Analysis

  • max time kernel
    601s
  • max time network
    601s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241023-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    20-11-2024 19:33

General

  • Target

    CrystalSiege.exe

  • Size

    154.6MB

  • MD5

    ff881bc6d9f56f353232a177575d0f1f

  • SHA1

    9d2fea770f59f05a6480a5f8915227bc6457f74c

  • SHA256

    690323b53f29fd18687a9049d7c4c26cb8346a8a4b65c51660a55ae6141f4dab

  • SHA512

    e5bdda697e1572c969081548a84d3553fcd3ea45395eb0de2ae9f0f91308fd54edf0eb222d1d8cb99a12e83196cb3364488e86ebc4991eb63937dd7a1662fc5e

  • SSDEEP

    1572864:gTmw0ciLNpDPuAvHxJLkY2O6Ea3f9kwZXeT6EivLp1vUAtdjtZn+f4FnIvGaC9dU:Tv6E70+Mk

Malware Config

Signatures

  • Hexon family
  • Hexon stealer

    Hexon is a stealer written in Electron NodeJS.

  • Uses browser remote debugging 2 TTPs 9 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates processes with tasklist 1 TTPs 7 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Kills process with taskkill 9 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
    "C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4020
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1844
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic csproduct get uuid
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:460
    • C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
      "C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1900 --field-trial-handle=1908,i,67054989044691770,2461890687055012515,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      2⤵
        PID:536
      • C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
        "C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\unrealgame" --mojo-platform-channel-handle=2080 --field-trial-handle=1908,i,67054989044691770,2461890687055012515,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:1680
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:720
        • C:\Windows\system32\tasklist.exe
          tasklist
          3⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:4768
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "where /r . cookies.sqlite"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3596
        • C:\Windows\system32\where.exe
          where /r . cookies.sqlite
          3⤵
            PID:3216
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4408
          • C:\Windows\system32\tasklist.exe
            tasklist
            3⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:3184
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1724
          • C:\Windows\system32\tasklist.exe
            tasklist
            3⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:2468
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9223 --profile-directory=Default --disable-gpu --no-sandbox --window-position=-32000,-32000
          2⤵
          • Uses browser remote debugging
          • Drops file in Windows directory
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:776
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ffe2c6ecc40,0x7ffe2c6ecc4c,0x7ffe2c6ecc58
            3⤵
              PID:2292
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1980,i,14118086285317106063,618134807003543857,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=1944 /prefetch:2
              3⤵
                PID:1772
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-appcompat-clear --field-trial-handle=1564,i,14118086285317106063,618134807003543857,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=1992 /prefetch:3
                3⤵
                  PID:2368
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --no-appcompat-clear --field-trial-handle=2092,i,14118086285317106063,618134807003543857,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=1752 /prefetch:8
                  3⤵
                    PID:3444
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --no-sandbox --remote-debugging-port=9223 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2888,i,14118086285317106063,618134807003543857,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2908 /prefetch:1
                    3⤵
                    • Uses browser remote debugging
                    PID:4300
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --no-sandbox --remote-debugging-port=9223 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2912,i,14118086285317106063,618134807003543857,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2920 /prefetch:1
                    3⤵
                    • Uses browser remote debugging
                    PID:2472
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --no-sandbox --remote-debugging-port=9223 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4080,i,14118086285317106063,618134807003543857,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4028 /prefetch:1
                    3⤵
                    • Uses browser remote debugging
                    PID:4508
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:/Program Files (x86)/Microsoft/Edge/Application/msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --disable-gpu --no-sandbox --window-position=-32000,-32000
                  2⤵
                  • Uses browser remote debugging
                  • Enumerates system info in registry
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of FindShellTrayWindow
                  PID:3572
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffe292b46f8,0x7ffe292b4708,0x7ffe292b4718
                    3⤵
                      PID:1384
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,11502254081216936800,2093628133502674373,131072 --no-sandbox --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2124 /prefetch:2
                      3⤵
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      PID:2468
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,11502254081216936800,2093628133502674373,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=2320 /prefetch:3
                      3⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:2812
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,11502254081216936800,2093628133502674373,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --mojo-platform-channel-handle=2796 /prefetch:8
                      3⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3104
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --remote-debugging-port=9223 --field-trial-handle=2100,11502254081216936800,2093628133502674373,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
                      3⤵
                      • Uses browser remote debugging
                      • Suspicious behavior: EnumeratesProcesses
                      PID:868
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --remote-debugging-port=9223 --field-trial-handle=2100,11502254081216936800,2093628133502674373,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
                      3⤵
                      • Uses browser remote debugging
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4272
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --remote-debugging-port=9223 --field-trial-handle=2100,11502254081216936800,2093628133502674373,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
                      3⤵
                      • Uses browser remote debugging
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4016
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --remote-debugging-port=9223 --field-trial-handle=2100,11502254081216936800,2093628133502674373,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3708 /prefetch:1
                      3⤵
                      • Uses browser remote debugging
                      • Suspicious behavior: EnumeratesProcesses
                      PID:2896
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                    2⤵
                      PID:4820
                      • C:\Windows\system32\tasklist.exe
                        tasklist
                        3⤵
                        • Enumerates processes with tasklist
                        PID:3812
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                      2⤵
                        PID:4364
                        • C:\Windows\system32\tasklist.exe
                          tasklist
                          3⤵
                          • Enumerates processes with tasklist
                          PID:4204
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                        2⤵
                          PID:4672
                          • C:\Windows\system32\tasklist.exe
                            tasklist
                            3⤵
                            • Enumerates processes with tasklist
                            PID:2172
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /d /s /c "where /r . *.sqlite"
                          2⤵
                            PID:2100
                            • C:\Windows\system32\where.exe
                              where /r . *.sqlite
                              3⤵
                                PID:4836
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"
                              2⤵
                                PID:940
                                • C:\Windows\system32\taskkill.exe
                                  taskkill /F /T /IM chrome.exe
                                  3⤵
                                  • Kills process with taskkill
                                  PID:560
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"
                                2⤵
                                  PID:2560
                                  • C:\Windows\system32\taskkill.exe
                                    taskkill /F /T /IM msedge.exe
                                    3⤵
                                    • Kills process with taskkill
                                    PID:2528
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM EpicGamesLauncher.exe /F"
                                  2⤵
                                    PID:2892
                                    • C:\Windows\system32\taskkill.exe
                                      taskkill /IM EpicGamesLauncher.exe /F
                                      3⤵
                                      • Kills process with taskkill
                                      PID:3808
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM javaw.exe /F"
                                    2⤵
                                      PID:2784
                                      • C:\Windows\system32\taskkill.exe
                                        taskkill /IM javaw.exe /F
                                        3⤵
                                        • Kills process with taskkill
                                        PID:2124
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"
                                      2⤵
                                        PID:3224
                                        • C:\Windows\system32\taskkill.exe
                                          taskkill /F /T /IM chrome.exe
                                          3⤵
                                          • Kills process with taskkill
                                          PID:1328
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"
                                        2⤵
                                          PID:2852
                                          • C:\Windows\system32\taskkill.exe
                                            taskkill /F /T /IM msedge.exe
                                            3⤵
                                            • Kills process with taskkill
                                            PID:2828
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"
                                          2⤵
                                            PID:2468
                                            • C:\Windows\system32\taskkill.exe
                                              taskkill /IM Steam.exe /F
                                              3⤵
                                              • Kills process with taskkill
                                              PID:1148
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"
                                            2⤵
                                              PID:660
                                              • C:\Windows\system32\taskkill.exe
                                                taskkill /F /T /IM chrome.exe
                                                3⤵
                                                • Kills process with taskkill
                                                PID:2368
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"
                                              2⤵
                                                PID:3732
                                                • C:\Windows\system32\taskkill.exe
                                                  taskkill /F /T /IM msedge.exe
                                                  3⤵
                                                  • Kills process with taskkill
                                                  PID:2752
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                                                2⤵
                                                  PID:1220
                                                  • C:\Windows\system32\tasklist.exe
                                                    tasklist
                                                    3⤵
                                                    • Enumerates processes with tasklist
                                                    PID:2844
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /d /s /c "wscript "C:\Users\Admin\AppData\Local\Temp\ba7d47908c39830f.vbs""
                                                  2⤵
                                                    PID:4364
                                                    • C:\Windows\system32\wscript.exe
                                                      wscript "C:\Users\Admin\AppData\Local\Temp\ba7d47908c39830f.vbs"
                                                      3⤵
                                                        PID:4300
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /d /s /c "cscript //B "C:\Users\Admin\AppData\Local\Temp\open.vbs""
                                                      2⤵
                                                        PID:4840
                                                        • C:\Windows\system32\cscript.exe
                                                          cscript //B "C:\Users\Admin\AppData\Local\Temp\open.vbs"
                                                          3⤵
                                                          • Checks computer location settings
                                                          PID:1724
                                                          • C:\Users\Admin\AppData\Local\Temp\hexon_6f6b13d197b67725.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\hexon_6f6b13d197b67725.exe" gayarwez discord
                                                            4⤵
                                                            • Checks computer location settings
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            PID:4572
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
                                                              5⤵
                                                                PID:1164
                                                                • C:\Windows\System32\reg.exe
                                                                  C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
                                                                  6⤵
                                                                    PID:984
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\20241020-4572-jyfm7o.mvdnk.png" "
                                                                  5⤵
                                                                    PID:1328
                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
                                                                      6⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:2776
                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFA5E.tmp" "c:\Users\Admin\AppData\Local\Temp\screenCapture\CSC437D8228CF08422588F537E66BE7A9D5.TMP"
                                                                        7⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:4540
                                                                    • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\20241020-4572-jyfm7o.mvdnk.png"
                                                                      6⤵
                                                                      • Executes dropped EXE
                                                                      PID:4352
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\20241020-4572-7kzbaj.qhg6h.png" "
                                                                    5⤵
                                                                      PID:2332
                                                                      • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\20241020-4572-7kzbaj.qhg6h.png"
                                                                        6⤵
                                                                        • Executes dropped EXE
                                                                        PID:3112
                                                              • C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --user-data-dir="C:\Users\Admin\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1684 --field-trial-handle=1908,i,67054989044691770,2461890687055012515,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
                                                                2⤵
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:1544
                                                            • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                              "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                              1⤵
                                                                PID:3380

                                                              Network

                                                              MITRE ATT&CK Enterprise v15

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                                Filesize

                                                                2B

                                                                MD5

                                                                d751713988987e9331980363e24189ce

                                                                SHA1

                                                                97d170e1550eee4afc0af065b78cda302a97674c

                                                                SHA256

                                                                4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                SHA512

                                                                b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                Filesize

                                                                120KB

                                                                MD5

                                                                54f74ae5130a6d81643b2dd622b4db74

                                                                SHA1

                                                                4875ec963d09b7e4753120da1a9be811c0fbc8ff

                                                                SHA256

                                                                6ab41e85b3eb6d4aca83bfa0578cf9c296d33bccef9e800fa74cf5e5ccb95dfd

                                                                SHA512

                                                                684e935e22f11ce0d0a6961e589f30f1ef1b06b493e07f26ce9fb8f827f1c5183b3484aa239a59da00b46aba75e858c5b4d39223ed41c94940982606a821c92e

                                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\screenCapture_1.3.2.exe.log

                                                                Filesize

                                                                862B

                                                                MD5

                                                                367da10772c194b1cd8c945c3f47b33b

                                                                SHA1

                                                                6c35d9731e6360bc94b18eed136880bed4e6c5e2

                                                                SHA256

                                                                8f2bdac06e17b49fa3947017fcb1d13851d8e4fa9fb31c809d2325741586021b

                                                                SHA512

                                                                b1c7cca7668451aa4d558dc6c9b7d8e265211b53fd4f2b497286e600ba2e87852d332d6a581bbb2cc4ad08312459809ce7533f38d4ce10fa0efb816f154d99e9

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                Filesize

                                                                152B

                                                                MD5

                                                                ccff51f965f8f4176e4ad112c34c86a7

                                                                SHA1

                                                                eab249ca0f58ed7a8afbca30bdae123136463cd8

                                                                SHA256

                                                                3eb00cf1bd645d308d0385a95a30737679be58dcc5433bc66216aac762d9da33

                                                                SHA512

                                                                8c68f146152045c2a78c9e52198b8180b261edf61a8c28364728eafb1cba1df0fa29906e5ede69b3c1e0b67cfcbeb7fde65b8d2edbc397c9a4b99ecfe8dea2dd

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                Filesize

                                                                152B

                                                                MD5

                                                                c29339188732b78d10f11d3fb23063cb

                                                                SHA1

                                                                2db38f26fbc92417888251d9e31be37c9380136f

                                                                SHA256

                                                                0a61fa9e17b9ae7812cdeda5e890b22b14e53fa14a90db334f721252a9c874c2

                                                                SHA512

                                                                77f1f5f78e73f4fc01151e7e2a553dc4ed9bf35dd3a9565501f698be373640f153c6d7fc83450b9d2f29aeaa72387dd627d56f287a46635c2da07c60bc3d6e2c

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

                                                                Filesize

                                                                70KB

                                                                MD5

                                                                e5e3377341056643b0494b6842c0b544

                                                                SHA1

                                                                d53fd8e256ec9d5cef8ef5387872e544a2df9108

                                                                SHA256

                                                                e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

                                                                SHA512

                                                                83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                Filesize

                                                                4KB

                                                                MD5

                                                                b8e92e92e62472a6af771e724b641b63

                                                                SHA1

                                                                7267ae2a65440545a4d9a0bd2d0baa611c805c43

                                                                SHA256

                                                                292ea00db2cede1e7e3cfd3a53275bfed567e444ac1aa25b128b46de7a010ce9

                                                                SHA512

                                                                d90263f447de5ba775c93792ccf2eeb30cdf2202f59a62b4a679a82eafeeca930c7146537a92781a346ed22ba42eba6601057098769ba08f34c7574d1fbbe4fa

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                                Filesize

                                                                24KB

                                                                MD5

                                                                86aa28ffd286b08415aa197216684874

                                                                SHA1

                                                                d99924976c73e3220108817ad6bc1d8b1795ca2d

                                                                SHA256

                                                                a6dc4bc6ade3039e57b538f2620b91602199f1908b23c4a2beb3fd3aa721579d

                                                                SHA512

                                                                a51fbd1af778d32f2f95a9a863a59f42a7eb804dbb8ce85459297959eea21fbfe9625d74c3f91ad65016031d4b3e26eeb748c1c59e09ac68778fc670d408d0fa

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\CURRENT

                                                                Filesize

                                                                16B

                                                                MD5

                                                                46295cac801e5d4857d09837238a6394

                                                                SHA1

                                                                44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                SHA256

                                                                0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                SHA512

                                                                8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

                                                                Filesize

                                                                41B

                                                                MD5

                                                                5af87dfd673ba2115e2fcf5cfdb727ab

                                                                SHA1

                                                                d5b5bbf396dc291274584ef71f444f420b6056f1

                                                                SHA256

                                                                f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                                                SHA512

                                                                de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                                              • C:\Users\Admin\AppData\Local\Temp\20241020-4572-7kzbaj.qhg6h.png

                                                                Filesize

                                                                423KB

                                                                MD5

                                                                c7a6e2ac6510ebf722660908f9214e7e

                                                                SHA1

                                                                43a098ba5f2a23801077c10e87503e3c87532d33

                                                                SHA256

                                                                42abdf8aa3bbabf560f94261adb3f2dae1d076b44007c3c20fc31681a0406dc4

                                                                SHA512

                                                                602bb28c42db0f9c92db2eee49e272e4abba7ae21a4fbd816952e92577bfb2238a73ea2333c11088cc259a940414fff37601e04b89109d87e10dca1ecb39d791

                                                              • C:\Users\Admin\AppData\Local\Temp\20241020-4572-jyfm7o.mvdnk.png

                                                                Filesize

                                                                423KB

                                                                MD5

                                                                378167ff16bdcb4987922b2784966a09

                                                                SHA1

                                                                92f86b6b8de11c372a5f1e98643a1a25ae2270f1

                                                                SHA256

                                                                5ce7fc6c0b37746e41911f6f4e9546f5a9d8604fd9a8f727c3e73b6f72a5f9dc

                                                                SHA512

                                                                fb53cfcb019587e9195e09b45e4508f3ed4536a5aa3a69056b9a680b461ccda62732ce3f0530370f5c2bcb497b0a69a87ca922fb8ae0e7880f6ef5b24a402444

                                                              • C:\Users\Admin\AppData\Local\Temp\726e1fab-f593-4e67-968d-8f9cb63e1769.tmp.node

                                                                Filesize

                                                                137KB

                                                                MD5

                                                                04bfbfec8db966420fe4c7b85ebb506a

                                                                SHA1

                                                                939bb742a354a92e1dcd3661a62d69e48030a335

                                                                SHA256

                                                                da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd

                                                                SHA512

                                                                4ea97a9a120ed5bee8638e0a69561c2159fc3769062d7102167b0e92b4f1a5c002a761bd104282425f6cee8d0e39dbe7e12ad4e4a38570c3f90f31b65072dd65

                                                              • C:\Users\Admin\AppData\Local\Temp\RESFA5E.tmp

                                                                Filesize

                                                                1KB

                                                                MD5

                                                                62d1d4739700b5f592c4015aa29bc2e1

                                                                SHA1

                                                                7e5fbed849d617be1c5afd9cdde4da79b2134ff1

                                                                SHA256

                                                                d6036a07b1c3757cea9cb79818e9d56bb71386e22c742248ab9329d4ba0963eb

                                                                SHA512

                                                                b969c19c02903a5679de1b9695e5894aeb8c26685468cd5d668065b14352dc8ad75fabb6b457758451e832d2569e2643786da5a4edf4320f058cdd7683c729c8

                                                              • C:\Users\Admin\AppData\Local\Temp\ba7d47908c39830f.vbs

                                                                Filesize

                                                                149KB

                                                                MD5

                                                                535dde9f3f6c105eac64540edf455ba6

                                                                SHA1

                                                                b116d7008477a4a1131963ee31f692e0b94f336e

                                                                SHA256

                                                                38e0d29ff9484ae7c7864787ca3b2da31a2c1e23aa3b35fef32863f91d000602

                                                                SHA512

                                                                4be2ff040eefb5232f5b37e7b7f42bf09c1f92f6aafc8216d51a4675a3e5c4fba5d29beef13a7ee1f8bdcbfba9d794e78ca4ca569a68009b910943c6d347bdf7

                                                              • C:\Users\Admin\AppData\Local\Temp\ca8a16be-7779-4b42-8569-07891bf073a9.tmp.node

                                                                Filesize

                                                                1.4MB

                                                                MD5

                                                                56192831a7f808874207ba593f464415

                                                                SHA1

                                                                e0c18c72a62692d856da1f8988b0bc9c8088d2aa

                                                                SHA256

                                                                6aa8763714aa5199a4065259af792292c2a7d6a2c381aa27007255421e5c9d8c

                                                                SHA512

                                                                c82aa1ef569c232b4b4f98a3789f2390e5f7bf5cc7e73d199fe23a3f636817edfdc2fb49ce7f69169c028a9dd5ab9f63e8f64964bb22424fc08db71e85054a33

                                                              • C:\Users\Admin\AppData\Local\Temp\open.vbs

                                                                Filesize

                                                                178B

                                                                MD5

                                                                bfeda00dd9e9d4984b836f42afe87aed

                                                                SHA1

                                                                e62d79211de446ae828e79ef4d3e26609b569da8

                                                                SHA256

                                                                31b071baff46a6727c66f6c16e739f98a47c66f7133b72b951c232cf2fe41df5

                                                                SHA512

                                                                8c09764d4266ab09c61f9544c4e493968b0d39b52d1d596f9babb4ebbfa032aa121313625bf15739c8f4e305ff4691967a6e8eb352aee0bde3ec6f0ec9482111

                                                              • C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\build\Release\node_sqlite3.node

                                                                Filesize

                                                                1.8MB

                                                                MD5

                                                                66a65322c9d362a23cf3d3f7735d5430

                                                                SHA1

                                                                ed59f3e4b0b16b759b866ef7293d26a1512b952e

                                                                SHA256

                                                                f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c

                                                                SHA512

                                                                0a44d12852fc4c74658a49f886c4bc7c715c48a7cb5a3dcf40c9f1d305ca991dd2c2cb3d0b5fd070b307a8f331938c5213188cbb2d27d47737cc1c4f34a1ea21

                                                              • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat

                                                                Filesize

                                                                13KB

                                                                MD5

                                                                da0f40d84d72ae3e9324ad9a040a2e58

                                                                SHA1

                                                                4ca7f6f90fb67dce8470b67010aa19aa0fd6253f

                                                                SHA256

                                                                818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b

                                                                SHA512

                                                                30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9

                                                              • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe

                                                                Filesize

                                                                12KB

                                                                MD5

                                                                cc16fb8aca4b5bc856bc91616aa98eec

                                                                SHA1

                                                                dcc1502fa6aee3c9799d5529f373ddff7cf94a55

                                                                SHA256

                                                                ac2a0a398ee1407aa5213a4560d4b5c447993faacfa3a5ff9a21f020726c9aad

                                                                SHA512

                                                                359baeb6c1ac55f5ec0e68ff727166326ad80106062ed01d5aed5036080b8f35b446c9b6fca27fef8dd9e606dc5487442e8c8e597f6afc9860bab79a87ce3fc3

                                                              • \??\c:\Users\Admin\AppData\Local\Temp\screenCapture\CSC437D8228CF08422588F537E66BE7A9D5.TMP

                                                                Filesize

                                                                1KB

                                                                MD5

                                                                a6f2d21624678f54a2abed46e9f3ab17

                                                                SHA1

                                                                a2a6f07684c79719007d434cbd1cd2164565734a

                                                                SHA256

                                                                ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344

                                                                SHA512

                                                                0b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676

                                                              • \??\c:\Users\Admin\AppData\Local\Temp\screenCapture\app.manifest

                                                                Filesize

                                                                350B

                                                                MD5

                                                                8951565428aa6644f1505edb592ab38f

                                                                SHA1

                                                                9c4bee78e7338f4f8b2c8b6c0e187f43cfe88bf2

                                                                SHA256

                                                                8814db9e125d0c2b7489f8c7c3e95adf41f992d4397ed718bda8573cb8fb0e83

                                                                SHA512

                                                                7577bad37b67bf13a0d7f9b8b7d6c077ecdfb81a5bee94e06dc99e84cb20db2d568f74d1bb2cef906470b4f6859e00214beacca7d82e2b99126d27820bf3b8f5

                                                              • \??\pipe\crashpad_776_MIGGSWKATWOVMUCY

                                                                MD5

                                                                d41d8cd98f00b204e9800998ecf8427e

                                                                SHA1

                                                                da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                SHA256

                                                                e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                SHA512

                                                                cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                              • memory/1544-288-0x00000255B7360000-0x00000255B7361000-memory.dmp

                                                                Filesize

                                                                4KB

                                                              • memory/1544-287-0x00000255B7360000-0x00000255B7361000-memory.dmp

                                                                Filesize

                                                                4KB

                                                              • memory/1544-286-0x00000255B7360000-0x00000255B7361000-memory.dmp

                                                                Filesize

                                                                4KB

                                                              • memory/1544-293-0x00000255B7360000-0x00000255B7361000-memory.dmp

                                                                Filesize

                                                                4KB

                                                              • memory/1544-294-0x00000255B7360000-0x00000255B7361000-memory.dmp

                                                                Filesize

                                                                4KB

                                                              • memory/1544-298-0x00000255B7360000-0x00000255B7361000-memory.dmp

                                                                Filesize

                                                                4KB

                                                              • memory/1544-297-0x00000255B7360000-0x00000255B7361000-memory.dmp

                                                                Filesize

                                                                4KB

                                                              • memory/1544-296-0x00000255B7360000-0x00000255B7361000-memory.dmp

                                                                Filesize

                                                                4KB

                                                              • memory/1544-295-0x00000255B7360000-0x00000255B7361000-memory.dmp

                                                                Filesize

                                                                4KB

                                                              • memory/1544-292-0x00000255B7360000-0x00000255B7361000-memory.dmp

                                                                Filesize

                                                                4KB

                                                              • memory/4352-280-0x0000000000980000-0x000000000098A000-memory.dmp

                                                                Filesize

                                                                40KB