatures

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	62d8ea970a9efd1beee95e835087648f401f1837d28f7ab805c0e75e5432e87d.exe
File opened (read-only)	\??\M:	62d8ea970a9efd1beee95e835087648f401f1837d28f7ab805c0e75e5432e87d.exe
File opened (read-only)	\??\S:	62d8ea970a9efd1beee95e835087648f401f1837d28f7ab805c0e75e5432e87d.exe
File opened (read-only)	\??\Z:	62d8ea970a9efd1beee95e835087648f401f1837d28f7ab805c0e75e5432e87d.exe
File opened (read-only)	\??\V:	62d8ea970a9efd1beee95e835087648f401f1837d28f7ab805c0e75e5432e87d.exe
File opened (read-only)	\??\X:	62d8ea970a9efd1beee95e835087648f401f1837d28f7ab805c0e75e5432e87d.exe
File opened (read-only)	\??\B:	62d8ea970a9efd1beee95e835087648f401f1837d28f7ab805c0e75e5432e87d.exe
File opened (read-only)	\??\G:	62d8ea970a9efd1beee95e835087648f401f1837d28f7ab805c0e75e5432e87d.exe
File opened (read-only)	\??\K:	62d8ea970a9efd1beee95e835087648f401f1837d28f7ab805c0e75e5432e87d.exe
File opened (read-only)	\??\N:	62d8ea970a9efd1beee95e835087648f401f1837d28f7ab805c0e75e5432e87d.exe
File opened (read-only)	\??\O:	62d8ea970a9efd1beee95e835087648f401f1837d28f7ab805c0e75e5432e87d.exe
File opened (read-only)	\??\Y:	62d8ea970a9efd1beee95e835087648f401f1837d28f7ab805c0e75e5432e87d.exe
File opened (read-only)	\??\H:	62d8ea970a9efd1beee95e835087648f401f1837d28f7ab805c0e75e5432e87d.exe
File opened (read-only)	\??\P:	62d8ea970a9efd1beee95e835087648f401f1837d28f7ab805c0e75e5432e87d.exe
File opened (read-only)	\??\Q:	62d8ea970a9efd1beee95e835087648f401f1837d28f7ab805c0e75e5432e87d.exe
File opened (read-only)	\??\T:	62d8ea970a9efd1beee95e835087648f401f1837d28f7ab805c0e75e5432e87d.exe
File opened (read-only)	\??\W:	62d8ea970a9efd1beee95e835087648f401f1837d28f7ab805c0e75e5432e87d.exe
File opened (read-only)	\??\U:	62d8ea970a9efd1beee95e835087648f401f1837d28f7ab805c0e75e5432e87d.exe
File opened (read-only)	\??\A:	62d8ea970a9efd1beee95e835087648f401f1837d28f7ab805c0e75e5432e87d.exe
File opened (read-only)	\??\E:	62d8ea970a9efd1beee95e835087648f401f1837d28f7ab805c0e75e5432e87d.exe
File opened (read-only)	\??\I:	62d8ea970a9efd1beee95e835087648f401f1837d28f7ab805c0e75e5432e87d.exe
File opened (read-only)	\??\L:	62d8ea970a9efd1beee95e835087648f401f1837d28f7ab805c0e75e5432e87d.exe
File opened (read-only)	\??\R:	62d8ea970a9efd1beee95e835087648f401f1837d28f7ab805c0e75e5432e87d.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2152 set thread context of 1420	2152	62d8ea970a9efd1beee95e835087648f401f1837d28f7ab805c0e75e5432e87d.exe	87

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	62d8ea970a9efd1beee95e835087648f401f1837d28f7ab805c0e75e5432e87d.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	62d8ea970a9efd1beee95e835087648f401f1837d28f7ab805c0e75e5432e87d.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3104	msedge.exe
3104	msedge.exe
2964	msedge.exe
2964	msedge.exe
5068	identity_helper.exe
5068	identity_helper.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2152	62d8ea970a9efd1beee95e835087648f401f1837d28f7ab805c0e75e5432e87d.exe
Token: SeCreatePagefilePrivilege	2152	62d8ea970a9efd1beee95e835087648f401f1837d28f7ab805c0e75e5432e87d.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2152	62d8ea970a9efd1beee95e835087648f401f1837d28f7ab805c0e75e5432e87d.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 1420	2152	62d8ea970a9efd1beee95e835087648f401f1837d28f7ab805c0e75e5432e87d.exe	87
PID 2152 wrote to memory of 1420	2152	62d8ea970a9efd1beee95e835087648f401f1837d28f7ab805c0e75e5432e87d.exe	87
PID 2152 wrote to memory of 1420	2152	62d8ea970a9efd1beee95e835087648f401f1837d28f7ab805c0e75e5432e87d.exe	87
PID 2152 wrote to memory of 1420	2152	62d8ea970a9efd1beee95e835087648f401f1837d28f7ab805c0e75e5432e87d.exe	87
PID 2152 wrote to memory of 1420	2152	62d8ea970a9efd1beee95e835087648f401f1837d28f7ab805c0e75e5432e87d.exe	87
PID 2152 wrote to memory of 1420	2152	62d8ea970a9efd1beee95e835087648f401f1837d28f7ab805c0e75e5432e87d.exe	87
PID 2152 wrote to memory of 1420	2152	62d8ea970a9efd1beee95e835087648f401f1837d28f7ab805c0e75e5432e87d.exe	87
PID 2152 wrote to memory of 1420	2152	62d8ea970a9efd1beee95e835087648f401f1837d28f7ab805c0e75e5432e87d.exe	87
PID 1420 wrote to memory of 2964	1420	62d8ea970a9efd1beee95e835087648f401f1837d28f7ab805c0e75e5432e87d.EXE	96
PID 1420 wrote to memory of 2964	1420	62d8ea970a9efd1beee95e835087648f401f1837d28f7ab805c0e75e5432e87d.EXE	96
PID 2964 wrote to memory of 1480	2964	msedge.exe	97
PID 2964 wrote to memory of 1480	2964	msedge.exe	97
PID 2964 wrote to memory of 4388	2964	msedge.exe	98
PID 2964 wrote to memory of 4388	2964	msedge.exe	98
PID 2964 wrote to memory of 4388	2964	msedge.exe	98
PID 2964 wrote to memory of 4388	2964	msedge.exe	98
PID 2964 wrote to memory of 4388	2964	msedge.exe	98
PID 2964 wrote to memory of 4388	2964	msedge.exe	98
PID 2964 wrote to memory of 4388	2964	msedge.exe	98
PID 2964 wrote to memory of 4388	2964	msedge.exe	98
PID 2964 wrote to memory of 4388	2964	msedge.exe	98
PID 2964 wrote to memory of 4388	2964	msedge.exe	98
PID 2964 wrote to memory of 4388	2964	msedge.exe	98
PID 2964 wrote to memory of 4388	2964	msedge.exe	98
PID 2964 wrote to memory of 4388	2964	msedge.exe	98
PID 2964 wrote to memory of 4388	2964	msedge.exe	98
PID 2964 wrote to memory of 4388	2964	msedge.exe	98
PID 2964 wrote to memory of 4388	2964	msedge.exe	98
PID 2964 wrote to memory of 4388	2964	msedge.exe	98
PID 2964 wrote to memory of 4388	2964	msedge.exe	98
PID 2964 wrote to memory of 4388	2964	msedge.exe	98
PID 2964 wrote to memory of 4388	2964	msedge.exe	98
PID 2964 wrote to memory of 4388	2964	msedge.exe	98
PID 2964 wrote to memory of 4388	2964	msedge.exe	98
PID 2964 wrote to memory of 4388	2964	msedge.exe	98
PID 2964 wrote to memory of 4388	2964	msedge.exe	98
PID 2964 wrote to memory of 4388	2964	msedge.exe	98
PID 2964 wrote to memory of 4388	2964	msedge.exe	98
PID 2964 wrote to memory of 4388	2964	msedge.exe	98
PID 2964 wrote to memory of 4388	2964	msedge.exe	98
PID 2964 wrote to memory of 4388	2964	msedge.exe	98
PID 2964 wrote to memory of 4388	2964	msedge.exe	98
PID 2964 wrote to memory of 4388	2964	msedge.exe	98
PID 2964 wrote to memory of 4388	2964	msedge.exe	98
PID 2964 wrote to memory of 4388	2964	msedge.exe	98
PID 2964 wrote to memory of 4388	2964	msedge.exe	98
PID 2964 wrote to memory of 4388	2964	msedge.exe	98
PID 2964 wrote to memory of 4388	2964	msedge.exe	98
PID 2964 wrote to memory of 4388	2964	msedge.exe	98
PID 2964 wrote to memory of 4388	2964	msedge.exe	98
PID 2964 wrote to memory of 4388	2964	msedge.exe	98
PID 2964 wrote to memory of 4388	2964	msedge.exe	98
PID 2964 wrote to memory of 3104	2964	msedge.exe	99
PID 2964 wrote to memory of 3104	2964	msedge.exe	99
PID 2964 wrote to memory of 2772	2964	msedge.exe	100
PID 2964 wrote to memory of 2772	2964	msedge.exe	100
PID 2964 wrote to memory of 2772	2964	msedge.exe	100
PID 2964 wrote to memory of 2772	2964	msedge.exe	100
PID 2964 wrote to memory of 2772	2964	msedge.exe	100
PID 2964 wrote to memory of 2772	2964	msedge.exe	100
PID 2964 wrote to memory of 2772	2964	msedge.exe	100
PID 2964 wrote to memory of 2772	2964	msedge.exe	100
PID 2964 wrote to memory of 2772	2964	msedge.exe	100
PID 2964 wrote to memory of 2772	2964	msedge.exe	100

C:\Users\Admin\AppData\Local\Temp\62d8ea970a9efd1beee95e835087648f401f1837d28f7ab805c0e75e5432e87d.exe
"C:\Users\Admin\AppData\Local\Temp\62d8ea970a9efd1beee95e835087648f401f1837d28f7ab805c0e75e5432e87d.exe"
1⤵
- Enumerates connected drives
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Users\Admin\AppData\Local\Temp\62d8ea970a9efd1beee95e835087648f401f1837d28f7ab805c0e75e5432e87d.EXE
  "C:\Users\Admin\AppData\Local\Temp\62d8ea970a9efd1beee95e835087648f401f1837d28f7ab805c0e75e5432e87d.EXE"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=62d8ea970a9efd1beee95e835087648f401f1837d28f7ab805c0e75e5432e87d.EXE&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x100,0xfc,0x104,0xd8,0x7ffcbd5546f8,0x7ffcbd554708,0x7ffcbd554718
      4⤵
      PID:1480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,11920358090334007164,10911119784087697501,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
      4⤵
      PID:4388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,11920358090334007164,10911119784087697501,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,11920358090334007164,10911119784087697501,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
      4⤵
      PID:2772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11920358090334007164,10911119784087697501,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
      4⤵
      PID:3880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11920358090334007164,10911119784087697501,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
      4⤵
      PID:1988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11920358090334007164,10911119784087697501,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
      4⤵
      PID:2000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,11920358090334007164,10911119784087697501,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
      4⤵
      PID:3108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,11920358090334007164,10911119784087697501,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11920358090334007164,10911119784087697501,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
      4⤵
      PID:2764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11920358090334007164,10911119784087697501,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
      4⤵
      PID:1800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11920358090334007164,10911119784087697501,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:1
      4⤵
      PID:540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11920358090334007164,10911119784087697501,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
      4⤵
      PID:3276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11920358090334007164,10911119784087697501,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
      4⤵
      PID:1036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11920358090334007164,10911119784087697501,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
      4⤵
      PID:1572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,11920358090334007164,10911119784087697501,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3168 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=62d8ea970a9efd1beee95e835087648f401f1837d28f7ab805c0e75e5432e87d.EXE&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
    3⤵
    PID:1832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcbd5546f8,0x7ffcbd554708,0x7ffcbd554718
      4⤵
      PID:4584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
1959ef7c020002d9da6b2526cecf310f

SHA1
43f18910d79a6b2c8daae8eb26c89cbc4a38f03a

SHA256
a7eed27c3c0c49ffb843c6edae9fb349c0ee5c8b4543b40742ce75f04f1c5861

SHA512
057310a87c154ed76692e26ba0c52186af98d845a622d39b3adb36cbdb6acb6b28d0f1038b22e4bd531613f1e6243943a41d355a7893f8b39df498cab7d0dfd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2d83c1bbfa49594f7d9a2aa16a0374b6

SHA1
1468c8ea5d5e8b997e85711f2422924eceadce7d

SHA256
3dec3c3b0c3041701678366a4552b5438584bc78dd3f44ca6f5e2d42461193d9

SHA512
b137d26135a7adf03b45f3d87c9bc09a150c91ee71e34b4579cda32a673a1ac05bf4998750e09e22466fb8a2ffd1ddd9157583274acedab512330ccb6ffde046

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a452f8dbc0165bb3e1f8115d319b4294

SHA1
3a7d2e908c839a742effcdb6c2f33eb58fa017fb

SHA256
3b96b7ea52e194fce8e8874e97eb15f3416a2444c806c77bf9bd105ecd7e91f1

SHA512
359112117f6be340633ddd263aff35a87132e168fd3f5e7390b7eaddbfab82d5ee70feddc54a2e5a170f8be32271d6997e5ad0e6d9c4fa42d45765c05e48847e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1be64786490876e1b756fc2b532fbe5b

SHA1
4830d9bdc50504dd8dce613f1f4fccef5ccf6094

SHA256
93039ceff4553db761bedea4a0ea4fe3ffa8dc970ba86608f5b8be4e413e42c7

SHA512
8a47dc8ff7d18d0f646db3bf5add6b124b6a291c363580b527a3cf160f4a57305619b0b28487d88e07d989b91f287b9cb3b10bccaae00ed2712309815512b6ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
aff08ce91752ea601fe4b078aa32df24

SHA1
c2d889133f54541f8b365e814476dccdc4d25e0c

SHA256
d959d697df5d64eb270faa2cd68429f9cfb41d6e992e039d70d10e6d078791e7

SHA512
8edaca52059fcc12d4dacc022b877c6c7ce08f310b3ecdd9ab4cdbb2377d2c30ebf404e63e7299c509ce7c155450c53a8902188e143473d69577b18b6f0595d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e0bb.TMP

Filesize
371B

MD5
c63abe40ff6e62c15eb310b5f39516ae

SHA1
faedb0504f3775718a1e2c38abb4dff32ab8f9a6

SHA256
22ae8143d94f4d76a705797f406466ffbb52bd5d1a3b205deb308e983b34c5d5

SHA512
0c1f7a77b15700c7c8450395cd4d9456cd188ad353fb8fa845d2b768506f8e9b945542bf51c135d1eb4dc9219d99bf87ba4f9ab9e867d83ad73a181aec47a0e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9a979a1005a0af081e5216466bb6f054

SHA1
e6ea573708e9802c7aee88d2db4c87fb185ef674

SHA256
76fdf43e473f93fcd45b71acfa211dfd439b7c001ba1140bd3f19927700cffc4

SHA512
dad7624c4bd017e55d30ad237ee94507d124e4467bd2621beb4206e23dbfb56d14b7bfedeb468f4473c529e57cdab6a332d6a9b8525a65b56fb6554b3e30c68a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
memory/1420-12-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download