Malware Analysis Report

2024-11-15 06:40

Sample ID 240603-ktbmkaag84
Target Shaderify Beta 8.4.4.exe
SHA256 2bd09329ad4d791ebabbb6e37876ccbfba538231e91487d6fc9c7abe28ddfc64
Tags
execution persistence spyware stealer
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral27

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral30

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral24

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral28

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral29

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral31

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral25

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral26

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

2bd09329ad4d791ebabbb6e37876ccbfba538231e91487d6fc9c7abe28ddfc64

Threat Level: Likely malicious

The file Shaderify Beta 8.4.4.exe was found to be: Likely malicious.

Malicious Activity Summary

execution persistence spyware stealer

Command and Scripting Interpreter: PowerShell

Reads user/profile data of web browsers

Loads dropped DLL

Executes dropped EXE

Checks computer location settings

Adds Run key to start application

Looks up external IP address via web service

An obfuscated cmd.exe command-line is typically used to evade detection.

Enumerates physical storage devices

Program crash

Unsigned PE

Command and Scripting Interpreter: JavaScript

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Enumerates processes with tasklist

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Modifies Internet Explorer settings

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-03 08:54

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral15

Detonation Overview

Submitted

2024-06-03 08:53

Reported

2024-06-03 08:57

Platform

win10v2004-20240508-en

Max time kernel

145s

Max time network

154s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 52.111.229.43:443 tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 18.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral18

Detonation Overview

Submitted

2024-06-03 08:53

Reported

2024-06-03 08:57

Platform

win7-20240508-en

Max time kernel

119s

Max time network

124s

Command Line

wscript.exe C:\Users\Admin\AppData\Local\Temp\resources\app.js

Signatures

Command and Scripting Interpreter: JavaScript

execution

Processes

C:\Windows\system32\wscript.exe

wscript.exe C:\Users\Admin\AppData\Local\Temp\resources\app.js

Network

N/A

Files

N/A

Analysis: behavioral27

Detonation Overview

Submitted

2024-06-03 08:53

Reported

2024-06-03 08:56

Platform

win10v2004-20240426-en

Max time kernel

148s

Max time network

155s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 14.179.89.13.in-addr.arpa udp

Files

N/A

Analysis: behavioral12

Detonation Overview

Submitted

2024-06-03 08:53

Reported

2024-06-03 08:57

Platform

win7-20240221-en

Max time kernel

123s

Max time network

139s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral30

Detonation Overview

Submitted

2024-06-03 08:53

Reported

2024-06-03 08:57

Platform

win7-20240221-en

Max time kernel

117s

Max time network

127s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#1

Signatures

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1352 -s 228

Network

N/A

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-03 08:53

Reported

2024-06-03 08:56

Platform

win10v2004-20240426-en

Max time kernel

148s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Shaderify Beta 8.4.4.exe"

Signatures

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Powershell = "\"powershell.exe\" -WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\\Users\\Admin\\AppData\\Local\\Temp\\RINqpDWchkxmzsg.ps1\"" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ipapi.co N/A N/A
N/A ipapi.co N/A N/A

An obfuscated cmd.exe command-line is typically used to evade detection.

Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\system32\cmd.exe N/A

Enumerates physical storage devices

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Shaderify Beta 8.4.4.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3012 wrote to memory of 4360 N/A C:\Users\Admin\AppData\Local\Temp\Shaderify Beta 8.4.4.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 3012 wrote to memory of 4360 N/A C:\Users\Admin\AppData\Local\Temp\Shaderify Beta 8.4.4.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 4360 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Windows\system32\cmd.exe
PID 4360 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Windows\system32\cmd.exe
PID 4360 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Windows\system32\cmd.exe
PID 4360 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Windows\system32\cmd.exe
PID 2284 wrote to memory of 656 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2284 wrote to memory of 656 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3472 wrote to memory of 4792 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 3472 wrote to memory of 4792 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 656 wrote to memory of 2224 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
PID 656 wrote to memory of 2224 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
PID 4360 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Windows\system32\cmd.exe
PID 4360 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Windows\system32\cmd.exe
PID 2208 wrote to memory of 4624 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2208 wrote to memory of 4624 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2224 wrote to memory of 1812 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
PID 2224 wrote to memory of 1812 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
PID 4360 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Windows\system32\cmd.exe
PID 4360 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Windows\system32\cmd.exe
PID 3448 wrote to memory of 4884 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3448 wrote to memory of 4884 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4360 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 4360 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 4360 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 4360 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 4360 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 4360 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 4360 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 4360 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 4360 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 4360 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 4360 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 4360 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 4360 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 4360 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 4360 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 4360 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 4360 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 4360 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 4360 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 4360 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 4360 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 4360 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 4360 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 4360 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 4360 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 4360 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 4360 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 4360 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 4360 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 4360 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 4360 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 4360 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 4360 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 4360 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 4360 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 4360 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 4360 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 4360 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 4360 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 4360 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 4360 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 4360 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Shaderify Beta 8.4.4.exe

"C:\Users\Admin\AppData\Local\Temp\Shaderify Beta 8.4.4.exe"

C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe

C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\ProgramData\edge\Updater\Get-Clipboard.ps1""

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\ProgramData\edge\Updater\Get-Clipboard.ps1"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wkezjkl4\wkezjkl4.cmdline"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,21,13,251,61,125,41,113,73,181,63,165,1,91,36,248,68,0,0,0,0,2,0,0,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,52,149,19,144,89,112,59,59,251,229,141,202,64,101,240,104,137,13,3,69,53,156,155,146,175,90,146,162,246,238,201,90,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,8,59,176,18,137,226,140,52,19,171,62,247,31,153,110,138,40,43,108,72,120,10,22,206,204,166,195,251,206,76,84,236,48,0,0,0,182,67,21,24,178,28,183,38,171,5,235,33,128,96,100,191,115,29,3,244,255,89,222,94,221,44,46,134,199,244,235,56,71,157,109,19,168,133,44,36,119,44,14,122,209,122,31,112,64,0,0,0,122,214,19,81,118,163,136,78,57,148,251,210,240,3,134,99,156,175,50,154,230,153,101,220,35,132,92,147,223,230,14,232,202,102,120,97,201,199,70,225,226,97,114,2,149,239,63,52,211,209,152,49,2,92,152,238,148,185,58,73,30,45,12,201), $null, 'CurrentUser')"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,21,13,251,61,125,41,113,73,181,63,165,1,91,36,248,68,0,0,0,0,2,0,0,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,52,149,19,144,89,112,59,59,251,229,141,202,64,101,240,104,137,13,3,69,53,156,155,146,175,90,146,162,246,238,201,90,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,8,59,176,18,137,226,140,52,19,171,62,247,31,153,110,138,40,43,108,72,120,10,22,206,204,166,195,251,206,76,84,236,48,0,0,0,182,67,21,24,178,28,183,38,171,5,235,33,128,96,100,191,115,29,3,244,255,89,222,94,221,44,46,134,199,244,235,56,71,157,109,19,168,133,44,36,119,44,14,122,209,122,31,112,64,0,0,0,122,214,19,81,118,163,136,78,57,148,251,210,240,3,134,99,156,175,50,154,230,153,101,220,35,132,92,147,223,230,14,232,202,102,120,97,201,199,70,225,226,97,114,2,149,239,63,52,211,209,152,49,2,92,152,238,148,185,58,73,30,45,12,201), $null, 'CurrentUser')

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4DC2.tmp" "c:\Users\Admin\AppData\Local\Temp\wkezjkl4\CSC8B5D8988B1464AE885AC9483C8AE36D8.TMP"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,21,13,251,61,125,41,113,73,181,63,165,1,91,36,248,68,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,87,225,225,105,74,250,17,14,121,162,50,56,214,71,202,251,32,121,40,26,5,205,214,52,26,191,58,177,200,241,246,155,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,137,230,184,142,248,175,36,120,222,4,110,117,60,85,255,52,21,39,177,126,38,76,194,9,75,54,127,87,52,196,251,57,48,0,0,0,62,242,129,76,25,82,189,44,92,5,130,128,156,115,35,25,175,83,81,85,159,232,192,255,184,181,3,127,179,216,232,85,78,47,144,255,115,62,133,108,75,82,5,154,21,128,253,243,64,0,0,0,96,3,115,172,134,228,139,54,161,25,254,150,216,24,138,103,124,43,211,181,183,191,211,17,78,104,20,9,218,8,230,157,99,145,15,109,156,238,65,113,104,211,133,73,126,187,22,212,132,81,131,66,39,202,237,184,142,225,59,166,44,170,47,76), $null, 'CurrentUser')"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,21,13,251,61,125,41,113,73,181,63,165,1,91,36,248,68,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,87,225,225,105,74,250,17,14,121,162,50,56,214,71,202,251,32,121,40,26,5,205,214,52,26,191,58,177,200,241,246,155,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,137,230,184,142,248,175,36,120,222,4,110,117,60,85,255,52,21,39,177,126,38,76,194,9,75,54,127,87,52,196,251,57,48,0,0,0,62,242,129,76,25,82,189,44,92,5,130,128,156,115,35,25,175,83,81,85,159,232,192,255,184,181,3,127,179,216,232,85,78,47,144,255,115,62,133,108,75,82,5,154,21,128,253,243,64,0,0,0,96,3,115,172,134,228,139,54,161,25,254,150,216,24,138,103,124,43,211,181,183,191,211,17,78,104,20,9,218,8,230,157,99,145,15,109,156,238,65,113,104,211,133,73,126,187,22,212,132,81,131,66,39,202,237,184,142,225,59,166,44,170,47,76), $null, 'CurrentUser')

C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe

"C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe" --type=gpu-process --field-trial-handle=1840,1509777136373570988,2685637573067112331,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1844 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe

"C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1840,1509777136373570988,2685637573067112331,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2124 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe

"C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe" --type=gpu-process --field-trial-handle=1840,1509777136373570988,2685637573067112331,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=MAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAIAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1344 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 shaderify.xyz udp
US 8.8.8.8:53 ipapi.co udp
US 104.21.62.38:443 shaderify.xyz tcp
US 104.26.9.44:443 ipapi.co tcp
US 104.21.62.38:443 shaderify.xyz tcp
US 104.21.62.38:443 shaderify.xyz tcp
US 104.21.62.38:443 shaderify.xyz tcp
US 104.21.62.38:443 shaderify.xyz tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 44.9.26.104.in-addr.arpa udp
US 8.8.8.8:53 38.62.21.104.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 106.246.116.51.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\nsf3AB8.tmp\System.dll

MD5 75ed96254fbf894e42058062b4b4f0d1
SHA1 996503f1383b49021eb3427bc28d13b5bbd11977
SHA256 a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
SHA512 58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4

C:\Users\Admin\AppData\Local\Temp\nsf3AB8.tmp\nsis7z.dll

MD5 c6a070b3e68b292bb0efc9b26e85e9cc
SHA1 5a922b96eda6595a68fd0a9051236162ff2e2ada
SHA256 66ac8bd1f273a73e17a3f31d6add739d3cb0330a6417faeda11a9cae00b62d8b
SHA512 8eff8fc16f5bb574bd9483e3b217b67a8986e31497368c06fdaa3a1e93a40aee94a5b31729d01905157b0ae1e556a402f43cd29a4d30a0587e1ec334458a44e8

C:\Users\Admin\AppData\Local\Temp\nsf3AB8.tmp\StdUtils.dll

MD5 33b4e69e7835e18b9437623367dd1787
SHA1 53afa03edaf931abdc2d828e5a2c89ad573d926c
SHA256 72d38ef115e71fc73dc5978987c583fc8c6b50ff12e4a5d30649a4d164a8b6ae
SHA512 ca890e785d1a0a7e0b4a748416fba417826ae66b46e600f407d4e795b444612a8b830f579f2cf5b6e051bea800604f34f8801cc3daf05c8d29ad05bcda454a77

C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ffmpeg.dll

MD5 eabfc10d56cb44a86493cb2f8ca7aab2
SHA1 09d7e87f43527333cd021329d6c2f4e8bd8ddab5
SHA256 42a2a996ac433ac33a22776b8418a82753557093d90147b7951138b5c83924b6
SHA512 ee31e3539fba9e5969a9f38c428f586de2dd7630cb5d8c5e3c2c934b5881f8176b8ab6ef6397c1ce4fa6ccf3ee9615225c7afa0e0b28c6fc23974e8b96625dec

C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\v8_context_snapshot.bin

MD5 c2208c06c8ff81bca3c092cc42b8df1b
SHA1 f7b9faa9ba0e72d062f68642a02cc8f3fed49910
SHA256 4a67de195878d290f49b503b83e415917b8bbcbd9936b07a5d33b48e9bc6e0a3
SHA512 6c3c370dd086a976c44d4059a315bd3bcbb50961aa34734e65a40d861cffca9090d47cec74575afe23952e394e4845bda2d8798eebe01fb54a7a6288bce238f5

C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\icudtl.dat

MD5 ad2988770b8cb3281a28783ad833a201
SHA1 94b7586ee187d9b58405485f4c551b55615f11b5
SHA256 df876c7af43ed93eec6aea4d2d55c805009c219653cdeb368f1d048f4922b108
SHA512 f27e542a9c6c60fa28c5b7cc2818079341ef93aef3bbcadecad2dc11aff5b1592b19c7ebfa543ea42a3cbfec26a668641b255545fb0912056e25e852c2dedd01

C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\resources\app.asar

MD5 9fc83d8c2973e2b71a40fa3d9a645d24
SHA1 e8de86beee4a3373337420922a9e2d03f2006199
SHA256 6ee130d45c67311acd315bb7b1390df04bb0350a879f602f88d91b127334b81c
SHA512 050349ac8cafe1624109f78f7bc4a33a9f8214e02c8e63acac6fade250761513111e1fc3fadc1f0e53703a91ec354522179483b91a382eeab14bbd5b4969867b

C:\Users\Admin\AppData\Local\Temp\b84a949a-8533-42cb-a100-a7916e0e3bff.tmp.node

MD5 56192831a7f808874207ba593f464415
SHA1 e0c18c72a62692d856da1f8988b0bc9c8088d2aa
SHA256 6aa8763714aa5199a4065259af792292c2a7d6a2c381aa27007255421e5c9d8c
SHA512 c82aa1ef569c232b4b4f98a3789f2390e5f7bf5cc7e73d199fe23a3f636817edfdc2fb49ce7f69169c028a9dd5ab9f63e8f64964bb22424fc08db71e85054a33

memory/656-182-0x0000022358860000-0x0000022358882000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cl5mwhp5.ms5.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\ProgramData\edge\Updater\Get-Clipboard.ps1

MD5 52cc110bb3777aa6bba7900630d4eb49
SHA1 3663dc658fd13d407e49781d1a5c2aa203c252fc
SHA256 892a9edb03db3fd88fecc1e1a2f56a7339f16f6734e8d77e6538ea2c8c9026d6
SHA512 89b80d2783e902d68ffd08b6f3fb1848ae6e6c4bf2d7a1e4afdac970b2ee6ffcc58116cdd6234e3d6278eb9413d36aafe62b5beca24a0846575d12af0c5112ab

\??\c:\Users\Admin\AppData\Local\Temp\wkezjkl4\wkezjkl4.cmdline

MD5 1f7e43c8dd997df7b17a87a843806bd0
SHA1 b11a922bba598e0e2b3322104d0642fe5ff47a36
SHA256 c53a03ffd94066aa747ed39c0e1aab50ad8148b595c5e0e874a3b1e1ed52e827
SHA512 66f63708eef747a95f066908ed9014e44b0bbc51aca39dd204a636a0748a94febadc69f8569ee119284bccee31186fcd5be0a9164770e694162bb3acdfd7678d

\??\c:\Users\Admin\AppData\Local\Temp\wkezjkl4\wkezjkl4.0.cs

MD5 b462a7b0998b386a2047c941506f7c1b
SHA1 61e8aa007164305a51fa2f1cebaf3f8e60a6a59f
SHA256 a81f86cd4d33ebbf2b725df6702b8f6b3c31627bf52eb1cadc1e40b1c0c2bb35
SHA512 eb41b838cc5726f4d1601d3c68d455203d3c23f17469b3c8cbdd552f479f14829856d699f310dec05fe7504a2ae511d0b7ffff6b66ceadb5a225efe3e2f3a020

\??\c:\Users\Admin\AppData\Local\Temp\wkezjkl4\CSC8B5D8988B1464AE885AC9483C8AE36D8.TMP

MD5 d3d58930dc7bbe3f96825cfce06cdd0b
SHA1 0246d0ff700f0c445257c619c0d8702a6a8919d6
SHA256 3961f41743de7c191778278209702e45fea3604bfa59385f2c472929c4f63ef2
SHA512 a109a54c30cb808ed1bf2ff6926dbe66d0c15ddb5158bf651f6273d96b5f310dc2776327b1a16e7ff7e7b0a57f3c8fd9b6291e0a21fa267b9717d1dc6a854861

C:\Users\Admin\AppData\Local\Temp\RES4DC2.tmp

MD5 1717a858fd499e6bf709acd8fdd770d4
SHA1 c256eb915102edbeca532fd2ef074a3376236192
SHA256 1d966328d26b94e86028b5c9b2dd02ec09935b9261b92adc38ffbc150fd64a18
SHA512 be94fe2143102eb5a7daa6fd5702a13ba8b47b8ccfe5a8f511a1d084101a96bceaac14cff7231c751f3ee74a836a065433dd230fe8ce06d2a7e6db26921ddcef

C:\Users\Admin\AppData\Local\Temp\wkezjkl4\wkezjkl4.dll

MD5 ed109863926f5575afc55875429b2ee8
SHA1 efa509b8334abc68ea52f2aa23ed1bdcbd910707
SHA256 9cabcedaa0a3567194688359c0825a6a1b65a2a19e2fc5887ec4c99ac91bc6d2
SHA512 db7448b8194c41381c1b705a17538a6472d035cd43da15ae5129f5c967cb5daf951f9c586b91b8afe2a2f10d946b73c6c1a85ec84cc3f146ada372c0b4847484

memory/656-207-0x00000223588D0000-0x00000223588D8000-memory.dmp

memory/4624-210-0x000001A9FED90000-0x000001A9FEDE0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 f48896adf9a23882050cdff97f610a7f
SHA1 4c5a610df62834d43f470cae7e851946530e3086
SHA256 3ae35c2828715a2f9a5531d334a0cfffc81396c2dc058ca42a9943f3cdc22e78
SHA512 16644246f2a35a186fcb5c2b6456ed6a16e8db65ad1383109e06547f9b1f9358f071c30cca541ca4cf7bae66cb534535e88f75f6296a4bfc6c7b22b0684a6ba9

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d358fd72a9c8adac36ad1f4e06d7c892
SHA1 a068b9af680e94996eaa99e9dcb4a4ee6f311e56
SHA256 309d625be93fe6ff8376930ba8a84ba845f59c6fd7ef038820d71d099aebf76e
SHA512 8c95254675917c25550f023396c64a6a02ba9adcfd6b7f156abebe4a9d85d65100f3cada43debd747cb7dddad88b21e0c44dad7e288e009b2f3d099c49bd4715

C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\chrome_100_percent.pak

MD5 06baf0ad34e0231bd76651203dba8326
SHA1 a5f99ecdcc06dec9d7f9ce0a8c66e46969117391
SHA256 5ae14147992a92548bcad76867dd88cdfcdb69d951c8720920cce6fb135e3189
SHA512 aff6616e56781ebb925a0ca146245ad3b2827250b32261c0c7c0d5b10b20a343a17fc3761c95d93104163e77b2eae3f1f9cbd3cb2b377f49b42bea39bdd09b91

C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\chrome_200_percent.pak

MD5 57c27201e7cd33471da7ec205fe9973c
SHA1 a8e7bce09c4cbdae2797611b2be8aeb5491036f9
SHA256 dd8146b2ee289e4d54a4a0f1fd3b2f61b979c6a2baaba96a406d96c3f4fdb33b
SHA512 57258aa169bec66abf0f45a3e026bb68751fb970b74bd0cb465607fa3b2a89967e832d92d8f675f0449bb6662fcb7786d05f0597124cc8e18bb99a47245779b4

C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\resources.pak

MD5 d13873f6fb051266deb3599b14535806
SHA1 143782c0ce5a5773ae0aae7a22377c8a6d18a5b2
SHA256 7b953443e3cd54a0a4775528b52fbfe5ebecbc2c71731600ed0999d227969506
SHA512 1ab38fcb70d1958c74da2493459532b52a04b884009509a1ac8dd39f6e9e670658a52f4d19ef57f1bc71dccfdd6ceedbc18034bbcad0b500d75a97c74aac6939

C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\locales\en-US.pak

MD5 bd8f7b719110342b7cefb16ddd05ec55
SHA1 82a79aeaa1dd4b1464b67053ba1766a4498c13e7
SHA256 d1d3f892be16329c79f9a8ee8c5fa1c9fb46d17edfeb56a3d9407f9d7587a0de
SHA512 7cd1493e59e87c70927e66769eb200f79a57e1eb1223af4eb4064088571893d3e32cbc4b5ece568fd308992aad65684aa280dc9834f2b5d327bdee514b046e5e

C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\Admincookies.zip

MD5 76cdb2bad9582d23c1f6f4d868218d6c
SHA1 b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
SHA256 8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
SHA512 5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f

memory/2696-241-0x00007FFE571C0000-0x00007FFE571C1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\D3DCompiler_47.dll

MD5 7641e39b7da4077084d2afe7c31032e0
SHA1 2256644f69435ff2fee76deb04d918083960d1eb
SHA256 44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
SHA512 8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5

C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\libglesv2.dll

MD5 bc45db0195aa369cc3c572e4e9eefc7e
SHA1 b880ca4933656be52f027028af5ef8a3b7e07e97
SHA256 a81729fd6ee2d64dfc47501a1d53794cdeee5c1daa3751f7554aea2503686d10
SHA512 dd8c39947e7d767fbdccf90c5b3eaedf3937b43c55200d2199107333b63ac09e5356c286618874fac841e1357dd927e0c70b5066c1feeedd8cc6c0fba605ee5f

C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\libegl.dll

MD5 660a9ae1282e6205fc0a51e64470eb5b
SHA1 f91a9c9559f51a8f33a552f0145ed9e706909de8
SHA256 f2a841b6ef320f226965c7cb01fbc4709fc31425e490a3edfa20147ce3656c85
SHA512 20bed2bed042033e3d8b077f9d66bce67922aaec180cc3777f20560219226b7efc73932bb87445afda4e3877472ddcd307215d23954cd082051437e5f2224263

memory/2696-270-0x00000221BA620000-0x00000221BAD5F000-memory.dmp

Analysis: behavioral14

Detonation Overview

Submitted

2024-06-03 08:53

Reported

2024-06-03 08:57

Platform

win7-20240221-en

Max time kernel

121s

Max time network

125s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral23

Detonation Overview

Submitted

2024-06-03 08:53

Reported

2024-06-03 08:57

Platform

win10v2004-20240226-en

Max time kernel

145s

Max time network

163s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libEGL.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libEGL.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4956 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 13.107.253.67:443 tcp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 93.65.42.20.in-addr.arpa udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
GB 142.250.200.42:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 42.200.250.142.in-addr.arpa udp

Files

N/A

Analysis: behavioral24

Detonation Overview

Submitted

2024-06-03 08:53

Reported

2024-06-03 08:57

Platform

win7-20240221-en

Max time kernel

117s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libGLESv2.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libGLESv2.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-03 08:53

Reported

2024-06-03 08:56

Platform

win7-20240508-en

Max time kernel

150s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Shaderify Beta 8.4.4.exe"

Signatures

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Shaderify Beta 8.4.4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Shaderify Beta 8.4.4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Shaderify Beta 8.4.4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Shaderify Beta 8.4.4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\Powershell = "\"powershell.exe\" -WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\\Users\\Admin\\AppData\\Local\\Temp\\YhXCExPtrzUlyvQ.ps1\"" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ipapi.co N/A N/A
N/A ipapi.co N/A N/A

An obfuscated cmd.exe command-line is typically used to evade detection.

Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A

Enumerates physical storage devices

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Shaderify Beta 8.4.4.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2892 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\Shaderify Beta 8.4.4.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 2892 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\Shaderify Beta 8.4.4.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 2892 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\Shaderify Beta 8.4.4.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 2892 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\Shaderify Beta 8.4.4.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 2504 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Windows\system32\cmd.exe
PID 2504 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Windows\system32\cmd.exe
PID 2504 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Windows\system32\cmd.exe
PID 2504 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Windows\system32\cmd.exe
PID 2504 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Windows\system32\cmd.exe
PID 2504 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Windows\system32\cmd.exe
PID 1056 wrote to memory of 1708 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1056 wrote to memory of 1708 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1056 wrote to memory of 1708 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1632 wrote to memory of 2616 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1632 wrote to memory of 2616 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1632 wrote to memory of 2616 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1708 wrote to memory of 3052 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
PID 1708 wrote to memory of 3052 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
PID 1708 wrote to memory of 3052 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
PID 2504 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Windows\system32\cmd.exe
PID 2504 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Windows\system32\cmd.exe
PID 2504 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Windows\system32\cmd.exe
PID 3052 wrote to memory of 1692 N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 3052 wrote to memory of 1692 N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 3052 wrote to memory of 1692 N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 2080 wrote to memory of 2376 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2080 wrote to memory of 2376 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2080 wrote to memory of 2376 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2504 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 2504 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 2504 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 2504 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 2504 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 2504 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 2504 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 2504 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 2504 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 2504 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 2504 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 2504 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 2504 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 2504 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 2504 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 2504 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 2504 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 2504 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 2504 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 2504 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 2504 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 2504 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 2504 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 2504 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 2504 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 2504 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 2504 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 2504 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 2504 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 2504 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 2504 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 2504 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 2504 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 2504 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 2504 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
PID 2504 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Shaderify Beta 8.4.4.exe

"C:\Users\Admin\AppData\Local\Temp\Shaderify Beta 8.4.4.exe"

C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe

C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\ProgramData\edge\Updater\Get-Clipboard.ps1""

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\ProgramData\edge\Updater\Get-Clipboard.ps1"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fojl7zlc.cmdline"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,88,113,4,176,210,247,218,64,146,8,207,58,233,231,122,35,0,0,0,0,2,0,0,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,198,174,129,137,14,197,109,52,156,10,22,195,216,222,164,189,67,241,179,124,202,149,124,70,51,160,45,114,92,47,134,110,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,49,106,159,15,167,171,146,10,64,132,198,226,228,113,65,90,139,16,200,210,13,221,227,16,10,227,43,213,135,187,88,34,48,0,0,0,39,106,83,106,82,239,82,53,166,75,36,151,0,61,83,22,113,230,29,198,228,209,223,173,181,154,238,44,210,195,137,76,226,171,180,154,28,186,223,85,229,165,41,15,44,229,216,76,64,0,0,0,147,72,81,112,14,20,177,155,252,73,198,50,42,143,71,147,29,124,3,113,127,2,21,61,110,104,3,184,141,152,188,32,221,95,127,71,149,63,13,54,104,25,210,103,47,252,0,7,253,69,145,102,65,33,56,221,190,182,253,102,179,78,2,67), $null, 'CurrentUser')"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES424F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC423E.tmp"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,88,113,4,176,210,247,218,64,146,8,207,58,233,231,122,35,0,0,0,0,2,0,0,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,198,174,129,137,14,197,109,52,156,10,22,195,216,222,164,189,67,241,179,124,202,149,124,70,51,160,45,114,92,47,134,110,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,49,106,159,15,167,171,146,10,64,132,198,226,228,113,65,90,139,16,200,210,13,221,227,16,10,227,43,213,135,187,88,34,48,0,0,0,39,106,83,106,82,239,82,53,166,75,36,151,0,61,83,22,113,230,29,198,228,209,223,173,181,154,238,44,210,195,137,76,226,171,180,154,28,186,223,85,229,165,41,15,44,229,216,76,64,0,0,0,147,72,81,112,14,20,177,155,252,73,198,50,42,143,71,147,29,124,3,113,127,2,21,61,110,104,3,184,141,152,188,32,221,95,127,71,149,63,13,54,104,25,210,103,47,252,0,7,253,69,145,102,65,33,56,221,190,182,253,102,179,78,2,67), $null, 'CurrentUser')

C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe

"C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe" --type=gpu-process --field-trial-handle=1128,4165107081401958544,4131634197973876802,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1136 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe

"C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1128,4165107081401958544,4131634197973876802,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1540 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe

"C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe" --type=gpu-process --field-trial-handle=1128,4165107081401958544,4131634197973876802,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1336 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 shaderify.xyz udp
US 8.8.8.8:53 ipapi.co udp
US 104.21.62.38:443 shaderify.xyz tcp
US 172.67.69.226:443 ipapi.co tcp
US 104.21.62.38:443 shaderify.xyz tcp
US 104.21.62.38:443 shaderify.xyz tcp
US 104.21.62.38:443 shaderify.xyz tcp
US 104.21.62.38:443 shaderify.xyz tcp

Files

\Users\Admin\AppData\Local\Temp\nsi316D.tmp\System.dll

MD5 75ed96254fbf894e42058062b4b4f0d1
SHA1 996503f1383b49021eb3427bc28d13b5bbd11977
SHA256 a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
SHA512 58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4

\Users\Admin\AppData\Local\Temp\nsi316D.tmp\nsis7z.dll

MD5 c6a070b3e68b292bb0efc9b26e85e9cc
SHA1 5a922b96eda6595a68fd0a9051236162ff2e2ada
SHA256 66ac8bd1f273a73e17a3f31d6add739d3cb0330a6417faeda11a9cae00b62d8b
SHA512 8eff8fc16f5bb574bd9483e3b217b67a8986e31497368c06fdaa3a1e93a40aee94a5b31729d01905157b0ae1e556a402f43cd29a4d30a0587e1ec334458a44e8

\Users\Admin\AppData\Local\Temp\nsi316D.tmp\StdUtils.dll

MD5 33b4e69e7835e18b9437623367dd1787
SHA1 53afa03edaf931abdc2d828e5a2c89ad573d926c
SHA256 72d38ef115e71fc73dc5978987c583fc8c6b50ff12e4a5d30649a4d164a8b6ae
SHA512 ca890e785d1a0a7e0b4a748416fba417826ae66b46e600f407d4e795b444612a8b830f579f2cf5b6e051bea800604f34f8801cc3daf05c8d29ad05bcda454a77

C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ffmpeg.dll

MD5 eabfc10d56cb44a86493cb2f8ca7aab2
SHA1 09d7e87f43527333cd021329d6c2f4e8bd8ddab5
SHA256 42a2a996ac433ac33a22776b8418a82753557093d90147b7951138b5c83924b6
SHA512 ee31e3539fba9e5969a9f38c428f586de2dd7630cb5d8c5e3c2c934b5881f8176b8ab6ef6397c1ce4fa6ccf3ee9615225c7afa0e0b28c6fc23974e8b96625dec

C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\v8_context_snapshot.bin

MD5 c2208c06c8ff81bca3c092cc42b8df1b
SHA1 f7b9faa9ba0e72d062f68642a02cc8f3fed49910
SHA256 4a67de195878d290f49b503b83e415917b8bbcbd9936b07a5d33b48e9bc6e0a3
SHA512 6c3c370dd086a976c44d4059a315bd3bcbb50961aa34734e65a40d861cffca9090d47cec74575afe23952e394e4845bda2d8798eebe01fb54a7a6288bce238f5

C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\icudtl.dat

MD5 ad2988770b8cb3281a28783ad833a201
SHA1 94b7586ee187d9b58405485f4c551b55615f11b5
SHA256 df876c7af43ed93eec6aea4d2d55c805009c219653cdeb368f1d048f4922b108
SHA512 f27e542a9c6c60fa28c5b7cc2818079341ef93aef3bbcadecad2dc11aff5b1592b19c7ebfa543ea42a3cbfec26a668641b255545fb0912056e25e852c2dedd01

C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\resources\app.asar

MD5 9fc83d8c2973e2b71a40fa3d9a645d24
SHA1 e8de86beee4a3373337420922a9e2d03f2006199
SHA256 6ee130d45c67311acd315bb7b1390df04bb0350a879f602f88d91b127334b81c
SHA512 050349ac8cafe1624109f78f7bc4a33a9f8214e02c8e63acac6fade250761513111e1fc3fadc1f0e53703a91ec354522179483b91a382eeab14bbd5b4969867b

\Users\Admin\AppData\Local\Temp\668c25df-2e3e-4d39-9c0f-cc7511a9b557.tmp.node

MD5 56192831a7f808874207ba593f464415
SHA1 e0c18c72a62692d856da1f8988b0bc9c8088d2aa
SHA256 6aa8763714aa5199a4065259af792292c2a7d6a2c381aa27007255421e5c9d8c
SHA512 c82aa1ef569c232b4b4f98a3789f2390e5f7bf5cc7e73d199fe23a3f636817edfdc2fb49ce7f69169c028a9dd5ab9f63e8f64964bb22424fc08db71e85054a33

memory/1708-181-0x000000001B620000-0x000000001B902000-memory.dmp

memory/1708-182-0x0000000001D80000-0x0000000001D88000-memory.dmp

C:\ProgramData\edge\Updater\Get-Clipboard.ps1

MD5 52cc110bb3777aa6bba7900630d4eb49
SHA1 3663dc658fd13d407e49781d1a5c2aa203c252fc
SHA256 892a9edb03db3fd88fecc1e1a2f56a7339f16f6734e8d77e6538ea2c8c9026d6
SHA512 89b80d2783e902d68ffd08b6f3fb1848ae6e6c4bf2d7a1e4afdac970b2ee6ffcc58116cdd6234e3d6278eb9413d36aafe62b5beca24a0846575d12af0c5112ab

\??\c:\Users\Admin\AppData\Local\Temp\fojl7zlc.cmdline

MD5 3ddccc7706037cb30eb9e1c6f94d6ff4
SHA1 43c749bfd7bb8e707408f428efd84914a67ee75d
SHA256 3fd460bf6be16c8c96bec8288a9d130f33dc323ce18213edd878abb201a00dc1
SHA512 b97c0b606972cc0424fa7cd93358bcab29f27849a63499f345d8434dcbfedb9437e793d1de4dee05fad843128644aa357df6a153c7b92f1b8aebb6ded090e899

\??\c:\Users\Admin\AppData\Local\Temp\fojl7zlc.0.cs

MD5 b462a7b0998b386a2047c941506f7c1b
SHA1 61e8aa007164305a51fa2f1cebaf3f8e60a6a59f
SHA256 a81f86cd4d33ebbf2b725df6702b8f6b3c31627bf52eb1cadc1e40b1c0c2bb35
SHA512 eb41b838cc5726f4d1601d3c68d455203d3c23f17469b3c8cbdd552f479f14829856d699f310dec05fe7504a2ae511d0b7ffff6b66ceadb5a225efe3e2f3a020

C:\Users\Admin\AppData\Local\Temp\RES424F.tmp

MD5 2d34d379030cd98a85f9413c7917d4eb
SHA1 597e0bcc7a5ef442f9e15b4e05493fda1b2393b6
SHA256 5bc19355bccdc5a4fbf06c4d1c33116428270a59ed56dba80cd32ae782b63df1
SHA512 3ebfadc8f567b8d03c70b4b45dcd4657c5118a4558e8c7f2669c2356843151769dd85eee46e20934d0f432de3c4c3d16bdf4433a11fa91489a111f15a71c4841

\??\c:\Users\Admin\AppData\Local\Temp\CSC423E.tmp

MD5 9a9e57cdc56eae3ce5243796414cc9d7
SHA1 c2136ed63723af4feef31fa6617ab34ec7b74b03
SHA256 e1124f552e8fd30d4f8bb6ef5642eafbfb70b8e556a5e9838d3cfe318e597afe
SHA512 7f763fb6caa1d3826df36d1d90b99fbc97ccb6bd26d7cc4f8098db44d54718b4b9ecad3e419cd8a05f1d06a7bc50e4ea7a73114d78a5bbfcadcb4bf62c6199de

C:\Users\Admin\AppData\Local\Temp\fojl7zlc.dll

MD5 c4ae837ff066e3e9c638bb0c1636b114
SHA1 112073063868b8acfd669d7155b263a16ea8302d
SHA256 9fc87b69238846fc416beddccbf8eab5139495fc1ad90dffc1411c10389145a6
SHA512 e434b8efe131b017478dd8bf8f281c4929a986183bf301a0119492fd1903d77619b0718bb2a7c001bbab530b368da28a498fadf724839190007fa0c6c75d2641

C:\Users\Admin\AppData\Local\Temp\fojl7zlc.pdb

MD5 ebf6306c22cd4bc12f198867bec80b17
SHA1 dc80b25dd9a2001ff3d3581603de6d968f75341d
SHA256 c73480bd4036e2c6747932f899cb7d2e1b254519df01bce03c9f765fd8f130f6
SHA512 f1930aa16e064de5d988445535b7744f717e953479e6840b41e71165d25e729849dd2adee0124f9254ce9249fcd3005e4a3095dc01a55dee7b7f16efcdce45d8

memory/1708-201-0x0000000002C10000-0x0000000002C18000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 5cdae2cf2a77e0c8e0c9de90231a96bd
SHA1 6ba9aac2046e4eb3598e149216fd42b99b55b714
SHA256 e4ee4b6886e481019a40762c59b82226d0bdeac3b4130daac270dc7e3a2cac0f
SHA512 e52677153520612ff815b3b70073d79930526adef2efbece454c48588907f8b432c67e186f6a4fec9a42ddb1cefd0b2200d2b81e4bd08025ce76aacdc3bb3a15

memory/1384-255-0x0000000077300000-0x0000000077301000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\Admincookies.zip

MD5 76cdb2bad9582d23c1f6f4d868218d6c
SHA1 b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
SHA256 8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
SHA512 5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f

memory/1384-222-0x0000000000060000-0x0000000000061000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\resources.pak

MD5 d13873f6fb051266deb3599b14535806
SHA1 143782c0ce5a5773ae0aae7a22377c8a6d18a5b2
SHA256 7b953443e3cd54a0a4775528b52fbfe5ebecbc2c71731600ed0999d227969506
SHA512 1ab38fcb70d1958c74da2493459532b52a04b884009509a1ac8dd39f6e9e670658a52f4d19ef57f1bc71dccfdd6ceedbc18034bbcad0b500d75a97c74aac6939

C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\locales\en-US.pak

MD5 bd8f7b719110342b7cefb16ddd05ec55
SHA1 82a79aeaa1dd4b1464b67053ba1766a4498c13e7
SHA256 d1d3f892be16329c79f9a8ee8c5fa1c9fb46d17edfeb56a3d9407f9d7587a0de
SHA512 7cd1493e59e87c70927e66769eb200f79a57e1eb1223af4eb4064088571893d3e32cbc4b5ece568fd308992aad65684aa280dc9834f2b5d327bdee514b046e5e

C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\chrome_200_percent.pak

MD5 57c27201e7cd33471da7ec205fe9973c
SHA1 a8e7bce09c4cbdae2797611b2be8aeb5491036f9
SHA256 dd8146b2ee289e4d54a4a0f1fd3b2f61b979c6a2baaba96a406d96c3f4fdb33b
SHA512 57258aa169bec66abf0f45a3e026bb68751fb970b74bd0cb465607fa3b2a89967e832d92d8f675f0449bb6662fcb7786d05f0597124cc8e18bb99a47245779b4

C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\chrome_100_percent.pak

MD5 06baf0ad34e0231bd76651203dba8326
SHA1 a5f99ecdcc06dec9d7f9ce0a8c66e46969117391
SHA256 5ae14147992a92548bcad76867dd88cdfcdb69d951c8720920cce6fb135e3189
SHA512 aff6616e56781ebb925a0ca146245ad3b2827250b32261c0c7c0d5b10b20a343a17fc3761c95d93104163e77b2eae3f1f9cbd3cb2b377f49b42bea39bdd09b91

C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\D3DCompiler_47.dll

MD5 7641e39b7da4077084d2afe7c31032e0
SHA1 2256644f69435ff2fee76deb04d918083960d1eb
SHA256 44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
SHA512 8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5

C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\libglesv2.dll

MD5 bc45db0195aa369cc3c572e4e9eefc7e
SHA1 b880ca4933656be52f027028af5ef8a3b7e07e97
SHA256 a81729fd6ee2d64dfc47501a1d53794cdeee5c1daa3751f7554aea2503686d10
SHA512 dd8c39947e7d767fbdccf90c5b3eaedf3937b43c55200d2199107333b63ac09e5356c286618874fac841e1357dd927e0c70b5066c1feeedd8cc6c0fba605ee5f

\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\libEGL.dll

MD5 660a9ae1282e6205fc0a51e64470eb5b
SHA1 f91a9c9559f51a8f33a552f0145ed9e706909de8
SHA256 f2a841b6ef320f226965c7cb01fbc4709fc31425e490a3edfa20147ce3656c85
SHA512 20bed2bed042033e3d8b077f9d66bce67922aaec180cc3777f20560219226b7efc73932bb87445afda4e3877472ddcd307215d23954cd082051437e5f2224263

\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\swiftshader\libEGL.dll

MD5 acd46d81bb4f34912c255a8d01953635
SHA1 25969cc9e588e174b854566778f283f067c3c0c6
SHA256 bd1bc00a5c29726fb39645041fc6c8295256d90c7f739ebeaa8b6c382a4db189
SHA512 83692654ada422391b428953b2cec67048a171bbef4c59158f34607a762feac8a233b52ceaa528306cf103d9830ee38897afa996389e086d3778f290555a059b

\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\swiftshader\libGLESv2.dll

MD5 8090f82a02c6850cc7bd2b481a7533e0
SHA1 54a0b66d76c1b60e45e83ba4627299d0b2aae84a
SHA256 e9473ba82f6d8742ab74e67484886291aa69037db72e0ae256b19581de0b772e
SHA512 b2e3c57926860a7954ca6e426f5f2fa080cf6ccb5c4edd77f59744f240f597aa9613f46294e8b344db76b46fe78777b5016828b8ab2fc274ca107f3af7abd878

Analysis: behavioral4

Detonation Overview

Submitted

2024-06-03 08:53

Reported

2024-06-03 08:56

Platform

win10v2004-20240508-en

Max time kernel

134s

Max time network

105s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1840 wrote to memory of 3952 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1840 wrote to memory of 3952 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1840 wrote to memory of 3952 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3952 -ip 3952

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-06-03 08:53

Reported

2024-06-03 08:57

Platform

win7-20240508-en

Max time kernel

150s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe"

Signatures

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\Powershell = "\"powershell.exe\" -WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\\Users\\Admin\\AppData\\Roaming\\yQDnuxbhHfKsEcW.ps1\"" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ipapi.co N/A N/A
N/A ipapi.co N/A N/A

An obfuscated cmd.exe command-line is typically used to evade detection.

Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2228 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Windows\system32\cmd.exe
PID 2228 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Windows\system32\cmd.exe
PID 2228 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Windows\system32\cmd.exe
PID 2228 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Windows\system32\cmd.exe
PID 2228 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Windows\system32\cmd.exe
PID 2228 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Windows\system32\cmd.exe
PID 1648 wrote to memory of 2716 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1648 wrote to memory of 2716 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1648 wrote to memory of 2716 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2332 wrote to memory of 2732 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2332 wrote to memory of 2732 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2332 wrote to memory of 2732 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2228 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Windows\system32\cmd.exe
PID 2228 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Windows\system32\cmd.exe
PID 2228 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Windows\system32\cmd.exe
PID 2684 wrote to memory of 2520 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2684 wrote to memory of 2520 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2684 wrote to memory of 2520 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2716 wrote to memory of 2540 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
PID 2716 wrote to memory of 2540 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
PID 2716 wrote to memory of 2540 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
PID 2540 wrote to memory of 3028 N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 2540 wrote to memory of 3028 N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 2540 wrote to memory of 3028 N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 2228 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 2228 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 2228 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 2228 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 2228 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 2228 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 2228 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 2228 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 2228 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 2228 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 2228 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 2228 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 2228 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 2228 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 2228 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 2228 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 2228 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 2228 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 2228 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 2228 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 2228 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 2228 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 2228 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 2228 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 2228 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 2228 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 2228 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 2228 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 2228 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 2228 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 2228 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 2228 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 2228 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 2228 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 2228 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 2228 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 2228 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 2228 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 2228 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 2228 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe

"C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\ProgramData\edge\Updater\Get-Clipboard.ps1""

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\ProgramData\edge\Updater\Get-Clipboard.ps1"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,118,15,111,182,215,54,82,72,136,26,56,188,234,104,207,139,0,0,0,0,2,0,0,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,253,95,42,89,97,96,145,105,134,65,186,218,54,63,151,38,224,9,191,71,136,75,181,66,230,176,203,96,226,244,195,218,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,206,215,77,135,63,182,209,100,158,156,120,193,137,23,197,23,112,177,117,241,159,140,39,95,171,44,239,104,117,242,162,137,48,0,0,0,226,87,31,244,153,200,57,247,226,251,206,164,212,206,92,58,240,215,105,6,80,49,136,70,24,192,82,192,7,64,37,1,78,48,111,2,84,0,13,48,142,195,130,49,208,48,86,13,64,0,0,0,186,225,40,149,75,14,43,176,40,14,27,196,217,32,122,224,209,108,122,127,43,218,234,231,211,92,5,23,29,99,155,189,39,125,132,34,54,180,1,43,213,255,249,1,238,199,39,55,32,250,167,23,100,194,152,77,192,205,215,235,95,126,89,80), $null, 'CurrentUser')"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,118,15,111,182,215,54,82,72,136,26,56,188,234,104,207,139,0,0,0,0,2,0,0,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,253,95,42,89,97,96,145,105,134,65,186,218,54,63,151,38,224,9,191,71,136,75,181,66,230,176,203,96,226,244,195,218,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,206,215,77,135,63,182,209,100,158,156,120,193,137,23,197,23,112,177,117,241,159,140,39,95,171,44,239,104,117,242,162,137,48,0,0,0,226,87,31,244,153,200,57,247,226,251,206,164,212,206,92,58,240,215,105,6,80,49,136,70,24,192,82,192,7,64,37,1,78,48,111,2,84,0,13,48,142,195,130,49,208,48,86,13,64,0,0,0,186,225,40,149,75,14,43,176,40,14,27,196,217,32,122,224,209,108,122,127,43,218,234,231,211,92,5,23,29,99,155,189,39,125,132,34,54,180,1,43,213,255,249,1,238,199,39,55,32,250,167,23,100,194,152,77,192,205,215,235,95,126,89,80), $null, 'CurrentUser')

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uj3osc1l.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES32D4.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC32D3.tmp"

C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe

"C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe" --type=gpu-process --field-trial-handle=1172,1763405922463736370,2378411873916200231,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1188 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe

"C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1172,1763405922463736370,2378411873916200231,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1460 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe

"C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe" --type=gpu-process --field-trial-handle=1172,1763405922463736370,2378411873916200231,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1360 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 shaderify.xyz udp
US 8.8.8.8:53 ipapi.co udp
US 104.21.62.38:443 shaderify.xyz tcp
US 172.67.69.226:443 ipapi.co tcp
US 104.21.62.38:443 shaderify.xyz tcp
US 104.21.62.38:443 shaderify.xyz tcp
US 104.21.62.38:443 shaderify.xyz tcp
US 104.21.62.38:443 shaderify.xyz tcp

Files

\Users\Admin\AppData\Local\Temp\92e4b02e-2aa9-454b-bb24-ffc61f59e499.tmp.node

MD5 56192831a7f808874207ba593f464415
SHA1 e0c18c72a62692d856da1f8988b0bc9c8088d2aa
SHA256 6aa8763714aa5199a4065259af792292c2a7d6a2c381aa27007255421e5c9d8c
SHA512 c82aa1ef569c232b4b4f98a3789f2390e5f7bf5cc7e73d199fe23a3f636817edfdc2fb49ce7f69169c028a9dd5ab9f63e8f64964bb22424fc08db71e85054a33

memory/2716-10-0x000000001B770000-0x000000001BA52000-memory.dmp

memory/2716-11-0x0000000002860000-0x0000000002868000-memory.dmp

C:\ProgramData\edge\Updater\Get-Clipboard.ps1

MD5 52cc110bb3777aa6bba7900630d4eb49
SHA1 3663dc658fd13d407e49781d1a5c2aa203c252fc
SHA256 892a9edb03db3fd88fecc1e1a2f56a7339f16f6734e8d77e6538ea2c8c9026d6
SHA512 89b80d2783e902d68ffd08b6f3fb1848ae6e6c4bf2d7a1e4afdac970b2ee6ffcc58116cdd6234e3d6278eb9413d36aafe62b5beca24a0846575d12af0c5112ab

\??\c:\Users\Admin\AppData\Local\Temp\uj3osc1l.cmdline

MD5 a63fc612aa2f620d2acb25bf455565e3
SHA1 2d455a1f46b027f0dfa4b2e3fe76d233e2b6c1b1
SHA256 322f1026c1c1c73672f72a54759aa54279a54424fa31f2ff3d2b3b9393bd5296
SHA512 d4431eff4f847be9e38170447d1cbf647340ece60cd2b7534eaa33d3e6f5c079f11d067b530118f51a302f9bf2dfb8c690d62efd9ed92714a44b884504300807

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 1f579ff27f26fff7ea3d2c1552dac5b4
SHA1 db47575d2ffbbe063bffa25683054472d283e931
SHA256 3766314ecb365b907986e1874526c5a73861c77f7ad5b0843bb4f7be712b3327
SHA512 b695920642371a763cea45292e544f9d57a01ababdf1561154d3bb24af3b2a46160c5d1b8a38a826271fa654ddd07f8f59df62a67a6416c38980bc64290b2961

\??\c:\Users\Admin\AppData\Local\Temp\uj3osc1l.0.cs

MD5 b462a7b0998b386a2047c941506f7c1b
SHA1 61e8aa007164305a51fa2f1cebaf3f8e60a6a59f
SHA256 a81f86cd4d33ebbf2b725df6702b8f6b3c31627bf52eb1cadc1e40b1c0c2bb35
SHA512 eb41b838cc5726f4d1601d3c68d455203d3c23f17469b3c8cbdd552f479f14829856d699f310dec05fe7504a2ae511d0b7ffff6b66ceadb5a225efe3e2f3a020

\??\c:\Users\Admin\AppData\Local\Temp\CSC32D3.tmp

MD5 eeeed9d083f6893f2edd7d61d763fd59
SHA1 ec8a1f08ff56c5dfe63b329cbe77f55158f8e3ad
SHA256 b3e659c57a7524099881b9e65cae4404ae0eb541e07626dcda69a0188cbda416
SHA512 98995373a613b4c639db59bc956c713ce48a5c847142d418c6c94a3e8197dad3120f7678dd5c86863938c9bab34f8ff4a6d15c5c30c7d8304467dc6d23d4cd06

C:\Users\Admin\AppData\Local\Temp\RES32D4.tmp

MD5 975e1493ed186f5c28e1fa8b22ffdb35
SHA1 9e850987523aedcf91615df02fe53011f904159f
SHA256 acd79f0eaf1c9c71bd0efe2d120c1e01c52547440baab92c6e39dfdadffec584
SHA512 cc50361e26e283ece619b3ce4d4349a4e977919a306d26a006557960c7189b1d6e02bedca41f40f6b07e25e17e18b02ddd277fed5fd9aeb24ada558297ad662b

C:\Users\Admin\AppData\Local\Temp\uj3osc1l.dll

MD5 1dec73136e07a111751becad7e683da0
SHA1 02014c3ebdbf3bd8faca26f04dadb9365c9d662c
SHA256 720bf989e81b4c839b03be09578518fcb5ec016a4f7600a6499c26892cb6955a
SHA512 1323d7256d6920f1d60044588543490f3eae0b9f1897538472d71152548409945a9e401d6e6512c164ba03df0bb0ecac554a9f29d9ad8c6652d29cfbe14214d2

memory/2716-35-0x0000000002A10000-0x0000000002A18000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\uj3osc1l.pdb

MD5 c9c5d6885c9065ddcb2eb88dca999b81
SHA1 88ed263b4ccc599204e0b2fd238deecdf75fd99f
SHA256 c59fb470d7ee43f4da5b09b579d0b807463acf400f00488cf0456ce91d6bf667
SHA512 40f2f0fcbb58ef391c9927f683f6a70a376ad5c2637f98a50823ae7bb0bd4832c7ae076299ffc95d8572aa2b283f141b94eb960b8da46af6ba7ac144afec1c82

memory/1604-45-0x0000000000060000-0x0000000000061000-memory.dmp

memory/1604-78-0x0000000077260000-0x0000000077261000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admincookies.zip

MD5 76cdb2bad9582d23c1f6f4d868218d6c
SHA1 b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
SHA256 8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
SHA512 5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f

Analysis: behavioral10

Detonation Overview

Submitted

2024-06-03 08:53

Reported

2024-06-03 08:56

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe"

Signatures

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Powershell = "\"powershell.exe\" -WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\\Users\\Admin\\AppData\\Local\\Temp\\cJuWbaEYwqGmdMS.ps1\"" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ipapi.co N/A N/A
N/A ipapi.co N/A N/A

An obfuscated cmd.exe command-line is typically used to evade detection.

Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\system32\cmd.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4400 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Windows\system32\cmd.exe
PID 4400 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Windows\system32\cmd.exe
PID 4400 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Windows\system32\cmd.exe
PID 4400 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Windows\system32\cmd.exe
PID 2724 wrote to memory of 2788 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2724 wrote to memory of 2788 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3052 wrote to memory of 3636 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 3052 wrote to memory of 3636 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2788 wrote to memory of 424 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
PID 2788 wrote to memory of 424 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
PID 424 wrote to memory of 2040 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
PID 424 wrote to memory of 2040 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
PID 4400 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Windows\system32\cmd.exe
PID 4400 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Windows\system32\cmd.exe
PID 5036 wrote to memory of 2420 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5036 wrote to memory of 2420 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4400 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Windows\system32\cmd.exe
PID 4400 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Windows\system32\cmd.exe
PID 4092 wrote to memory of 1344 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4092 wrote to memory of 1344 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4400 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 4400 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 4400 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 4400 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 4400 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 4400 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 4400 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 4400 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 4400 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 4400 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 4400 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 4400 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 4400 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 4400 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 4400 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 4400 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 4400 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 4400 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 4400 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 4400 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 4400 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 4400 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 4400 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 4400 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 4400 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 4400 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 4400 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 4400 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 4400 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 4400 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 4400 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 4400 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 4400 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 4400 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 4400 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 4400 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 4400 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 4400 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 4400 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 4400 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 4400 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 4400 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 4400 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe
PID 4400 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe

"C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\ProgramData\edge\Updater\Get-Clipboard.ps1""

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\ProgramData\edge\Updater\Get-Clipboard.ps1"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rxqp5jle\rxqp5jle.cmdline"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES49AB.tmp" "c:\Users\Admin\AppData\Local\Temp\rxqp5jle\CSCE4340FD8C5CF418888524C9E3494AA8.TMP"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,29,91,20,250,244,96,249,70,151,181,139,149,165,63,141,20,0,0,0,0,2,0,0,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,153,5,53,101,41,221,199,69,137,25,8,206,225,102,110,200,122,91,33,160,134,229,213,22,203,204,228,9,108,217,15,36,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,209,169,143,159,124,134,19,21,115,239,86,173,129,115,75,126,28,211,192,67,176,83,172,180,133,53,36,115,134,63,125,108,48,0,0,0,247,204,77,117,114,109,27,84,75,239,250,231,249,252,110,35,28,202,157,116,66,197,80,79,79,53,42,90,124,78,22,98,170,121,69,228,70,161,95,144,248,17,178,142,224,204,145,171,64,0,0,0,147,222,190,106,197,5,164,148,65,178,237,73,45,249,247,52,202,203,218,107,66,57,114,152,65,63,102,164,185,7,212,103,210,243,200,201,208,204,243,76,218,218,33,186,103,238,37,186,225,235,182,3,102,148,159,173,246,151,154,219,224,67,3,103), $null, 'CurrentUser')"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,29,91,20,250,244,96,249,70,151,181,139,149,165,63,141,20,0,0,0,0,2,0,0,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,153,5,53,101,41,221,199,69,137,25,8,206,225,102,110,200,122,91,33,160,134,229,213,22,203,204,228,9,108,217,15,36,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,209,169,143,159,124,134,19,21,115,239,86,173,129,115,75,126,28,211,192,67,176,83,172,180,133,53,36,115,134,63,125,108,48,0,0,0,247,204,77,117,114,109,27,84,75,239,250,231,249,252,110,35,28,202,157,116,66,197,80,79,79,53,42,90,124,78,22,98,170,121,69,228,70,161,95,144,248,17,178,142,224,204,145,171,64,0,0,0,147,222,190,106,197,5,164,148,65,178,237,73,45,249,247,52,202,203,218,107,66,57,114,152,65,63,102,164,185,7,212,103,210,243,200,201,208,204,243,76,218,218,33,186,103,238,37,186,225,235,182,3,102,148,159,173,246,151,154,219,224,67,3,103), $null, 'CurrentUser')

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,29,91,20,250,244,96,249,70,151,181,139,149,165,63,141,20,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,79,171,147,34,242,140,11,144,120,220,207,24,1,221,227,169,44,203,106,123,198,62,79,112,151,240,97,129,25,0,50,145,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,32,55,196,118,8,60,34,118,98,67,63,99,6,38,147,168,170,66,7,134,227,81,225,238,7,185,77,116,227,246,218,58,48,0,0,0,78,190,62,86,160,155,76,226,24,98,1,99,171,202,6,173,38,116,115,17,183,57,67,52,104,15,151,198,177,138,154,219,128,136,105,37,238,1,157,221,171,183,164,115,48,229,49,214,64,0,0,0,125,51,56,187,118,74,244,13,72,110,208,133,201,236,145,223,199,106,152,47,227,46,94,245,9,105,158,218,74,107,44,139,41,14,192,86,33,57,145,152,112,35,146,122,237,245,61,79,197,152,91,113,187,28,240,193,73,96,252,159,90,120,136,138), $null, 'CurrentUser')"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,29,91,20,250,244,96,249,70,151,181,139,149,165,63,141,20,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,79,171,147,34,242,140,11,144,120,220,207,24,1,221,227,169,44,203,106,123,198,62,79,112,151,240,97,129,25,0,50,145,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,32,55,196,118,8,60,34,118,98,67,63,99,6,38,147,168,170,66,7,134,227,81,225,238,7,185,77,116,227,246,218,58,48,0,0,0,78,190,62,86,160,155,76,226,24,98,1,99,171,202,6,173,38,116,115,17,183,57,67,52,104,15,151,198,177,138,154,219,128,136,105,37,238,1,157,221,171,183,164,115,48,229,49,214,64,0,0,0,125,51,56,187,118,74,244,13,72,110,208,133,201,236,145,223,199,106,152,47,227,46,94,245,9,105,158,218,74,107,44,139,41,14,192,86,33,57,145,152,112,35,146,122,237,245,61,79,197,152,91,113,187,28,240,193,73,96,252,159,90,120,136,138), $null, 'CurrentUser')

C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe

"C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe" --type=gpu-process --field-trial-handle=1836,14204483464277005053,8560346771562735350,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1844 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe

"C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1836,14204483464277005053,8560346771562735350,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2200 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe

"C:\Users\Admin\AppData\Local\Temp\ShaderifyBeta.exe" --type=gpu-process --field-trial-handle=1836,14204483464277005053,8560346771562735350,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=MAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAIAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1872 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 shaderify.xyz udp
US 8.8.8.8:53 ipapi.co udp
US 172.67.219.241:443 shaderify.xyz tcp
US 104.26.9.44:443 ipapi.co tcp
US 172.67.219.241:443 shaderify.xyz tcp
US 172.67.219.241:443 shaderify.xyz tcp
US 172.67.219.241:443 shaderify.xyz tcp
US 172.67.219.241:443 shaderify.xyz tcp
US 8.8.8.8:53 44.9.26.104.in-addr.arpa udp
US 8.8.8.8:53 241.219.67.172.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\dcd43bf2-4266-4892-9855-2c6bd8b87bcf.tmp.node

MD5 56192831a7f808874207ba593f464415
SHA1 e0c18c72a62692d856da1f8988b0bc9c8088d2aa
SHA256 6aa8763714aa5199a4065259af792292c2a7d6a2c381aa27007255421e5c9d8c
SHA512 c82aa1ef569c232b4b4f98a3789f2390e5f7bf5cc7e73d199fe23a3f636817edfdc2fb49ce7f69169c028a9dd5ab9f63e8f64964bb22424fc08db71e85054a33

memory/2788-6-0x0000019B3E210000-0x0000019B3E232000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_go5q1pmc.uh1.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\ProgramData\edge\Updater\Get-Clipboard.ps1

MD5 52cc110bb3777aa6bba7900630d4eb49
SHA1 3663dc658fd13d407e49781d1a5c2aa203c252fc
SHA256 892a9edb03db3fd88fecc1e1a2f56a7339f16f6734e8d77e6538ea2c8c9026d6
SHA512 89b80d2783e902d68ffd08b6f3fb1848ae6e6c4bf2d7a1e4afdac970b2ee6ffcc58116cdd6234e3d6278eb9413d36aafe62b5beca24a0846575d12af0c5112ab

\??\c:\Users\Admin\AppData\Local\Temp\rxqp5jle\rxqp5jle.cmdline

MD5 18a339e346aa61df6906b165ebceac0d
SHA1 d4a60b888c0e2e8c9d77a79ce22e3e56e09e400c
SHA256 11eb4bfaefce360800f256c97e0edef53de240e0cfd84d10982fbd84795ad20d
SHA512 8df662c72e3f1f94e0ddff509d334e007935777043297270351c39a1f203bfb1c6652dd81d67f5b4652940a79ee97d0ba3cc78657f30a5189291739c05030891

\??\c:\Users\Admin\AppData\Local\Temp\rxqp5jle\rxqp5jle.0.cs

MD5 b462a7b0998b386a2047c941506f7c1b
SHA1 61e8aa007164305a51fa2f1cebaf3f8e60a6a59f
SHA256 a81f86cd4d33ebbf2b725df6702b8f6b3c31627bf52eb1cadc1e40b1c0c2bb35
SHA512 eb41b838cc5726f4d1601d3c68d455203d3c23f17469b3c8cbdd552f479f14829856d699f310dec05fe7504a2ae511d0b7ffff6b66ceadb5a225efe3e2f3a020

\??\c:\Users\Admin\AppData\Local\Temp\rxqp5jle\CSCE4340FD8C5CF418888524C9E3494AA8.TMP

MD5 ccbf1e6bddb19b391dabbb5c8ebbdb01
SHA1 8c1fe2349bea8bcf3542bf5a30627960ce9f807f
SHA256 d75d83eb8f467390c5c2f9245a62b617786e55f5a0a3815ab2e4e73dc752737a
SHA512 7136016be56afb67ff3d4934db4cc1ec3fc141c2bd5d76c49fff625773d5f84f34db9993a53cc9483b237758f03c1791edb53956924fc1fb8164158edcf800d0

C:\Users\Admin\AppData\Local\Temp\RES49AB.tmp

MD5 7b1c2af8ddbcd4c3363b180262abd7d0
SHA1 5e8c5227748093c40d64e0717607acdbdd29b9b7
SHA256 9f053ba56308492806f15ca87db1b336dee056f534bf4ee806c1897d29402299
SHA512 f18afa42c832983ddb5a53e5a451d477d82b5e6d9ef6c17109b3c64baaef310347b1413f0142e63d8d72dd05eec815ceecf75b1654b3027ec4a915a5b5e851c1

C:\Users\Admin\AppData\Local\Temp\rxqp5jle\rxqp5jle.dll

MD5 7d368ef8c4c56efa9547e63e4ec515aa
SHA1 46f3516cfdadca41f878994f5133fca64665dc5e
SHA256 e924c2bd8e16474bf12f3bd3ac611dd3d9f5ea001b86dd5e52a9f96d384bc749
SHA512 e57471f84847dafbd6f95702b0fb5f21d6ae8a8eaea30a735e59ec5a3e10f83ee481b646c61a6d3088a44536406d1222493ebbc4ddbe8c43b296586fd69bd52e

memory/2788-30-0x0000019B25F70000-0x0000019B25F78000-memory.dmp

memory/2420-43-0x0000021456C30000-0x0000021456C80000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 f48896adf9a23882050cdff97f610a7f
SHA1 4c5a610df62834d43f470cae7e851946530e3086
SHA256 3ae35c2828715a2f9a5531d334a0cfffc81396c2dc058ca42a9943f3cdc22e78
SHA512 16644246f2a35a186fcb5c2b6456ed6a16e8db65ad1383109e06547f9b1f9358f071c30cca541ca4cf7bae66cb534535e88f75f6296a4bfc6c7b22b0684a6ba9

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 68d80cc2ac40ea9e5c7297fba6623c45
SHA1 05908daef7414f753fa6006082c42485002a7da8
SHA256 3b059d656dae93233a96c9079352c1d77c6abfec689cc6236b93b427c9918e96
SHA512 2c51e963eba030ee4f2ef5df1577a8ce38cacd6ffc3d0c56258db173352b46cd6048505061c65bd5757d14e2e27d9d396cbce95d58406660af62365bd4e7afb6

C:\Users\Admin\AppData\Local\Temp\Admincookies.zip

MD5 76cdb2bad9582d23c1f6f4d868218d6c
SHA1 b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
SHA256 8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
SHA512 5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f

memory/2272-68-0x00007FF81A540000-0x00007FF81A541000-memory.dmp

Analysis: behavioral13

Detonation Overview

Submitted

2024-06-03 08:53

Reported

2024-06-03 08:57

Platform

win10v2004-20240426-en

Max time kernel

89s

Max time network

156s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral17

Detonation Overview

Submitted

2024-06-03 08:53

Reported

2024-06-03 08:57

Platform

win10v2004-20240508-en

Max time kernel

89s

Max time network

155s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 52.111.229.43:443 tcp

Files

N/A

Analysis: behavioral19

Detonation Overview

Submitted

2024-06-03 08:53

Reported

2024-06-03 08:57

Platform

win10v2004-20240508-en

Max time kernel

145s

Max time network

155s

Command Line

wscript.exe C:\Users\Admin\AppData\Local\Temp\resources\app.js

Signatures

Command and Scripting Interpreter: JavaScript

execution

Processes

C:\Windows\system32\wscript.exe

wscript.exe C:\Users\Admin\AppData\Local\Temp\resources\app.js

Network

Country Destination Domain Proto
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 24.140.123.92.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-06-03 08:53

Reported

2024-06-03 08:56

Platform

win7-20240221-en

Max time kernel

117s

Max time network

120s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2836 -s 220

Network

N/A

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-06-03 08:53

Reported

2024-06-03 08:56

Platform

win10v2004-20240426-en

Max time kernel

148s

Max time network

151s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3424 wrote to memory of 4316 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3424 wrote to memory of 4316 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3424 wrote to memory of 4316 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4316 -ip 4316

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 66.112.168.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-06-03 08:53

Reported

2024-06-03 08:57

Platform

win10v2004-20240508-en

Max time kernel

132s

Max time network

157s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html

Signatures

N/A

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=4340,i,7012731823941922179,12386606396608877869,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=3816,i,7012731823941922179,12386606396608877869,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --field-trial-handle=5292,i,7012731823941922179,12386606396608877869,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=5360,i,7012731823941922179,12386606396608877869,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --field-trial-handle=5464,i,7012731823941922179,12386606396608877869,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --field-trial-handle=5296,i,7012731823941922179,12386606396608877869,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --field-trial-handle=5644,i,7012731823941922179,12386606396608877869,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 api.edgeoffer.microsoft.com udp
US 8.8.8.8:53 api.edgeoffer.microsoft.com udp
IE 94.245.104.56:443 api.edgeoffer.microsoft.com tcp
US 8.8.8.8:53 business.bing.com udp
US 8.8.8.8:53 business.bing.com udp
US 13.107.9.158:443 business.bing.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 bzib.nelreports.net udp
US 8.8.8.8:53 bzib.nelreports.net udp
BE 23.55.97.181:443 www.microsoft.com tcp
US 2.17.251.4:443 bzib.nelreports.net tcp
US 8.8.8.8:53 56.104.245.94.in-addr.arpa udp
US 8.8.8.8:53 56.94.73.104.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 181.97.55.23.in-addr.arpa udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
GB 51.11.108.188:443 nav-edge.smartscreen.microsoft.com tcp
GB 51.11.108.188:443 nav-edge.smartscreen.microsoft.com tcp
GB 51.11.108.188:443 nav-edge.smartscreen.microsoft.com tcp
GB 51.11.108.188:443 nav-edge.smartscreen.microsoft.com tcp
US 8.8.8.8:53 edgestatic.azureedge.net udp
US 8.8.8.8:53 edgestatic.azureedge.net udp
US 8.8.8.8:53 c.s-microsoft.com udp
US 8.8.8.8:53 c.s-microsoft.com udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 188.108.11.51.in-addr.arpa udp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
US 13.107.253.64:443 wcpstatic.microsoft.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 64.253.107.13.in-addr.arpa udp
NL 23.62.61.72:443 www.bing.com tcp
US 8.8.8.8:53 72.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

N/A

Analysis: behavioral11

Detonation Overview

Submitted

2024-06-03 08:53

Reported

2024-06-03 08:56

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

154s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3dcompiler_47.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3dcompiler_47.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-03 08:53

Reported

2024-06-03 08:57

Platform

win7-20240221-en

Max time kernel

118s

Max time network

129s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

Signatures

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 224

Network

N/A

Files

N/A

Analysis: behavioral22

Detonation Overview

Submitted

2024-06-03 08:53

Reported

2024-06-03 08:57

Platform

win7-20231129-en

Max time kernel

119s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libEGL.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libEGL.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral28

Detonation Overview

Submitted

2024-06-03 08:53

Reported

2024-06-03 08:57

Platform

win7-20240221-en

Max time kernel

119s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2236 wrote to memory of 2608 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 2236 wrote to memory of 2608 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 2236 wrote to memory of 2608 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2236 -s 88

Network

N/A

Files

N/A

Analysis: behavioral29

Detonation Overview

Submitted

2024-06-03 08:53

Reported

2024-06-03 08:57

Platform

win10v2004-20240508-en

Max time kernel

142s

Max time network

159s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
NL 23.62.61.129:443 www.bing.com tcp
US 8.8.8.8:53 129.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

N/A

Analysis: behavioral31

Detonation Overview

Submitted

2024-06-03 08:53

Reported

2024-06-03 08:56

Platform

win10v2004-20240508-en

Max time kernel

92s

Max time network

95s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2428 wrote to memory of 2976 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2428 wrote to memory of 2976 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2428 wrote to memory of 2976 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2976 -ip 2976

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 624

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral16

Detonation Overview

Submitted

2024-06-03 08:53

Reported

2024-06-03 08:57

Platform

win7-20240508-en

Max time kernel

118s

Max time network

122s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1596 wrote to memory of 2172 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 1596 wrote to memory of 2172 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 1596 wrote to memory of 2172 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 1596 -s 88

Network

N/A

Files

N/A

Analysis: behavioral20

Detonation Overview

Submitted

2024-06-03 08:53

Reported

2024-06-03 08:57

Platform

win7-20240221-en

Max time kernel

117s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe

"C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe"

Network

N/A

Files

N/A

Analysis: behavioral21

Detonation Overview

Submitted

2024-06-03 08:53

Reported

2024-06-03 08:56

Platform

win10v2004-20240508-en

Max time kernel

133s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe

"C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

N/A

Analysis: behavioral25

Detonation Overview

Submitted

2024-06-03 08:53

Reported

2024-06-03 08:57

Platform

win10v2004-20240508-en

Max time kernel

131s

Max time network

154s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libGLESv2.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libGLESv2.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4040,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 58.189.79.40.in-addr.arpa udp

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-06-03 08:53

Reported

2024-06-03 08:56

Platform

win7-20240508-en

Max time kernel

133s

Max time network

131s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html

Signatures

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423566728" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000c93178593e856827b4fb61eabbd93578d3fd42a9abadd9d8132aeb5000fc244c000000000e80000000020000200000003374b28e422ce550afb9cb96cfd846cb60634bb9fc21cdb96586cc8b4ebc54512000000093669776e0a3b4b160d71f0eaf18343796f4577200cdc50abd8c3ac78736f6564000000087dac80d8d09482c535084c716d8d66ace66a6dda922b0efff7124036dcc51a1b44d66e203740f036fc4086e572880e43a7bafbb931e0b944dfc5344e9df0150 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DE5A5921-2186-11EF-8E44-4635F953E0C8} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c04409b393b5da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000afb4126ac31e18aa18580427062616cb063271a7443b87c38f3b4986c0dd4a49000000000e80000000020000200000005d922f2587ca7c9d6b220e8752c3ae6578450dd3c887aa7317caaac914eb0acc90000000eb93918d41be0dc53b6b514250db303d0dfcf39c5bb1b33370c9a875a58409435b525b8fd2dd8ac3436d393d56219a6790eb618fde4382b8385b6a41d5505a7a3136bb8e1936d115389e6652dcc6ff0739d5f6c9b6e9a6aa6395192306bb28f57b76f4eefb8965343210aeb7de4ad80cafa8abee07ca2fdb6b3d0ae083f44cbb02fc78700fd44843977beb4f1ecd9d5940000000770cc4fad65cfedd980fbae18ee4bdf79052f4a9196b9eeedb37ba7b09fcca1693b847205b022daff0b58fc135352f1a808da93d387805ff5fee197f98a2c2de C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1700 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\Cab5B9B.tmp

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar5BFF.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ba8781d44ad1f3c75a948f51f5387408
SHA1 44ec0da8991eaaaea6236734ba00355b0977befe
SHA256 c647b53b3c8836e1cf76053d14f55e98f52578fcaf89e3e259428a7657ada87c
SHA512 cf5f3cdf1bbd2233e48a84cd9ac3abdca69eca43239a81d75db191bdfa0320993d0a35ee0e9f41ae281321f0d5f42a13abb9122acb2781aa4efc9362147be300

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8e4e1620398aca3e1191dea888e295bc
SHA1 dd8b16275e0e1a0715f4dc95d2ecdb304d250887
SHA256 5e50fbc0c70f275c43c291225a120a5f89927351b40c96d605388dc2954b9545
SHA512 ddb6ead8d8a6470538c15ffea1226ecd108ad4d24d7dd3a0b14b01cf67af2468cc9832438e893d875140f0cc21b877f5e4388d2be466cc687f0c48eeaef67b16

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 63548821b73ca077a3606adec5ea4d8e
SHA1 8682ac7278a27a0fe443b647f64ae814b7c48e75
SHA256 9ed7c88e66d77449e801291cde0b8654120ebfd5d9ec12232b97c0bc8afcdf89
SHA512 0d065405f86fe942e513fade25ab60007cdfa0224ba17b41e26f351591798026a5e2fed2b7ca943cafcf7fb26e94b1a05743a0f972c5387c18f243799c20967a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 15badb69bcdb6f50a10fc8b71dbf8e73
SHA1 54e73a8b4b139aaa4afeefcd9fc8310d2b75d5ec
SHA256 ea8ae0a350e7fe11e94cb9da50b3bd7ea35f93dc7183bdd77905efa2fb8bb7d8
SHA512 bc6dd8330a4d3fa7d554c9953e660e969dd0f65741a7ebd7ccd8812baeb44fddb1504d943f7ca1fceff25cfc6899ae7543c0392de841ad071b1c5a1635090732

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a3bf4ce3dc4f791b72dccaae72accde9
SHA1 4d2e60cef40284fc52b2d70cb9ea69cba37cdf1e
SHA256 90614563bfa4c340fa08a6da9853684329cee7636d4c8ba4db1c9bfb5c3b5db2
SHA512 7d05e1aebac317a480ce2a05505addf10b2c06e719ecf4b136974b43a2c8b55f9f5d35415dd3633399cdb00e1f5c5690cb10307fda2179a0f291b11fdb4d3240

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 52de1b879f6a27d2e7d05ff4108336aa
SHA1 ab015bdf891ad7fb616675009920cacd352ef63a
SHA256 3775f9d26d6216a1671716b3b42eafe3dd09278f271ba1898f86f2bade5a87aa
SHA512 df2e30a4b29ad982933eb094179e659cb29f61ce6c48fc7e0a657a1928717e6787106ef7bb86844501ad6bd25f6a7357a7329df5573540e9534873b122bac6fb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ff74fa2a628a4f306c1b953a4a06564e
SHA1 11ffc5ce9071a916279dbef3d4122ae37ca7b269
SHA256 51474f8fc870ae6c1ec984261cdc25eb0d21169080e0421e6208887239569b33
SHA512 51a066fad840069f36bfa1d7f93a20c3a669c005ec26a34f2e9b02039d9bb71a2f9a7a5ab251c50221acd853e6b91b5b3478df3c0e0c0259d3ccb97e994f5bf4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a3b5b9e54a69447f0c17dbb230b995f0
SHA1 f3f7fc0a01c3e355e9ab4c97f6bedf76ca3a54cb
SHA256 dd5d9cbdda4ae88cef09229f16d063ba2fb3e2c526bb254f8cc3f4fe888bfdfc
SHA512 8b7cc3720dcf3d5292af9449564cd3a3422de294f048589ba7b5510dc4a17eab0e1f383a2a9710e3e32bda5b292755bc10caecccb3fb5f72930a11c0f780b3c7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9799be48d6915779045e755ab5539fb0
SHA1 c3c8168550efc34e5095816b10c0e42fbadb1eb2
SHA256 5046d56f41b158020813c22691c1ea3ccc9deec1d79dd5002dda231d4e3fbaca
SHA512 d6f5e6c7a31e764b506b44848adf9fab2c640f3db773b3c2c6b2462174863c84e358978af8b1d153d044c386149238046b0862f2b18afaded1cbb75a98e9c753

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3fa0cd793d99816cd74d94f4a2eb057c
SHA1 020306c2ea0c26202b221387c5ef13cf8e4da9e8
SHA256 9d025ee49a7858c799c04cbdc79c52542bf04baafd32446076aaa354f1778b87
SHA512 16e45497147ce4a66c4c13809552430d211a435a792448f70bdc00fedd6ad067747545ff1fbc470faa6a265d02db3a94cf75dd6c58d9aa42e5099cf1afaf887a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8eeb4374934ce7e87149070e67b3a49a
SHA1 1a9355b202347b2567110916f8214752f0b59816
SHA256 940a09218b533cc5193d527e1fbf7625c196ba2351e8381d79706740d044c666
SHA512 c18bd2d9cb89a29b7ddedf14f16beddaaa0af7ed8767e63cc8cbc5455f956b5ee5d22731e4dac08f3ed7e85fb509f73081cf8070a0a76afe898b1dc154318c77

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7802c5824ca4f73860a969d6257e9b54
SHA1 04a57bdb78a96d0573273b889783af60e1fad649
SHA256 39768a94416e56a7c95f8d89fa82b219edc435ed26d1ebcc170d45bffdecf09e
SHA512 4acea02f22bcd0a95709297dd4e6cf740d7803cac42787d794e3e857055db4ef18f310431242633c47170151c13ee46b9de9a443cba367caec2e5a9514c1f319

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 22a65e09e274dec721e7b36f7d413152
SHA1 4863c5ef1c1010ffd9287044e8a2db591b4c6007
SHA256 31e5880eaf48a1c9c607e06b96097bca5b4a0f092785370a135945566a52f754
SHA512 760e06f3e7df5badf536ccb4bdba0f01efe460a3fc521320b1e8191134804af2ce86c084d8364889bda51cac2177f52b9a1b83c87914b791e030bd91573a0608

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7bacf0dcfb48eae91fb4f39a30f6cab5
SHA1 0860758d0b3e9a94172db531cb10fbc3b75372bf
SHA256 f269fd9acdc131420392279ce9dcc7e9514b768c800647548c2197026743df50
SHA512 dc5ed5aa54f9aab95f4efe952382fcd28a999dbc75713e72ac698810fd27469432aaf8e1d36d95169d05a028bdc0057f3b31ca7d7c23c7ca213c664782e86235

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0dca74224a071c26574ee69df57ce1d2
SHA1 563f97229a6fefbf36ee26614dee897699a12e07
SHA256 888f1bba65587c521f1676410531967cce588ad7d0036ebba92045ec1e545042
SHA512 9d5de8dcab08aada81cd150fa3746960f69bdcef4724c27ce47fd766c888f30ee21fb7100f5f4175f637334e2d4dde612c70655c554503bcd327cd99daf12151

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 35de2f2f8f5604f14ae8a620d9e8e29c
SHA1 1084fff69a1ad0ff056cebcee8d321464af46e5c
SHA256 619b695fc89930f0c91340cb6b7e2b96509f6d5fec074dcfdc6eb19369d6d92e
SHA512 0269790fe414b4c901d4a4cfbe99b7ed4d0e5e86dccbdf862c3f47c5d1aab9f16f71d21400dab5c5ee0c24dabf8dd4af924ed45338daea4f7c3eac0517703f9a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bc0c2a99f919d92e2406e17d1eebe50e
SHA1 4fa62779770a83b098028e2fd77c5708a239d44f
SHA256 cb438fa48828a1843831c09ee4efe82bcf7e056cb368508cdf11ed6d19ca7e67
SHA512 c9bc7aea95349d686976e6fda732a3942e228f6d95284c228a98c4c664fa70f3d100f073ec6b4aacf9e21408cb7f7fcfc1aff55598ae41d38157703a61737f33

Analysis: behavioral26

Detonation Overview

Submitted

2024-06-03 08:53

Reported

2024-06-03 08:57

Platform

win7-20240221-en

Max time kernel

120s

Max time network

124s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2488 wrote to memory of 2764 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 2488 wrote to memory of 2764 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 2488 wrote to memory of 2764 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2488 -s 80

Network

N/A

Files

N/A