Analysis Overview
Threat Level: Known bad
The file https://github.com/Cyendd/Vape-V4-CRACKED/blob/main/CRACKED-V4.exe was found to be: Known bad.
Malicious Activity Summary
Detect Umbral payload
Umbral
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Downloads MZ/PE file
Drops file in Drivers directory
Executes dropped EXE
Reads user/profile data of web browsers
Checks BIOS information in registry
Checks whether UAC is enabled
Looks up external IP address via web service
Legitimate hosting services abused for malware hosting/C2
Suspicious use of NtSetInformationThreadHideFromDebugger
Enumerates physical storage devices
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SendNotifyMessage
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of FindShellTrayWindow
NTFS ADS
Views/modifies file attributes
Detects videocard installed
Runs ping.exe
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-04-13 13:08
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-04-13 13:08
Reported
2024-04-13 13:09
Platform
win11-20240412-en
Max time kernel
51s
Max time network
63s
Command Line
Signatures
Detect Umbral payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Umbral
Identifies VirtualBox via ACPI registry values (likely anti-VM)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\RarSFX0\VAPE V4.exe | N/A |
Downloads MZ/PE file
Drops file in Drivers directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\System32\drivers\etc\hosts | C:\Users\Admin\AppData\Local\Temp\RarSFX0\VAPE V4 (injector).exe | N/A |
Checks BIOS information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\RarSFX0\VAPE V4.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\RarSFX0\VAPE V4.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\Downloads\CRACKED-V4.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\RarSFX0\VAPE V4 (injector).exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\RarSFX0\VAPE V4.exe | N/A |
Reads user/profile data of web browsers
Checks whether UAC is enabled
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA | C:\Users\Admin\AppData\Local\Temp\RarSFX0\VAPE V4.exe | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | discord.com | N/A | N/A |
| N/A | raw.githubusercontent.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
| N/A | raw.githubusercontent.com | N/A | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | ip-api.com | N/A | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\RarSFX0\VAPE V4.exe | N/A |
Enumerates physical storage devices
Detects videocard installed
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
NTFS ADS
| Description | Indicator | Process | Target |
| File opened for modification | C:\Users\Admin\Downloads\Unconfirmed 140088.crdownload:SmartScreen | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| File opened for modification | C:\Users\Admin\Downloads\CRACKED-V4.exe:Zone.Identifier | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Runs ping.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\PING.EXE | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\RarSFX0\VAPE V4 (injector).exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: 34 | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: 35 | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: 36 | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: 34 | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: 35 | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: 36 | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of WriteProcessMemory
Views/modifies file attributes
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SYSTEM32\attrib.exe | N/A |
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Cyendd/Vape-V4-CRACKED/blob/main/CRACKED-V4.exe
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc19dd3cb8,0x7ffc19dd3cc8,0x7ffc19dd3cd8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1816,16851059953584889126,16352068135687609589,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1900 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1816,16851059953584889126,16352068135687609589,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1816,16851059953584889126,16352068135687609589,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,16851059953584889126,16352068135687609589,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,16851059953584889126,16352068135687609589,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1816,16851059953584889126,16352068135687609589,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3928 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,16851059953584889126,16352068135687609589,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1816,16851059953584889126,16352068135687609589,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6132 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1816,16851059953584889126,16352068135687609589,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,16851059953584889126,16352068135687609589,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,16851059953584889126,16352068135687609589,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1816,16851059953584889126,16352068135687609589,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5656 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,16851059953584889126,16352068135687609589,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,16851059953584889126,16352068135687609589,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
C:\Users\Admin\Downloads\CRACKED-V4.exe
"C:\Users\Admin\Downloads\CRACKED-V4.exe"
C:\Users\Admin\AppData\Local\Temp\RarSFX0\VAPE V4 (injector).exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\VAPE V4 (injector).exe"
C:\Windows\System32\Wbem\wmic.exe
"wmic.exe" csproduct get uuid
C:\Windows\SYSTEM32\attrib.exe
"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\RarSFX0\VAPE V4 (injector).exe"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\RarSFX0\VAPE V4 (injector).exe'
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
C:\Windows\System32\Wbem\wmic.exe
"wmic.exe" os get Caption
C:\Windows\System32\Wbem\wmic.exe
"wmic.exe" computersystem get totalphysicalmemory
C:\Windows\System32\Wbem\wmic.exe
"wmic.exe" csproduct get uuid
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
C:\Windows\System32\Wbem\wmic.exe
"wmic" path win32_VideoController get name
C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\RarSFX0\VAPE V4 (injector).exe" && pause
C:\Windows\system32\PING.EXE
ping localhost
C:\Users\Admin\AppData\Local\Temp\RarSFX0\VAPE V4.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\VAPE V4.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | github.com | udp |
| US | 8.8.8.8:53 | github.com | udp |
| GB | 20.26.156.215:443 | github.com | tcp |
| GB | 20.26.156.215:443 | github.com | tcp |
| US | 185.199.110.154:443 | github.githubassets.com | tcp |
| US | 185.199.108.133:443 | avatars.githubusercontent.com | tcp |
| US | 8.8.8.8:53 | 133.108.199.185.in-addr.arpa | udp |
| US | 140.82.114.21:443 | collector.github.com | tcp |
| US | 140.82.114.21:443 | collector.github.com | tcp |
| US | 185.199.110.154:443 | github.githubassets.com | tcp |
| GB | 20.26.156.210:443 | api.github.com | tcp |
| US | 185.199.108.133:443 | avatars.githubusercontent.com | tcp |
| N/A | 224.0.0.251:5353 | udp | |
| GB | 142.250.200.35:443 | gstatic.com | tcp |
| US | 208.95.112.1:80 | ip-api.com | tcp |
| US | 208.95.112.1:80 | ip-api.com | tcp |
| US | 162.159.128.233:443 | discord.com | tcp |
| GB | 2.18.66.75:443 | tcp | |
| US | 52.182.143.213:443 | browser.pipe.aria.microsoft.com | tcp |
| NL | 23.62.61.147:443 | r.bing.com | tcp |
| NL | 23.62.61.147:443 | r.bing.com | tcp |
| NL | 23.62.61.147:443 | r.bing.com | tcp |
| NL | 23.62.61.147:443 | r.bing.com | tcp |
| NL | 23.62.61.147:443 | r.bing.com | tcp |
| NL | 23.62.61.147:443 | r.bing.com | tcp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | bc5d52992e41687fa70efc27531f778d |
| SHA1 | 6437d388bc4423de222bc1d10c39e86360497083 |
| SHA256 | eb037bb42f7cc1e8a3c419f575089582952678145740efa9d1581e58716d7870 |
| SHA512 | b7cd86df836ae883142bee2d91a300d421b8f7887e0b768dca7025a67901a6fd92f557ef1b8313470abd4630a0f5ac261adcfe9561766f75e6f8d5cc8b8ee5e7 |
\??\pipe\LOCAL\crashpad_860_DCPCGQYHLXYDLSSC
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 2740c93dd78962ad9f13777917f70bb3 |
| SHA1 | a3439adc4e310594bfb88f677ba662a2165cf8f6 |
| SHA256 | 4d834bfed93709866be1efbbb76ab57a6a942d1e2106095acb3643e3a49e879b |
| SHA512 | d0ca3a9db1a95bab1f9dc6925cd40ec545bf8cde07fbbef2a51bd18e96c7eb167799a195f62db6f38043155c9acbe2ec5b1607e0e7f76c4e069501edcc35748a |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 7672354beeca837dc514258b9fe29500 |
| SHA1 | 87eb7a7c5be5c93322efb7aa9b947e7abdc7fc61 |
| SHA256 | 25df869ce65ab467b7dff1ba6e16d72f8c9770b90c9a4b4ee254405ac4291c14 |
| SHA512 | 487f702e4a03daca95989488603a4031a22031b074957b9ae214294b597cc8ff8bf74b9c78ff9bb7c3df79adc8335d6a698896ff6ba259e2096a2334f74572fe |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 996d9c5cfd14b9914d57e3600f0e23c6 |
| SHA1 | 1970e1481960a5d511dc7a4b157e7350d6081f11 |
| SHA256 | 8251e2de9470f708a246b72c4b928b3e3d8341203c526f04eb0d84711dbc5a78 |
| SHA512 | edf1b143b45ee80e56bff2ec0bc0943ac7a837c0e304715544e8c6bbbae1c108841a7c4d1811fef5432078d573f3549afb0b08aee78e68b25b8c2918532f3d36 |
C:\Users\Admin\Downloads\Unconfirmed 140088.crdownload
| MD5 | 8f595faff0637bebf700d5da2c87f733 |
| SHA1 | d55ed72bdc723ace2b3822e31877bd5e83cafc04 |
| SHA256 | fe63b60aba71f6effea1029b2b46423c666170e1ab947c11a9f2c60c037d1f46 |
| SHA512 | c7898ab2cbf4043537c938b96e5f75c7fbf1984cad6e5f2dab94bbfdfef2ef010a2a5e06cd625683b19747c5c4668fb26c35d8b2dfdef427c4642e7120ae5133 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | dc0fa8769f8cfe1bbc59d6941c02cefb |
| SHA1 | 4296d2671b2250db5cf60b593c626594fcef9eae |
| SHA256 | 5002eb4c728e3b2a458f500cb96557aff16e493c21643a58d6941b815f88ecde |
| SHA512 | 249b4eca740e1cc5b6824a99c4e701126a4b3b9be2bdda62f37c4bfb2ffc2f44348a575e16781f57fbd7d124ecf0ce215a01401520a2000978cf0d8dece62849 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 46295cac801e5d4857d09837238a6394 |
| SHA1 | 44e0fa1b517dbf802b18faf0785eeea6ac51594b |
| SHA256 | 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443 |
| SHA512 | 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 206702161f94c5cd39fadd03f4014d98 |
| SHA1 | bd8bfc144fb5326d21bd1531523d9fb50e1b600a |
| SHA256 | 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167 |
| SHA512 | 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145 |
C:\Users\Admin\Downloads\CRACKED-V4.exe:Zone.Identifier
| MD5 | fbccf14d504b7b2dbcb5a5bda75bd93b |
| SHA1 | d59fc84cdd5217c6cf74785703655f78da6b582b |
| SHA256 | eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913 |
| SHA512 | aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | efdc66889d8f4d5591bc009ed68a13b8 |
| SHA1 | 6444edd89982ceb4594673b31483c727c915b994 |
| SHA256 | 9fbded4d03fd4f18ce1fa04973c636c1fbf5cadac11ae8b817577127fba5fd26 |
| SHA512 | 41dda25c708f5e1269f3676d3b8a1e126392ece18ed8d239793ad010d58091a17f0f1bb86feed29e5ac489087ae3a5c28ec84bf75fc16c64e5daef605fcfcd76 |
C:\Users\Admin\AppData\Local\Temp\RarSFX0\VAPE V4 (injector).exe
| MD5 | d44a9b5d00eacfcba7fe044612e54200 |
| SHA1 | 58f1aa0e81b20d554da64153dcdc98358c9267c1 |
| SHA256 | 861212e4344c1b2380b5ae1a431a0b5bb97797bc4e83f11c93adcea87e6bce12 |
| SHA512 | 0e02f8e7a0de05f66446f3880f836a7304c3ed51be0f8b68293761e8abaea388206d8e786b16f25d15625490b55b89bdc4edeae96cd3a54796d048d16d7b4ff9 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | c66f9e7caca183d4780a326a225c65b3 |
| SHA1 | ba3e4dd26b42d195cb08ae782c6a0243a0b4b813 |
| SHA256 | e5ee6f895239b967d02ef384c55ec4c28af085bb780906c2f604c3f9cdce59d6 |
| SHA512 | 0f52c18a3bd558b190e667da9c9d8e1b4ea2820cb3094727fb02d9f707ce69192686a8ef9b1acd8937066d2ccc439b5f515141ffd5588bef67c4b0afcf8ec64f |
memory/3564-221-0x00000184B3530000-0x00000184B3570000-memory.dmp
memory/3564-227-0x00007FFC0A420000-0x00007FFC0AEE2000-memory.dmp
memory/3564-228-0x00000184CDB90000-0x00000184CDBA0000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_phi13zcg.4rq.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/5024-237-0x0000012FD6720000-0x0000012FD6742000-memory.dmp
memory/5024-238-0x00007FFC0A420000-0x00007FFC0AEE2000-memory.dmp
memory/5024-239-0x0000012FD65E0000-0x0000012FD65F0000-memory.dmp
memory/5024-240-0x0000012FD65E0000-0x0000012FD65F0000-memory.dmp
memory/5024-242-0x00007FFC0A420000-0x00007FFC0AEE2000-memory.dmp
C:\Windows\system32\drivers\etc\hosts
| MD5 | 4028457913f9d08b06137643fe3e01bc |
| SHA1 | a5cb3f12beaea8194a2d3d83a62bdb8d558f5f14 |
| SHA256 | 289d433902418aaf62e7b96b215ece04fcbcef2457daf90f46837a4d5090da58 |
| SHA512 | c8e1eef90618341bbde885fd126ece2b1911ca99d20d82f62985869ba457553b4c2bf1e841fd06dacbf27275b3b0940e5a794e1b1db0fd56440a96592362c28b |
memory/3564-247-0x00000184CDCF0000-0x00000184CDD66000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
| MD5 | 0ee4a2ccbf9735c7e427829f4a8214d7 |
| SHA1 | a81159f68380de764c9db237bb8fa39a8ccafff7 |
| SHA256 | cfc85b57ef5569c4e4731d24dedc0540ffeb70d647eb3319730de118f65f0e6a |
| SHA512 | 8d3d3fec36d3a056aeb13e56e454abd7ef5a2ffd11df31b6390db6aa7352d5cee3dbd3105c6a9183d4068311bdfaa4e9f28e219c0be0be7ffe6d2ed2e3e2013d |
memory/3564-249-0x00000184CDB40000-0x00000184CDB90000-memory.dmp
memory/3564-251-0x00000184CDDE0000-0x00000184CDDFE000-memory.dmp
memory/2376-252-0x00007FFC0A420000-0x00007FFC0AEE2000-memory.dmp
memory/2376-253-0x000002BA27AE0000-0x000002BA27AF0000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | fa21dd50b4e64421076f843031c8ccf7 |
| SHA1 | 2c56e94f130c0d8d77116e939ffee4e37cf982bd |
| SHA256 | e4f21aca1e12aafa8de7af24b79a75526e902c7d4b3fea5bdb6e723976997be3 |
| SHA512 | b8de2bfeb7af06c587dd1f424d410cf83471f31a55a3ea4c4481ce07ffd9bf66ddc1f7775ecd6ac65ac33baaec90ba5a208a9aefc84f31125a50dfb919982687 |
memory/2376-265-0x000002BA27AE0000-0x000002BA27AF0000-memory.dmp
memory/2376-277-0x00007FFC0A420000-0x00007FFC0AEE2000-memory.dmp
memory/3300-286-0x00007FFC0A420000-0x00007FFC0AEE2000-memory.dmp
memory/3564-287-0x00007FFC0A420000-0x00007FFC0AEE2000-memory.dmp
memory/3300-289-0x0000021C732B0000-0x0000021C732C0000-memory.dmp
memory/3300-288-0x0000021C732B0000-0x0000021C732C0000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 57083a8e45ebe4fd84c7c0f137ec3e21 |
| SHA1 | 857b5ea57f7bcf03cadee122106c6e58792a9b84 |
| SHA256 | f20102c4dc409cad3cdaf7a330c3a18a730a9d7d902b9fbee2a84186cba93d40 |
| SHA512 | 4bbc21c07c05ee1f783242f0fb59324d5ff9ae18bdf892f02980d582fed83380888eeba58e1a6a321507cfd5d4fe82a328a0d3482b29633be4e3ebbeac636f87 |
memory/3300-292-0x00007FFC0A420000-0x00007FFC0AEE2000-memory.dmp
memory/3564-294-0x00000184CDD70000-0x00000184CDD7A000-memory.dmp
memory/3564-295-0x00000184CDDA0000-0x00000184CDDB2000-memory.dmp
memory/3564-301-0x00000184CDB90000-0x00000184CDBA0000-memory.dmp
memory/1348-310-0x00007FFC0A420000-0x00007FFC0AEE2000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 6954f218ba4c7d0fe9cbf31e88fe3a69 |
| SHA1 | f6f26b65a7892fdcd1372dedbbb1a7fdd2b1db88 |
| SHA256 | b33cf6e9bb2ceccfb71165bcb40fa340fde43da503d3a4443d03aeddf28832e4 |
| SHA512 | e7f2aec7ef1cb35c37c8fd0d3d012a66c8aaaefc92c7975fb5597760730c9909dac76961aea6b19844863e90f992b9936efd6cf519fbc971668a86f34c1d0744 |
memory/1348-311-0x000002B2E6A50000-0x000002B2E6A60000-memory.dmp
memory/1348-313-0x000002B2E6A50000-0x000002B2E6A60000-memory.dmp
memory/1348-314-0x000002B2E6A50000-0x000002B2E6A60000-memory.dmp
memory/1348-316-0x00007FFC0A420000-0x00007FFC0AEE2000-memory.dmp
memory/3564-321-0x00007FFC0A420000-0x00007FFC0AEE2000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\RarSFX0\VAPE V4.exe
| MD5 | 4c015c3972db24a77316c56cd01c5468 |
| SHA1 | 38a0ac1bb0cae3db263ea1212fe90165de2d726b |
| SHA256 | 320e63d3a2f70fdf24db8e00c4811fe4b78e896946d99df6aeca1756bb986f99 |
| SHA512 | 4aba6313bd4634306024f2e0510efd14facfa8224ba835ead5f42f69a6af62a0c4f734a3a4a9362b0e5cfc76f512fd1ab4a2a1bc4c83c9abc2f1e5124072992e |
memory/1628-329-0x0000000140000000-0x00000001415DE000-memory.dmp
memory/1628-330-0x0000000140000000-0x00000001415DE000-memory.dmp
memory/1628-331-0x00007FFC2D1A0000-0x00007FFC2D3A9000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 6ed7c3661bf1adbb13ac6ee97b81bf98 |
| SHA1 | a0059f71c1bfbab6904042e80cbdd1ec68dedf5c |
| SHA256 | 9ced5b524a9d476662385170c33514103a9e97cc5670fdfff37c9f5094410cb3 |
| SHA512 | e56672f5799e132f87598039cc6f11908ffd719f7b974e5b116038c61d9d003937ad8fef37bb5d3630aeab8be2fc53aa16865e53320dc75848185f341171014b |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | b1ce4b8891b563ae68fae1420f27e2b8 |
| SHA1 | b550b5fdc1b0c403e2fa0e300bf9ef31dd93b4da |
| SHA256 | 841a2f6516ef63bdb1e3c2a34129b2dae05f1d32b038575329d6ed3d79bf2445 |
| SHA512 | 45bc6c672e76564a8758c8983c17fe88943e0e5be0fe22a12e71290f6e859c81df0387d21b009009940e157bd78d0f7c3c29df6bb5e99e1464cc0d2ec40c3985 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583256.TMP
| MD5 | ddd4d0afa085420600838c912ab6b622 |
| SHA1 | ee870345cde861539c2fd503c4c2f51d0eebae0a |
| SHA256 | 4b87903566bdaa24cba5f29d5f82d9303587104bc7149038159adc41b9aa7bae |
| SHA512 | 3277b7c7eb2ee2b240067898906e8af9097b315b9aa292ac1d0d41f7ecf60664ef6e216244a48847d55c900f82f76e743c8fc341d8101545ffec70f083dc0d89 |
memory/1628-355-0x0000000140000000-0x00000001415DE000-memory.dmp