Overview
overview
10Static
static
3ShaderifyB....0.exe
windows7-x64
10ShaderifyB....0.exe
windows10-2004-x64
10$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3LICENSES.c...m.html
windows7-x64
3LICENSES.c...m.html
windows10-2004-x64
3ShaderifyBeta.exe
windows7-x64
7ShaderifyBeta.exe
windows10-2004-x64
7d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows7-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows7-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows7-x64
1libGLESv2.dll
windows10-2004-x64
1resources/app.js
windows7-x64
3resources/app.js
windows10-2004-x64
3resources/elevate.exe
windows7-x64
3resources/elevate.exe
windows10-2004-x64
3swiftshade...GL.dll
windows7-x64
1swiftshade...GL.dll
windows10-2004-x64
1swiftshade...v2.dll
windows7-x64
1swiftshade...v2.dll
windows10-2004-x64
1vk_swiftshader.dll
windows7-x64
1vk_swiftshader.dll
windows10-2004-x64
1vulkan-1.dll
windows7-x64
1vulkan-1.dll
windows10-2004-x64
1$PLUGINSDI...7z.dll
windows7-x64
3$PLUGINSDI...7z.dll
windows10-2004-x64
3Analysis
-
max time kernel
145s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
submitted
13-06-2024 16:28
Static task
static1
Behavioral task
behavioral1
Sample
ShaderifyBeta 1.4.0.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
ShaderifyBeta 1.4.0.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
LICENSES.chromium.html
Resource
win7-20240611-en
Behavioral task
behavioral8
Sample
LICENSES.chromium.html
Resource
win10v2004-20240611-en
Behavioral task
behavioral9
Sample
ShaderifyBeta.exe
Resource
win7-20240611-en
Behavioral task
behavioral10
Sample
ShaderifyBeta.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
d3dcompiler_47.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral12
Sample
ffmpeg.dll
Resource
win7-20240508-en
Behavioral task
behavioral13
Sample
ffmpeg.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral14
Sample
libEGL.dll
Resource
win7-20240611-en
Behavioral task
behavioral15
Sample
libEGL.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral16
Sample
libGLESv2.dll
Resource
win7-20240221-en
Behavioral task
behavioral17
Sample
libGLESv2.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral18
Sample
resources/app.js
Resource
win7-20231129-en
Behavioral task
behavioral19
Sample
resources/app.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral20
Sample
resources/elevate.exe
Resource
win7-20240508-en
Behavioral task
behavioral21
Sample
resources/elevate.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral22
Sample
swiftshader/libEGL.dll
Resource
win7-20240508-en
Behavioral task
behavioral23
Sample
swiftshader/libEGL.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral24
Sample
swiftshader/libGLESv2.dll
Resource
win7-20240508-en
Behavioral task
behavioral25
Sample
swiftshader/libGLESv2.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral26
Sample
vk_swiftshader.dll
Resource
win7-20240611-en
Behavioral task
behavioral27
Sample
vk_swiftshader.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral28
Sample
vulkan-1.dll
Resource
win7-20240221-en
Behavioral task
behavioral29
Sample
vulkan-1.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral30
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win7-20240611-en
Behavioral task
behavioral31
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10v2004-20240611-en
General
-
Target
LICENSES.chromium.html
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1196 msedge.exe 1196 msedge.exe 3820 msedge.exe 3820 msedge.exe 3236 identity_helper.exe 3236 identity_helper.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3820 wrote to memory of 2656 3820 msedge.exe 84 PID 3820 wrote to memory of 2656 3820 msedge.exe 84 PID 3820 wrote to memory of 2836 3820 msedge.exe 85 PID 3820 wrote to memory of 2836 3820 msedge.exe 85 PID 3820 wrote to memory of 2836 3820 msedge.exe 85 PID 3820 wrote to memory of 2836 3820 msedge.exe 85 PID 3820 wrote to memory of 2836 3820 msedge.exe 85 PID 3820 wrote to memory of 2836 3820 msedge.exe 85 PID 3820 wrote to memory of 2836 3820 msedge.exe 85 PID 3820 wrote to memory of 2836 3820 msedge.exe 85 PID 3820 wrote to memory of 2836 3820 msedge.exe 85 PID 3820 wrote to memory of 2836 3820 msedge.exe 85 PID 3820 wrote to memory of 2836 3820 msedge.exe 85 PID 3820 wrote to memory of 2836 3820 msedge.exe 85 PID 3820 wrote to memory of 2836 3820 msedge.exe 85 PID 3820 wrote to memory of 2836 3820 msedge.exe 85 PID 3820 wrote to memory of 2836 3820 msedge.exe 85 PID 3820 wrote to memory of 2836 3820 msedge.exe 85 PID 3820 wrote to memory of 2836 3820 msedge.exe 85 PID 3820 wrote to memory of 2836 3820 msedge.exe 85 PID 3820 wrote to memory of 2836 3820 msedge.exe 85 PID 3820 wrote to memory of 2836 3820 msedge.exe 85 PID 3820 wrote to memory of 2836 3820 msedge.exe 85 PID 3820 wrote to memory of 2836 3820 msedge.exe 85 PID 3820 wrote to memory of 2836 3820 msedge.exe 85 PID 3820 wrote to memory of 2836 3820 msedge.exe 85 PID 3820 wrote to memory of 2836 3820 msedge.exe 85 PID 3820 wrote to memory of 2836 3820 msedge.exe 85 PID 3820 wrote to memory of 2836 3820 msedge.exe 85 PID 3820 wrote to memory of 2836 3820 msedge.exe 85 PID 3820 wrote to memory of 2836 3820 msedge.exe 85 PID 3820 wrote to memory of 2836 3820 msedge.exe 85 PID 3820 wrote to memory of 2836 3820 msedge.exe 85 PID 3820 wrote to memory of 2836 3820 msedge.exe 85 PID 3820 wrote to memory of 2836 3820 msedge.exe 85 PID 3820 wrote to memory of 2836 3820 msedge.exe 85 PID 3820 wrote to memory of 2836 3820 msedge.exe 85 PID 3820 wrote to memory of 2836 3820 msedge.exe 85 PID 3820 wrote to memory of 2836 3820 msedge.exe 85 PID 3820 wrote to memory of 2836 3820 msedge.exe 85 PID 3820 wrote to memory of 2836 3820 msedge.exe 85 PID 3820 wrote to memory of 2836 3820 msedge.exe 85 PID 3820 wrote to memory of 1196 3820 msedge.exe 86 PID 3820 wrote to memory of 1196 3820 msedge.exe 86 PID 3820 wrote to memory of 2644 3820 msedge.exe 87 PID 3820 wrote to memory of 2644 3820 msedge.exe 87 PID 3820 wrote to memory of 2644 3820 msedge.exe 87 PID 3820 wrote to memory of 2644 3820 msedge.exe 87 PID 3820 wrote to memory of 2644 3820 msedge.exe 87 PID 3820 wrote to memory of 2644 3820 msedge.exe 87 PID 3820 wrote to memory of 2644 3820 msedge.exe 87 PID 3820 wrote to memory of 2644 3820 msedge.exe 87 PID 3820 wrote to memory of 2644 3820 msedge.exe 87 PID 3820 wrote to memory of 2644 3820 msedge.exe 87 PID 3820 wrote to memory of 2644 3820 msedge.exe 87 PID 3820 wrote to memory of 2644 3820 msedge.exe 87 PID 3820 wrote to memory of 2644 3820 msedge.exe 87 PID 3820 wrote to memory of 2644 3820 msedge.exe 87 PID 3820 wrote to memory of 2644 3820 msedge.exe 87 PID 3820 wrote to memory of 2644 3820 msedge.exe 87 PID 3820 wrote to memory of 2644 3820 msedge.exe 87 PID 3820 wrote to memory of 2644 3820 msedge.exe 87 PID 3820 wrote to memory of 2644 3820 msedge.exe 87 PID 3820 wrote to memory of 2644 3820 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffec10546f8,0x7ffec1054708,0x7ffec10547182⤵PID:2656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,15638165517800320366,3934142597122078247,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:22⤵PID:2836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,15638165517800320366,3934142597122078247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,15638165517800320366,3934142597122078247,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:82⤵PID:2644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,15638165517800320366,3934142597122078247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:4132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,15638165517800320366,3934142597122078247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:12⤵PID:1872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,15638165517800320366,3934142597122078247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4944 /prefetch:82⤵PID:2268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,15638165517800320366,3934142597122078247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4944 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,15638165517800320366,3934142597122078247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:12⤵PID:5104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,15638165517800320366,3934142597122078247,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:12⤵PID:3132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,15638165517800320366,3934142597122078247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:12⤵PID:4860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,15638165517800320366,3934142597122078247,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:12⤵PID:3404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,15638165517800320366,3934142597122078247,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2732 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2164
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2540
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4160
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5db9081c34e133c32d02f593df88f047a
SHA1a0da007c14fd0591091924edc44bee90456700c6
SHA256c9cd202ebb55fe8dd3e5563948bab458e947d7ba33bc0f38c6b37ce5d0bd7c3e
SHA51212f9809958b024571891fae646208a76f3823ae333716a5cec303e15c38281db042b7acf95bc6523b6328ac9c8644794d39a0e03d9db196f156a6ee1fb4f2744
-
Filesize
152B
MD53a09f853479af373691d131247040276
SHA11b6f098e04da87e9cf2d3284943ec2144f36ac04
SHA256a358de2c0eba30c70a56022c44a3775aa99ffa819cd7f42f7c45ac358b5e739f
SHA512341cf0f363621ee02525cd398ae0d462319c6a80e05fd25d9aca44234c42a3071b51991d4cf102ac9d89561a1567cbe76dfeaad786a304bec33821ca77080016
-
Filesize
6KB
MD542e4251ecc2e429c85403a40c5bfb6c7
SHA196519d28e6a51d5580f06506ff8349d7b02954ee
SHA256e6bc75fbb504216b3616724c6b0bf49578e6f21fd8512c0c5c0276f7a418c409
SHA51276aa17752dfd43c6c7fc92e2e4af02700384d277234f404aef2ab0657b5cd55a588f420f33f8c29dc18ed4d01cf52e699b7ef034e06244b4d4de95c83e2bee84
-
Filesize
6KB
MD595ab5d84e8dec30515e71ee14d827592
SHA164962d73a4a3e8bd4c066194fed38350a3797c6f
SHA2567078b20eba363aaab16e1b5ed66fb98e17eafd10c5d238f3f251beefdafb479b
SHA512e89667da974fa891948c7c2b139facba90b10accd86e33e0c1c501d265ee25c5713223063506f24ebcf4a16be0d8bd8b4a6c4ea79bcf3099b2e5a0820f9ce63a
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD596c6886af4ca817597693550c917018d
SHA17299a375e621e61ab99944f0af5869a2245f8248
SHA256e56536c583312f2f7beee33e1cf68b72ae7f9b7eb094844567d3b3849254f0e7
SHA5128e9fd560fbf078f1573d2ba7f2b2eab279737c8637f3987de66bd5aa707a11ca71f10b9d812b10f6719fb6fe75cdea94ec6b622e5b82074815037e545cd558db