hxxps://dirtyship[.]to/mr-sethi-nude-blowjob-tiktok-girl-video-leaked-19a-x/ | Triage

Resubmissions

19/01/2025, 01:33

250119-byqsls1lbs 3

19/01/2025, 01:06

250119-bf6q4szqcw 3

02/08/2024, 02:10

240802-clvrgavamg 3

16/07/2023, 03:36

230716-d6bd1add5z 5

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/01/2025, 01:06

Sharing

Report Analysis Logs

General

Target

https://dirtyship.to/mr-sethi-nude-blowjob-tiktok-girl-video-leaked-19a-x/

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2316	msedge.exe
2316	msedge.exe
2448	msedge.exe
2448	msedge.exe
2036	identity_helper.exe
2036	identity_helper.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 2344	2448	msedge.exe	83
PID 2448 wrote to memory of 2344	2448	msedge.exe	83
PID 2448 wrote to memory of 744	2448	msedge.exe	84
PID 2448 wrote to memory of 744	2448	msedge.exe	84
PID 2448 wrote to memory of 744	2448	msedge.exe	84
PID 2448 wrote to memory of 744	2448	msedge.exe	84
PID 2448 wrote to memory of 744	2448	msedge.exe	84
PID 2448 wrote to memory of 744	2448	msedge.exe	84
PID 2448 wrote to memory of 744	2448	msedge.exe	84
PID 2448 wrote to memory of 744	2448	msedge.exe	84
PID 2448 wrote to memory of 744	2448	msedge.exe	84
PID 2448 wrote to memory of 744	2448	msedge.exe	84
PID 2448 wrote to memory of 744	2448	msedge.exe	84
PID 2448 wrote to memory of 744	2448	msedge.exe	84
PID 2448 wrote to memory of 744	2448	msedge.exe	84
PID 2448 wrote to memory of 744	2448	msedge.exe	84
PID 2448 wrote to memory of 744	2448	msedge.exe	84
PID 2448 wrote to memory of 744	2448	msedge.exe	84
PID 2448 wrote to memory of 744	2448	msedge.exe	84
PID 2448 wrote to memory of 744	2448	msedge.exe	84
PID 2448 wrote to memory of 744	2448	msedge.exe	84
PID 2448 wrote to memory of 744	2448	msedge.exe	84
PID 2448 wrote to memory of 744	2448	msedge.exe	84
PID 2448 wrote to memory of 744	2448	msedge.exe	84
PID 2448 wrote to memory of 744	2448	msedge.exe	84
PID 2448 wrote to memory of 744	2448	msedge.exe	84
PID 2448 wrote to memory of 744	2448	msedge.exe	84
PID 2448 wrote to memory of 744	2448	msedge.exe	84
PID 2448 wrote to memory of 744	2448	msedge.exe	84
PID 2448 wrote to memory of 744	2448	msedge.exe	84
PID 2448 wrote to memory of 744	2448	msedge.exe	84
PID 2448 wrote to memory of 744	2448	msedge.exe	84
PID 2448 wrote to memory of 744	2448	msedge.exe	84
PID 2448 wrote to memory of 744	2448	msedge.exe	84
PID 2448 wrote to memory of 744	2448	msedge.exe	84
PID 2448 wrote to memory of 744	2448	msedge.exe	84
PID 2448 wrote to memory of 744	2448	msedge.exe	84
PID 2448 wrote to memory of 744	2448	msedge.exe	84
PID 2448 wrote to memory of 744	2448	msedge.exe	84
PID 2448 wrote to memory of 744	2448	msedge.exe	84
PID 2448 wrote to memory of 744	2448	msedge.exe	84
PID 2448 wrote to memory of 744	2448	msedge.exe	84
PID 2448 wrote to memory of 2316	2448	msedge.exe	85
PID 2448 wrote to memory of 2316	2448	msedge.exe	85
PID 2448 wrote to memory of 1100	2448	msedge.exe	86
PID 2448 wrote to memory of 1100	2448	msedge.exe	86
PID 2448 wrote to memory of 1100	2448	msedge.exe	86
PID 2448 wrote to memory of 1100	2448	msedge.exe	86
PID 2448 wrote to memory of 1100	2448	msedge.exe	86
PID 2448 wrote to memory of 1100	2448	msedge.exe	86
PID 2448 wrote to memory of 1100	2448	msedge.exe	86
PID 2448 wrote to memory of 1100	2448	msedge.exe	86
PID 2448 wrote to memory of 1100	2448	msedge.exe	86
PID 2448 wrote to memory of 1100	2448	msedge.exe	86
PID 2448 wrote to memory of 1100	2448	msedge.exe	86
PID 2448 wrote to memory of 1100	2448	msedge.exe	86
PID 2448 wrote to memory of 1100	2448	msedge.exe	86
PID 2448 wrote to memory of 1100	2448	msedge.exe	86
PID 2448 wrote to memory of 1100	2448	msedge.exe	86
PID 2448 wrote to memory of 1100	2448	msedge.exe	86
PID 2448 wrote to memory of 1100	2448	msedge.exe	86
PID 2448 wrote to memory of 1100	2448	msedge.exe	86
PID 2448 wrote to memory of 1100	2448	msedge.exe	86
PID 2448 wrote to memory of 1100	2448	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://dirtyship.to/mr-sethi-nude-blowjob-tiktok-girl-video-leaked-19a-x/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc375a46f8,0x7ffc375a4708,0x7ffc375a4718
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,9206874919298783599,11320915493950936373,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,9206874919298783599,11320915493950936373,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,9206874919298783599,11320915493950936373,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,9206874919298783599,11320915493950936373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,9206874919298783599,11320915493950936373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,9206874919298783599,11320915493950936373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,9206874919298783599,11320915493950936373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,9206874919298783599,11320915493950936373,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,9206874919298783599,11320915493950936373,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,9206874919298783599,11320915493950936373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3916 /prefetch:1
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,9206874919298783599,11320915493950936373,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,9206874919298783599,11320915493950936373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,9206874919298783599,11320915493950936373,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,9206874919298783599,11320915493950936373,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4828 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7cb450b1315c63b1d5d89d98ba22da5

SHA1
694005cd9e1a4c54e0b83d0598a8a0c089df1556

SHA256
38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

SHA512
df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37f660dd4b6ddf23bc37f5c823d1c33a

SHA1
1c35538aa307a3e09d15519df6ace99674ae428b

SHA256
4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

SHA512
807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
792B

MD5
961ca601f218eb1660ea2445ca5a2af5

SHA1
5d419f9ab187163c8cedd5f2308d771eccc4c85a

SHA256
fbb9307d2aadea46ba164868a50eb6ba9b722e3684b3ccd398897042b762317b

SHA512
0a50450f3574bd8a8ac6c2e1a8808d81945c590879af8919de836248b17b61a9ebd95d14ea572984811f120f78cc49414b03453ef5491a97a82e9680f2fa05ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
a65f221560068c672bc5218ecb2327eb

SHA1
cfe33ec34496d25401f7c4268be683b6f8a88c9f

SHA256
8e056f56decbb08503f347b2b85b999f558d10ead126e32c29d8c6b1e57af66b

SHA512
cf1b336dff91c192c1fd2578de7d05dec0d3123de764a05b06270782b9018f88c2bbaf5990092c017c6a27600fbb2e377603e261b6ae006de0b5ee410313998d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0016612ecef42e3c16b0b3e1987bf92e

SHA1
706cc3cbcecaf7e6a7cf44d30d4d2a05e2955a63

SHA256
18870693b0f27dca11645df2a21d33e13d33f90b8cd73e01210b5b4ea6e37509

SHA512
d9bd696e7abad616fc5f4b6cff09c0aa0a0cf018c29c0177144e6184058369f36a03b8c47fcf56d44f5077fe6ec576a36549b66d2a948203b032572720093a71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
61c4d321aae5a3acca7cf9c0f6847598

SHA1
f2f12812b04a8b88d2f94b60741674173adb796a

SHA256
a66f85963b1b4843f716f2ec9ce85cbc567f309405cb59f1c2d924c6cbfcf840

SHA512
f1b2513fddb93a79a5bcc7c2e835a51e2d5f16a98e9790c37208599cc68cb29a42132697126ac693366414844b78fdadfcd9fb238291c32bca2b6f05357a09d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f7b32010b68f3f3b663f6e00be67ff36

SHA1
6498e55b532aa993730fd7894bc8b96e51aa2a88

SHA256
cc020acb1060fcfa0d4081d319ae9815be5f9e9157d736fa0edce50e64e364d8

SHA512
a586291a078ea5cb486dcc8fa17325e66f6c98870dd173a1630ddff7b0a3191149996aff8112dc00dcca8dbc8619f3d8a450c4b9acae887514e3cc0ba5c62b53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
53986f9d802d3ca610af27f8dbb29e2c

SHA1
5f0323201ce35f98f6b68d854c274abd1298d2ea

SHA256
3f31264dac3e3c242716f4f1e5d22575ca7eff8c119de3c200500d453208f7da

SHA512
dc54f4ef1113c052f82fcbd3c8f283aac1f2d80f1674e2fbfb98fc132fe6772a5220fd137fe6c33e47b9d801277852b4867ccb6ff42bed91ca66b202c45ba42a

Download Submit