RAT

Mouse Without Borders

Mouse Without Borders is a Microsoft Garage utility that lets you control up to four Windows computers with a single keyboard and mouse, with clipboard sharing and simple drag-and-drop file transfers. **IMPORTANT**: This tool is signed with legitimate Microsoft Corporation certificates that are also used to sign numerous other Microsoft products and Windows components. Do NOT blindly block these certificate thumbprints as doing so will likely break essential Windows functionality and other Microsoft applications in your environment. Use certificate data for detection, hunting, and analysis purposes only.

Visit tool website ↗Download JSON ↓View source YAML ↗Suggest an update ↗

Tool overview

Category: RAT
Research authors: Microsoft
Created: 2011-09-12
Last modified: 2011-09-12
Privileges: User; optional Service Mode for elevated apps
Free / availability: Yes
Verification required: Yes
Supported platforms: Windows

Capabilities

Multi-computer input sharingClipboard sharingDrag-and-drop file transfer (up to 100 MB)Optional service for elevated app control

Executables & installation paths

Filename: MouseWithoutBorders.exe
OriginalFileName: MouseWithoutBorders.exe
Description: Mouse Without Borders
Product: Mouse Without Borders

Installation paths

C:\Program Files (x86)\Microsoft Garage\Mouse without Borders\*

Code signing

signer name: Microsoft Corporation
certificate thumbprint: F5877012FBD62FABCBDC8D8CEE9C9585BA30DF79
src file sha256: bf283be664cacfb08009f3996a7907fccebf7e0502652ef40582d64238fdfe22
src file path: downloaded_files/mouse_without_borders/bf283be664cacfb08009f3996a7907fccebf7e0502652ef40582d64238fdfe22
src file company: Microsoft Corporation

signer name: Microsoft Corporation
certificate thumbprint: 3F56A45111684D454E231CFDC4DA5C8D370F9816
src file sha256: f4b2e2dac7ba4458f79e7333d093b5259c18300ad201bfcb9b4674c00109815d
src file path: downloaded_files/mouse_without_borders/f4b2e2dac7ba4458f79e7333d093b5259c18300ad201bfcb9b4674c00109815d
src file company: Microsoft Corporation

FORENSIC EVIDENCE

Disk artifacts

File

C:\Program Files (x86)\Microsoft Garage\Mouse without Borders\MouseWithoutBorders.exe

Description

Main application binary

OS

Windows

Example

SHA256: 0DE3E5D76E1359EEA6AAAD2A37F8D787CF4E1D686C4AB45C8221556CF5982BA1

File

C:\Program Files (x86)\Microsoft Garage\Mouse without Borders\MouseWithoutBordersSvc.exe

Description

Optional service binary when Service Mode is enabled

OS

Windows

Example

SHA256: D65D44126E2327891BA426A09471DF0564456A9B37AAD8B3453D2D5B06F6AEF3

File

C:\Program Files (x86)\Microsoft Garage\Mouse without Borders\MouseWithoutBordersHelper.exe

Description

Helper executable used by Mouse Without Borders

OS

Windows

Example

SHA256: D7E8F30B3F87373E89E8DEC1273F161C478E621E2450279A01A3D0914D754B4F

FORENSIC EVIDENCE

Event log artifacts

EventID: 7045
ProviderName: Service Control Manager
LogFile: System.evtx
ServiceName: Mouse without Borders Service
ImagePath: C:\Program Files (x86)\Microsoft Garage\Mouse without Borders\MouseWithoutBordersSvc.exe
Description: Service installed (user mode service), auto start, account LocalSystem

FORENSIC EVIDENCE

Network artifacts

Description

Peer discovery and control traffic

Domains

Not recorded

Ports

15100
15101

Detections

Sigma: https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/mouse_without_borders_files_sigma.yml
Description: Detects potential files activity of Mouse Without Borders RMM tool

References

Acknowledgements

Person: Michael Haag