8f1373d68141153fd199fe865bd31c8052798fbb46316fb30615c0e36ee67107

Resubmissions

22-08-2024 12:33

240822-prdrcsxbph 3

22-08-2024 12:31

240822-pqa9vazdqp 8

22-08-2024 12:28

240822-pnejgsxamc 8

22-08-2024 12:24

240822-plfzjawhld 3

Analysis

max time kernel
55s
max time network
53s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
22-08-2024 12:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IMG_20240403_100446.jpg
Size

151KB
MD5

c831ea5e71a02f0385cdfbb21a7f7a13
SHA1

4430b664552e60813b24df402bfd98e8e240bb15
SHA256

8f1373d68141153fd199fe865bd31c8052798fbb46316fb30615c0e36ee67107
SHA512

176f89f164e522c8585ccd50579089b77a1a6be5e02b6081289d25811ec39789710b24cced27384df2f6ceb35d53a2db5e361179581dce7888344cd6c51731e9
SSDEEP

3072:HIEGfnX3ag2n/nau9MhVAtIveKBzXEqbq5YZI8xX4tHG4xiN:HIBy/ausAt6egzXEqVe8OHGV

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
1816	CreepyDestruct DEMO.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
55	raw.githubusercontent.com
56	raw.githubusercontent.com
62	raw.githubusercontent.com

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\CreepyDestruct DEMO.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreepyDestruct DEMO.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2227988167-2813779459-4240799794-1000\{39DF4026-203C-41A9-9727-FED54D14F855}	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 671027.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\CreepyDestruct DEMO.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1948	msedge.exe
1948	msedge.exe
2616	msedge.exe
2616	msedge.exe
324	msedge.exe
324	msedge.exe
1908	identity_helper.exe
1908	identity_helper.exe
3380	msedge.exe
3380	msedge.exe
1152	msedge.exe
1152	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1816	CreepyDestruct DEMO.exe
1816	CreepyDestruct DEMO.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 4800	1948	msedge.exe	86
PID 1948 wrote to memory of 4800	1948	msedge.exe	86
PID 1948 wrote to memory of 1040	1948	msedge.exe	87
PID 1948 wrote to memory of 1040	1948	msedge.exe	87
PID 1948 wrote to memory of 1040	1948	msedge.exe	87
PID 1948 wrote to memory of 1040	1948	msedge.exe	87
PID 1948 wrote to memory of 1040	1948	msedge.exe	87
PID 1948 wrote to memory of 1040	1948	msedge.exe	87
PID 1948 wrote to memory of 1040	1948	msedge.exe	87
PID 1948 wrote to memory of 1040	1948	msedge.exe	87
PID 1948 wrote to memory of 1040	1948	msedge.exe	87
PID 1948 wrote to memory of 1040	1948	msedge.exe	87
PID 1948 wrote to memory of 1040	1948	msedge.exe	87
PID 1948 wrote to memory of 1040	1948	msedge.exe	87
PID 1948 wrote to memory of 1040	1948	msedge.exe	87
PID 1948 wrote to memory of 1040	1948	msedge.exe	87
PID 1948 wrote to memory of 1040	1948	msedge.exe	87
PID 1948 wrote to memory of 1040	1948	msedge.exe	87
PID 1948 wrote to memory of 1040	1948	msedge.exe	87
PID 1948 wrote to memory of 1040	1948	msedge.exe	87
PID 1948 wrote to memory of 1040	1948	msedge.exe	87
PID 1948 wrote to memory of 1040	1948	msedge.exe	87
PID 1948 wrote to memory of 1040	1948	msedge.exe	87
PID 1948 wrote to memory of 1040	1948	msedge.exe	87
PID 1948 wrote to memory of 1040	1948	msedge.exe	87
PID 1948 wrote to memory of 1040	1948	msedge.exe	87
PID 1948 wrote to memory of 1040	1948	msedge.exe	87
PID 1948 wrote to memory of 1040	1948	msedge.exe	87
PID 1948 wrote to memory of 1040	1948	msedge.exe	87
PID 1948 wrote to memory of 1040	1948	msedge.exe	87
PID 1948 wrote to memory of 1040	1948	msedge.exe	87
PID 1948 wrote to memory of 1040	1948	msedge.exe	87
PID 1948 wrote to memory of 1040	1948	msedge.exe	87
PID 1948 wrote to memory of 1040	1948	msedge.exe	87
PID 1948 wrote to memory of 1040	1948	msedge.exe	87
PID 1948 wrote to memory of 1040	1948	msedge.exe	87
PID 1948 wrote to memory of 1040	1948	msedge.exe	87
PID 1948 wrote to memory of 1040	1948	msedge.exe	87
PID 1948 wrote to memory of 1040	1948	msedge.exe	87
PID 1948 wrote to memory of 1040	1948	msedge.exe	87
PID 1948 wrote to memory of 1040	1948	msedge.exe	87
PID 1948 wrote to memory of 1040	1948	msedge.exe	87
PID 1948 wrote to memory of 2616	1948	msedge.exe	88
PID 1948 wrote to memory of 2616	1948	msedge.exe	88
PID 1948 wrote to memory of 3260	1948	msedge.exe	89
PID 1948 wrote to memory of 3260	1948	msedge.exe	89
PID 1948 wrote to memory of 3260	1948	msedge.exe	89
PID 1948 wrote to memory of 3260	1948	msedge.exe	89
PID 1948 wrote to memory of 3260	1948	msedge.exe	89
PID 1948 wrote to memory of 3260	1948	msedge.exe	89
PID 1948 wrote to memory of 3260	1948	msedge.exe	89
PID 1948 wrote to memory of 3260	1948	msedge.exe	89
PID 1948 wrote to memory of 3260	1948	msedge.exe	89
PID 1948 wrote to memory of 3260	1948	msedge.exe	89
PID 1948 wrote to memory of 3260	1948	msedge.exe	89
PID 1948 wrote to memory of 3260	1948	msedge.exe	89
PID 1948 wrote to memory of 3260	1948	msedge.exe	89
PID 1948 wrote to memory of 3260	1948	msedge.exe	89
PID 1948 wrote to memory of 3260	1948	msedge.exe	89
PID 1948 wrote to memory of 3260	1948	msedge.exe	89
PID 1948 wrote to memory of 3260	1948	msedge.exe	89
PID 1948 wrote to memory of 3260	1948	msedge.exe	89
PID 1948 wrote to memory of 3260	1948	msedge.exe	89
PID 1948 wrote to memory of 3260	1948	msedge.exe	89

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20240403_100446.jpg
1⤵
PID:2720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd866e3cb8,0x7ffd866e3cc8,0x7ffd866e3cd8
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,11600643734363998481,2360301774685140909,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,11600643734363998481,2360301774685140909,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,11600643734363998481,2360301774685140909,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,11600643734363998481,2360301774685140909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,11600643734363998481,2360301774685140909,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,11600643734363998481,2360301774685140909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,11600643734363998481,2360301774685140909,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,11600643734363998481,2360301774685140909,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3372 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,11600643734363998481,2360301774685140909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,11600643734363998481,2360301774685140909,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,11600643734363998481,2360301774685140909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,11600643734363998481,2360301774685140909,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,11600643734363998481,2360301774685140909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,11600643734363998481,2360301774685140909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,11600643734363998481,2360301774685140909,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1900,11600643734363998481,2360301774685140909,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4788 /prefetch:8
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1900,11600643734363998481,2360301774685140909,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,11600643734363998481,2360301774685140909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3972 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,11600643734363998481,2360301774685140909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4516 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,11600643734363998481,2360301774685140909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,11600643734363998481,2360301774685140909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1900,11600643734363998481,2360301774685140909,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6068 /prefetch:8
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1900,11600643734363998481,2360301774685140909,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1152
- C:\Users\Admin\Downloads\CreepyDestruct DEMO.exe
  "C:\Users\Admin\Downloads\CreepyDestruct DEMO.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1816

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e2612636cf368bc811fdc8db09e037d

SHA1
d69e34379f97e35083f4c4ea1249e6f1a5f51d56

SHA256
2eecaacf3f2582e202689a16b0ac1715c628d32f54261671cf67ba6abbf6c9f9

SHA512
b3cc3bf967d014f522e6811448c4792eed730e72547f83eb4974e832e958deb7e7f4c3ce8e0ed6f9c110525d0b12f7fe7ab80a914c2fe492e1f2d321ef47f96d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e8115549491cca16e7bfdfec9db7f89a

SHA1
d1eb5c8263cbe146cd88953bb9886c3aeb262742

SHA256
dfa9a8b54936607a5250bec0ed3e2a24f96f4929ca550115a91d0d5d68e4d08e

SHA512
851207c15de3531bd230baf02a8a96550b81649ccbdd44ad74875d97a700271ef96e8be6e1c95b2a0119561aee24729cb55c29eb0b3455473688ef9132ed7f54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
e4e3c749330ee574ea594c035d4f8fb2

SHA1
795576311687b103b06d3dd6e71636d61e963985

SHA256
901a0b95e944aed73c61ac54b1941a9fe7299400555c34b4dd231713db9e51de

SHA512
f6b61977b3741fe137323b4d326bf2aa1801688e10716a3d03f0ccf6de5931ff1354a590d602eaf537e68f37bf6ab586153cf8fb8de18f4314be5cc2bd5d3e78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a1c90a08eee9e4d202793b3ab8d63861

SHA1
36a337cf18713b888f0d4e940bc21adb9392b394

SHA256
1b80c2c64d6a66cb2bb8b7111a76aced8e4b1601aa678cbf905d4cd53786d11b

SHA512
e376cf099209025f2b96025c47d7cccfbd123c57b5fe5b0520f4c55a2ab3133f80a56c195766c011372a19f2bf1c166bc1995ac8bcd98ac46dde8545da69b52e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e534fb0efee6f96597d2e1b5fc51197d

SHA1
d12a3859082318d9dcdb473e2940cf0a3044acae

SHA256
7f340223fc0a2b64242e6e249919eb82410083e0194e6274b2cc87f43dfd7073

SHA512
7abb66139acff435edca88711f295fb9cd2d112b873ef8c5d3860dbf95fac0c30de77a1fee56e72ca4844d3c28dcc3e135a60ccb01458a12882fb0f56687b524

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9a80d1229539b7f9443a225d3f71dad0

SHA1
edb8e786e789670366a7497e6df1aab865823f6e

SHA256
077ccc5362133d914b9b5d9a37e58469d6d73a9895aeed3685eadd0b01bf65e0

SHA512
deee43fae69f8846741ab30efdebadd34aeddad3e203f2deeec62fd186384651856ac283349e9de410c7e8950073d6bc575fb3ecb0d247a25b80867f293ce408

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b6176e56198580dac09f6a32a7d37fd8

SHA1
dcaa33b37396559711dc963dfbed39781af28a82

SHA256
71b6135ded37910ee9c05f0706db2344a0623ff692b6cc1cc7b438a213013a42

SHA512
214a9b8e04a2f829491db2058429daa07b02b4492fdcf12bf00edb92ab7314839b37701a3500474d3b69150c315b442d68aaa3538bd79564c42c4ee31b506dd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5830df.TMP

Filesize
1KB

MD5
a6e4fc077089d96659c4ae4009cedf99

SHA1
04a566f42a598c7ff6d5ba92a2e082bd27f82872

SHA256
e8f92860678c70217a8e87cc49ec54bc7495a3482fe934cc14d98613cc07b8fd

SHA512
154df2de6a37274891e5f479ab3bee2a44e52124ea8e1e9fd6217d1ea86e2d0a4aa301dbba03928dbe6e194fee67fa1af73471d920e4196690ac0c9131835b27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0f4de98d857b835fa3fdeb82ba895fc3

SHA1
1ab11e12e65ea9ff6cae0d931b57d466c701ce8b

SHA256
1a285d8ea30f3635be4f51d7094e0e278ce5e1a6ef200a8befdeb4bb799f4217

SHA512
9c2e6227fb760696d377834fc0f690af891c4f3c238ff5d49832a850d79c8b9688c1e036d299ab2a8dcd327783098531efdeb986205a99afecff02c6502121ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d2188b72f4d921482032ce373791e563

SHA1
2fde8d8b4dc133edc60186d316244048c079ebca

SHA256
9ab82fdf8d2570b793324d58008d230ac2c02af2d441dc91e6a5fcfefd71dbf2

SHA512
1e8c3def1e8ecad6cdfb80476f6285d37617b27d9bf2625ef0fff5ff1bd6f93f74567e28a9ebbd7731f69802fc5a3023e6673c1309040642ca74918770aa8887

Download Submit
C:\Users\Admin\Downloads\CreepyDestruct DEMO.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 671027.crdownload

Filesize
3.3MB

MD5
45fa2816fd9490821cb04240953ac1ef

SHA1
85bbe980c85686d869223cd0a38a8e660334c265

SHA256
24e4426770ba99198dfb9241402468c08fe5e80470fe3cbef353743d4ab6c35a

SHA512
1c83077aec1888e1de26b1c19414e3de47322ab067351ef044f042d96e33fd82f22f78db206ef56a01559e8e6f1e8dbb537e4d4af2cbcabb725cb82d67f4c278

Download Submit