Overview
overview
10Static
static
3BetaUnfrated.exe
windows7-x64
10BetaUnfrated.exe
windows10-2004-x64
10$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3BetaUnfated.exe
windows7-x64
10BetaUnfated.exe
windows10-2004-x64
10LICENSES.c...m.html
windows7-x64
1LICENSES.c...m.html
windows10-2004-x64
1d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows7-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows7-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows7-x64
1libGLESv2.dll
windows10-2004-x64
1resources/...dex.js
windows7-x64
1resources/...dex.js
windows10-2004-x64
1resources/....2.bat
windows7-x64
7resources/....2.bat
windows10-2004-x64
7resources/elevate.exe
windows7-x64
1resources/elevate.exe
windows10-2004-x64
1swiftshade...GL.dll
windows7-x64
1swiftshade...GL.dll
windows10-2004-x64
1swiftshade...v2.dll
windows7-x64
1swiftshade...v2.dll
windows10-2004-x64
1vk_swiftshader.dll
windows7-x64
1vk_swiftshader.dll
windows10-2004-x64
1vulkan-1.dll
windows7-x64
1vulkan-1.dll
windows10-2004-x64
1$PLUGINSDI...7z.dll
windows7-x64
3Analysis
- max time kernel
159s - max time network
178s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
17/04/2024, 11:58
Static task
static1
Behavioral task
behavioral1
Sample
BetaUnfrated.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
BetaUnfrated.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
BetaUnfated.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral8
Sample
BetaUnfated.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
LICENSES.chromium.html
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral10
Sample
LICENSES.chromium.html
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
d3dcompiler_47.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
ffmpeg.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral13
Sample
ffmpeg.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
libEGL.dll
Resource
win7-20240319-en
windows7-x64
Behavioral task
behavioral15
Sample
libEGL.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
libGLESv2.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral17
Sample
libGLESv2.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/index.js
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral19
Sample
resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/index.js
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/screenCapture_1.3.2.bat
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral21
Sample
resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/screenCapture_1.3.2.bat
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
resources/elevate.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral23
Sample
resources/elevate.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
swiftshader/libEGL.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral25
Sample
swiftshader/libEGL.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
swiftshader/libGLESv2.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral27
Sample
swiftshader/libGLESv2.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
vk_swiftshader.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral29
Sample
vk_swiftshader.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
vulkan-1.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral31
Sample
vulkan-1.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win7-20240221-en
windows7-x64
General
- Target BetaUnfated.exe
- Size 139.8MB
- Sample240417-n47drsfe41
- SHA256 705dc4d21549b6603587ef120e0849814871bdd5fcd10c5fb6235e0ff779b6df
- MD5 8a648d6aa159c835df037c21917b28bf
- SHA1 80678dfdf60594f022fb00cb0123b109c36a1f94
- SHA512 76a44f60afd1f0383ccb7f997fec5f38db6953b83fcc3ea26fcad982ebaf52984bd080fa16dc1b3c229e082b20fd61e075eb09da054a5b13f85ecdd20a2fa99c
- SSDEEP 786432:sSfg0tbLs2cRE3FsdxwBFyAaZZiljQWohhjbj6S46P845IPD:sSj5szmFcxwBFyAaZ4jMhhXcyC
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest BetaUnfated.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse BetaUnfated.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService BetaUnfated.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF BetaUnfated.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo BetaUnfated.exe - Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ BetaUnfated.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ BetaUnfated.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ BetaUnfated.exe - Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions BetaUnfated.exe - Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools BetaUnfated.exe - Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion BetaUnfated.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion BetaUnfated.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate BetaUnfated.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\International\Geo\Nation BetaUnfated.exe - Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\SOFTWARE\Wine BetaUnfated.exe - Loads dropped DLL 3 IoCs
pid Process 2668 BetaUnfated.exe 2668 BetaUnfated.exe 2668 BetaUnfated.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdater = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\0\\WindowsUpdater.exe" reg.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 ipinfo.io 3 ipinfo.io - Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN BetaUnfated.exe - Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 1620 WMIC.exe - Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 2412 tasklist.exe 1444 tasklist.exe - Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2668 BetaUnfated.exe 2668 BetaUnfated.exe 2668 BetaUnfated.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2536 WMIC.exe Token: SeSecurityPrivilege 2536 WMIC.exe Token: SeTakeOwnershipPrivilege 2536 WMIC.exe Token: SeLoadDriverPrivilege 2536 WMIC.exe Token: SeSystemProfilePrivilege 2536 WMIC.exe Token: SeSystemtimePrivilege 2536 WMIC.exe Token: SeProfSingleProcessPrivilege 2536 WMIC.exe Token: SeIncBasePriorityPrivilege 2536 WMIC.exe Token: SeCreatePagefilePrivilege 2536 WMIC.exe Token: SeBackupPrivilege 2536 WMIC.exe Token: SeRestorePrivilege 2536 WMIC.exe Token: SeShutdownPrivilege 2536 WMIC.exe Token: SeDebugPrivilege 2536 WMIC.exe Token: SeSystemEnvironmentPrivilege 2536 WMIC.exe Token: SeRemoteShutdownPrivilege 2536 WMIC.exe Token: SeUndockPrivilege 2536 WMIC.exe Token: SeManageVolumePrivilege 2536 WMIC.exe Token: 33 2536 WMIC.exe Token: 34 2536 WMIC.exe Token: 35 2536 WMIC.exe Token: SeIncreaseQuotaPrivilege 2536 WMIC.exe Token: SeSecurityPrivilege 2536 WMIC.exe Token: SeTakeOwnershipPrivilege 2536 WMIC.exe Token: SeLoadDriverPrivilege 2536 WMIC.exe Token: SeSystemProfilePrivilege 2536 WMIC.exe Token: SeSystemtimePrivilege 2536 WMIC.exe Token: SeProfSingleProcessPrivilege 2536 WMIC.exe Token: SeIncBasePriorityPrivilege 2536 WMIC.exe Token: SeCreatePagefilePrivilege 2536 WMIC.exe Token: SeBackupPrivilege 2536 WMIC.exe Token: SeRestorePrivilege 2536 WMIC.exe Token: SeShutdownPrivilege 2536 WMIC.exe Token: SeDebugPrivilege 2536 WMIC.exe Token: SeSystemEnvironmentPrivilege 2536 WMIC.exe Token: SeRemoteShutdownPrivilege 2536 WMIC.exe Token: SeUndockPrivilege 2536 WMIC.exe Token: SeManageVolumePrivilege 2536 WMIC.exe Token: 33 2536 WMIC.exe Token: 34 2536 WMIC.exe Token: 35 2536 WMIC.exe Token: SeShutdownPrivilege 2668 BetaUnfated.exe Token: SeShutdownPrivilege 2668 BetaUnfated.exe Token: SeDebugPrivilege 2412 tasklist.exe Token: SeIncreaseQuotaPrivilege 1040 WMIC.exe Token: SeSecurityPrivilege 1040 WMIC.exe Token: SeTakeOwnershipPrivilege 1040 WMIC.exe Token: SeLoadDriverPrivilege 1040 WMIC.exe Token: SeSystemProfilePrivilege 1040 WMIC.exe Token: SeSystemtimePrivilege 1040 WMIC.exe Token: SeProfSingleProcessPrivilege 1040 WMIC.exe Token: SeIncBasePriorityPrivilege 1040 WMIC.exe Token: SeCreatePagefilePrivilege 1040 WMIC.exe Token: SeBackupPrivilege 1040 WMIC.exe Token: SeRestorePrivilege 1040 WMIC.exe Token: SeShutdownPrivilege 1040 WMIC.exe Token: SeDebugPrivilege 1040 WMIC.exe Token: SeSystemEnvironmentPrivilege 1040 WMIC.exe Token: SeRemoteShutdownPrivilege 1040 WMIC.exe Token: SeUndockPrivilege 1040 WMIC.exe Token: SeManageVolumePrivilege 1040 WMIC.exe Token: 33 1040 WMIC.exe Token: 34 1040 WMIC.exe Token: 35 1040 WMIC.exe Token: SeIncreaseQuotaPrivilege 1040 WMIC.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2668 BetaUnfated.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2668 wrote to memory of 2712 2668 BetaUnfated.exe 30 PID 2668 wrote to memory of 2712 2668 BetaUnfated.exe 30 PID 2668 wrote to memory of 2712 2668 BetaUnfated.exe 30 PID 2712 wrote to memory of 2536 2712 cmd.exe 32 PID 2712 wrote to memory of 2536 2712 cmd.exe 32 PID 2712 wrote to memory of 2536 2712 cmd.exe 32 PID 2668 wrote to memory of 2428 2668 BetaUnfated.exe 33 PID 2668 wrote to memory of 2428 2668 BetaUnfated.exe 33 PID 2668 wrote to memory of 2428 2668 BetaUnfated.exe 33 PID 2668 wrote to memory of 2428 2668 BetaUnfated.exe 33 PID 2668 wrote to memory of 2428 2668 BetaUnfated.exe 33 PID 2668 wrote to memory of 2428 2668 BetaUnfated.exe 33 PID 2668 wrote to memory of 2428 2668 BetaUnfated.exe 33 PID 2668 wrote to memory of 2428 2668 BetaUnfated.exe 33 PID 2668 wrote to memory of 2428 2668 BetaUnfated.exe 33 PID 2668 wrote to memory of 2428 2668 BetaUnfated.exe 33 PID 2668 wrote to memory of 2428 2668 BetaUnfated.exe 33 PID 2668 wrote to memory of 2428 2668 BetaUnfated.exe 33 PID 2668 wrote to memory of 2428 2668 BetaUnfated.exe 33 PID 2668 wrote to memory of 2428 2668 BetaUnfated.exe 33 PID 2668 wrote to memory of 2428 2668 BetaUnfated.exe 33 PID 2668 wrote to memory of 2428 2668 BetaUnfated.exe 33 PID 2668 wrote to memory of 2428 2668 BetaUnfated.exe 33 PID 2668 wrote to memory of 2428 2668 BetaUnfated.exe 33 PID 2668 wrote to memory of 812 2668 BetaUnfated.exe 35 PID 2668 wrote to memory of 812 2668 BetaUnfated.exe 35 PID 2668 wrote to memory of 812 2668 BetaUnfated.exe 35 PID 2668 wrote to memory of 1996 2668 BetaUnfated.exe 36 PID 2668 wrote to memory of 1996 2668 BetaUnfated.exe 36 PID 2668 wrote to memory of 1996 2668 BetaUnfated.exe 36 PID 2668 wrote to memory of 1988 2668 BetaUnfated.exe 38 PID 2668 wrote to memory of 1988 2668 BetaUnfated.exe 38 PID 2668 wrote to memory of 1988 2668 BetaUnfated.exe 38 PID 1996 wrote to memory of 2180 1996 cmd.exe 41 PID 1996 wrote to memory of 2180 1996 cmd.exe 41 PID 1996 wrote to memory of 2180 1996 cmd.exe 41 PID 1988 wrote to memory of 2412 1988 cmd.exe 42 PID 1988 wrote to memory of 2412 1988 cmd.exe 42 PID 1988 wrote to memory of 2412 1988 cmd.exe 42 PID 812 wrote to memory of 864 812 cmd.exe 43 PID 812 wrote to memory of 864 812 cmd.exe 43 PID 812 wrote to memory of 864 812 cmd.exe 43 PID 2668 wrote to memory of 2716 2668 BetaUnfated.exe 44 PID 2668 wrote to memory of 2716 2668 BetaUnfated.exe 44 PID 2668 wrote to memory of 2716 2668 BetaUnfated.exe 44 PID 2716 wrote to memory of 1040 2716 cmd.exe 46 PID 2716 wrote to memory of 1040 2716 cmd.exe 46 PID 2716 wrote to memory of 1040 2716 cmd.exe 46 PID 2668 wrote to memory of 940 2668 BetaUnfated.exe 47 PID 2668 wrote to memory of 940 2668 BetaUnfated.exe 47 PID 2668 wrote to memory of 940 2668 BetaUnfated.exe 47 PID 940 wrote to memory of 1620 940 cmd.exe 49 PID 940 wrote to memory of 1620 940 cmd.exe 49 PID 940 wrote to memory of 1620 940 cmd.exe 49 PID 2668 wrote to memory of 2024 2668 BetaUnfated.exe 50 PID 2668 wrote to memory of 2024 2668 BetaUnfated.exe 50 PID 2668 wrote to memory of 2024 2668 BetaUnfated.exe 50 PID 2024 wrote to memory of 528 2024 cmd.exe 52 PID 2024 wrote to memory of 528 2024 cmd.exe 52 PID 2024 wrote to memory of 528 2024 cmd.exe 52 PID 528 wrote to memory of 468 528 cmd.exe 53 PID 528 wrote to memory of 468 528 cmd.exe 53 PID 528 wrote to memory of 468 528 cmd.exe 53 PID 2024 wrote to memory of 3056 2024 cmd.exe 54
Processes
-
C:\Users\Admin\AppData\Local\Temp\BetaUnfated.exe"C:\Users\Admin\AppData\Local\Temp\BetaUnfated.exe"1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Loads dropped DLL
- Checks for VirtualBox DLLs, possible anti-VM trick
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic CsProduct Get UUID"2⤵
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\System32\Wbem\WMIC.exewmic CsProduct Get UUID3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2536
-
-
-
C:\Users\Admin\AppData\Local\Temp\BetaUnfated.exe"C:\Users\Admin\AppData\Local\Temp\BetaUnfated.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\BetaUnfated" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1128 --field-trial-handle=1220,7876842049568711027,6430637027676635897,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵PID:2428
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions""2⤵
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions"3⤵PID:864
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath"2⤵
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath3⤵PID:2180
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2412
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List"2⤵
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\System32\Wbem\WMIC.exewmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1040
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
PID:1620
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "cmd /c chcp 65001>nul && netsh wlan show profiles"2⤵
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\system32\cmd.execmd /c chcp 650013⤵
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Windows\system32\chcp.comchcp 650014⤵PID:468
-
-
-
C:\Windows\system32\netsh.exenetsh wlan show profiles3⤵PID:3056
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsUpdater /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\0\WindowsUpdater.exe /f"2⤵PID:1356
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsUpdater /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\0\WindowsUpdater.exe /f3⤵
- Adds Run key to start application
PID:1148
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:2084
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:1444
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\epsilon-Admin\AutoFill Data\All Autofill Data.txt
- Size 240B
- SHA256 453478914b72d9056472fb1e44c69606c62331452f47a1f3c02190f26501785c
- MD5 810ae82f863a5ffae14d3b3944252a4e
- SHA1 5393e27113753191436b14f0cafa8acabcfe6b2a
- SHA512 2421a397dd2ebb17947167addacd3117f666ddab388e3678168075f58dc8eee15bb49a4aac2290140ae5102924852d27b538740a859d0b35245f505b20f29112
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\epsilon-Admin\Credit Cards\All Credit Cards.txt
- Size 231B
- SHA256 753b99d2b4e8c58bfd10995d0c2c19255fe9c8f53703bb27d1b6f76f1f4e83cc
- MD5 dec2be4f1ec3592cea668aa279e7cc9b
- SHA1 327cf8ab0c895e10674e00ea7f437784bb11d718
- SHA512 81728e3d31b72905b3a09c79d1e307c4e8e79d436fcfe7560a8046b46ca4ae994fdfaeb1bc2328e35f418b8128f2e7239289e84350e142146df9cde86b20bb66
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\BetaUnfated\Local Storage\leveldb\CURRENT~RFf76f892.TMP
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path \Users\Admin\AppData\Local\Temp\6afc665f-bc20-4d94-bd17-991bc500386a.tmp.node
- Size 2.7MB
- SHA256 7c999c84852b1f46a48f75b130fea445280d7032a56359dffecf36730366abc5
- MD5 08b28072c6d59fdf06a808182efed01f
- SHA1 35253af00af3308a64cff1eda104fd7227abb2f4
- SHA512 f2592ade5053b674dbe4191c7001748a801dca3b19e97e19b440a3e944011c87926b0ef21c87e98b48e038889a32e01c1d74949124be3144834e2f06d9781198
- SSDEEP 49152:IcbZZ3iGVhn8mIiiTINlF/sif0KPRrMg7HPM6A8:z9YqM6
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\81a62b6a-6118-453b-bf12-70a63d4fdcbf.tmp.node
- Size 163KB
- SHA256 8d6f5cab1d6a99ac49772080c6f383f33a9bb983e0f8d02d0f3de4b2bdd26215
- MD5 b0e113443ddc1ee234acbf0eb0e6f8a0
- SHA1 84cc562b82570ec05df6dbbfc8f29fbb16ec68c7
- SHA512 306e89ec66fdf8b0de19d5bcda01f69809d83f464a9c21fda4b470e81ad3b722aa6cb6086fb4c2af59504fe4332c1f9efff27168598cc00be0f28fed45dde8ee
- SSDEEP 3072:ka6VYNZlMDfTXQvj9PRl8OcQTpxNM0v1xYkNedgdv3I0l+MS7:kTVYMDfTgvj9PEjkvMt
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\8648bd85-63aa-4059-8c7f-934ff7589c44.tmp.node
- Size 652KB
- SHA256 b314ee85e8f31cb13b5ed4d602615814cf1615646dc76b8eec7dc27551d8ba33
- MD5 aeeb49ada6f1fb805239308e4c6adb55
- SHA1 9f309664c10b4e181e0637cbb1f9b954bbf8ca00
- SHA512 e49bbeb8ec7a003667db17bc129a806053e7b1b139ad5d5c86472ca8f9c20a31fb90aae79313cc17685473b909381b5931d7e34a1228d5e624b1c742dccfc843
- SSDEEP 6144:lZNXP5VGi4aC1+YGPa74q2fZZP/i/roNn23h18pOodXbgP94T:lZNXPHTC1+jPar2fDPa/ychQOoBgla
- MD5 SHA1 SHA512 SSDEEP