Technical Information
Malicious functions
Injects code into
the following user processes:
- stand manager.exe
Modifies file system
Creates the following files
- %TEMP%\nscaa4b.tmp\system.dll
- %TEMP%\nscaa4b.tmp\app-64.7z
- %TEMP%\nscaa4b.tmp\nsis7z.dll
- %TEMP%\nscaa4b.tmp\7z-out\chrome_100_percent.pak
- %TEMP%\nscaa4b.tmp\7z-out\chrome_200_percent.pak
- %TEMP%\nscaa4b.tmp\7z-out\icudtl.dat
- %TEMP%\nscaa4b.tmp\7z-out\license.electron.txt
- %TEMP%\nscaa4b.tmp\7z-out\licenses.chromium.html
- %TEMP%\nscaa4b.tmp\7z-out\locales\af.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\am.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\ar.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\bg.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\bn.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\ca.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\cs.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\da.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\de.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\el.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\en-gb.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\en-us.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\es-419.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\es.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\et.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\fa.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\fi.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\fil.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\fr.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\gu.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\he.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\hi.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\hr.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\hu.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\id.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\it.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\ja.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\kn.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\ko.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\lt.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\lv.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\ml.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\mr.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\ms.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\nb.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\nl.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\pl.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\pt-br.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\pt-pt.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\ro.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\ru.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\sk.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\sl.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\sr.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\sv.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\sw.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\ta.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\te.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\th.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\tr.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\uk.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\ur.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\vi.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\zh-cn.pak
- %TEMP%\nscaa4b.tmp\7z-out\locales\zh-tw.pak
- %TEMP%\nscaa4b.tmp\7z-out\resources\app.asar
- %TEMP%\nscaa4b.tmp\7z-out\resources\files\res.ahk
- %TEMP%\nscaa4b.tmp\7z-out\resources\icon.ico
- %TEMP%\nscaa4b.tmp\7z-out\resources.pak
- %TEMP%\nscaa4b.tmp\7z-out\snapshot_blob.bin
- %TEMP%\nscaa4b.tmp\7z-out\v8_context_snapshot.bin
- %TEMP%\nscaa4b.tmp\7z-out\vk_swiftshader_icd.json
- %TEMP%\nscaa4b.tmp\7z-out\d3dcompiler_47.dll
- %TEMP%\nscaa4b.tmp\7z-out\ffmpeg.dll
- %TEMP%\nscaa4b.tmp\7z-out\libegl.dll
- %TEMP%\nscaa4b.tmp\7z-out\libglesv2.dll
- %TEMP%\nscaa4b.tmp\7z-out\resources\elevate.exe
- %TEMP%\nscaa4b.tmp\7z-out\resources\files\ahk.exe
- %TEMP%\nscaa4b.tmp\7z-out\resources\files\jump_scroll.exe
- %TEMP%\nscaa4b.tmp\7z-out\resources\fvfps.exe
- %TEMP%\nscaa4b.tmp\7z-out\stand manager.exe
- %TEMP%\nscaa4b.tmp\7z-out\vk_swiftshader.dll
- %TEMP%\nscaa4b.tmp\7z-out\vulkan-1.dll
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\chrome_100_percent.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\chrome_200_percent.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\d3dcompiler_47.dll
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\ffmpeg.dll
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\icudtl.dat
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\libegl.dll
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\libglesv2.dll
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\license.electron.txt
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\licenses.chromium.html
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\resources.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\snapshot_blob.bin
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\stand manager.exe
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\v8_context_snapshot.bin
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\vk_swiftshader.dll
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\vk_swiftshader_icd.json
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\vulkan-1.dll
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\af.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\am.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\ar.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\bg.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\bn.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\ca.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\cs.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\da.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\de.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\el.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\en-gb.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\en-us.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\es-419.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\es.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\et.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\fa.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\fi.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\fil.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\fr.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\gu.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\he.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\hi.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\hr.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\hu.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\id.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\it.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\ja.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\kn.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\ko.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\lt.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\lv.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\ml.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\mr.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\ms.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\nb.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\nl.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\pl.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\pt-br.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\pt-pt.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\ro.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\ru.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\sk.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\sl.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\sr.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\sv.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\sw.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\ta.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\te.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\th.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\tr.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\uk.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\ur.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\vi.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\zh-cn.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\locales\zh-tw.pak
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\resources\app.asar
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\resources\elevate.exe
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\resources\fvfps.exe
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\resources\icon.ico
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\resources\files\ahk.exe
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\resources\files\jump_scroll.exe
- %TEMP%\3e1wrqofgf5bhcpteow7kxobajr\resources\files\res.ahk
- %TEMP%\nscaa4b.tmp\stdutils.dll
- %HOMEPATH%\desktop\stand manager.exe
- %APPDATA%\stand manager\scripts\jump_scroll.ahk
- %APPDATA%\stand manager\scripts\bhop_cs.ahk
- %APPDATA%\stand manager\scripts\resolution_toggle.ahk
- %APPDATA%\stand manager\scripts\custom_example.ahk
- %APPDATA%\stand manager\scripts\feature-focus.ahk
- %APPDATA%\stand manager\scripts\feature-cursor-fix.ahk
- %APPDATA%\stand manager\scripts\feature-dpi-bind.ahk
- %APPDATA%\stand manager\scripts.json
- %APPDATA%\stand manager\local storage\leveldb\log
- %APPDATA%\stand manager\local storage\leveldb\manifest-000001
- %APPDATA%\stand manager\code cache\wasm\index
- %APPDATA%\stand manager\code cache\js\index
- %APPDATA%\stand manager\code cache\wasm\index-dir\temp-index
- %APPDATA%\stand manager\code cache\js\index-dir\temp-index
- %APPDATA%\microsoft\spelling\en-us\default.dic
- %APPDATA%\stand manager\56e4aa9d-d1ad-4543-9d8e-21d32bef03af.tmp
- %APPDATA%\stand manager\shared dictionary\db-journal
- %APPDATA%\stand manager\9b2e81ac-b824-4c16-9866-7521dddfe408.tmp
- %APPDATA%\stand manager\cache\cache_data\index
- %APPDATA%\stand manager\shared dictionary\cache\index
- %APPDATA%\stand manager\local storage\leveldb\000001.dbtmp
- %APPDATA%\microsoft\spelling\en-us\default.exc
- %APPDATA%\stand manager\shared dictionary\cache\index-dir\temp-index
- %APPDATA%\stand manager\network\cookies-journal
- %APPDATA%\stand manager\network\trust tokens-journal
- %APPDATA%\stand manager\cache\cache_data\data_0
- %APPDATA%\stand manager\cache\cache_data\data_1
- %APPDATA%\stand manager\cache\cache_data\data_2
- %APPDATA%\stand manager\cache\cache_data\data_3
- %APPDATA%\microsoft\spelling\en-us\default.acl
- %APPDATA%\stand manager\shared dictionary\db
- %APPDATA%\stand manager\network\trust tokens
- %APPDATA%\stand manager\network\cookies
- %TEMP%\dfa31769-dbea-4b33-a75e-497729ca967d.tmp
- nul
- %APPDATA%\stand manager\network\9a1ae5a4-14cb-4f57-afe8-c3788d5efdcd.tmp
- %APPDATA%\stand manager\network\c5fb9f75-f31c-473b-ae27-58e786334560.tmp
Moves the following files
- from %APPDATA%\stand manager\code cache\wasm\index-dir\temp-index to %APPDATA%\stand manager\code cache\wasm\index-dir\the-real-index
- from %APPDATA%\stand manager\code cache\js\index-dir\temp-index to %APPDATA%\stand manager\code cache\js\index-dir\the-real-index
- from %APPDATA%\stand manager\shared dictionary\cache\index-dir\temp-index to %APPDATA%\stand manager\shared dictionary\cache\index-dir\the-real-index
- from %APPDATA%\stand manager\56e4aa9d-d1ad-4543-9d8e-21d32bef03af.tmp to %APPDATA%\stand manager\local state
- from %APPDATA%\stand manager\local storage\leveldb\000001.dbtmp to %APPDATA%\stand manager\local storage\leveldb\current
- from %APPDATA%\stand manager\9b2e81ac-b824-4c16-9866-7521dddfe408.tmp to %APPDATA%\stand manager\preferences
- from %APPDATA%\stand manager\network\9a1ae5a4-14cb-4f57-afe8-c3788d5efdcd.tmp to %APPDATA%\stand manager\network\network persistent state
- from %APPDATA%\stand manager\network\c5fb9f75-f31c-473b-ae27-58e786334560.tmp to %APPDATA%\stand manager\network\transportsecurity
Network activity
Connects to
- 'dn#.google':443
- '14#.#51.38.68':443
- '21#.#8.198.164':443
- '21#.#1.201.215':3847
TCP
Other
- 'dn#.google':443
- '14#.#51.151.119':443
- '14#.#51.38.68':443
- '21#.#8.198.164':443
UDP
- DNS ASK dn#.google
- 'dn#.google':443
- '14#.#51.151.119':443
- '21#.#8.198.164':443
- '14#.#51.38.68':443
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: ''
Creates and executes the following
- '%TEMP%\3e1wrqofgf5bhcpteow7kxobajr\stand manager.exe'
- '%TEMP%\3e1wrqofgf5bhcpteow7kxobajr\stand manager.exe' --type=gpu-process --user-data-dir="%APPDATA%\Stand Manager" --gpu-preferences=WAAAAAAAAADgABAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAA...
- '%TEMP%\3e1wrqofgf5bhcpteow7kxobajr\stand manager.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="%APPDATA%\Stand Manager" --mojo-platform-channel-handle=2004 --field-tri...
- '%TEMP%\3e1wrqofgf5bhcpteow7kxobajr\stand manager.exe' --type=renderer --user-data-dir="%APPDATA%\Stand Manager" --app-user-model-id="Stand Manager" --app-path="%TEMP%\3E1WrqOfGF5bhcpteoW7KxOBAjR\resources\app.asar" --enable-sandbox --lang=en-US --...
- '%TEMP%\3e1wrqofgf5bhcpteow7kxobajr\stand manager.exe' --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="%...
Executes the following
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\\SOFTWARE\\Microsoft\\Cryptography" /v MachineGuid"
- '<SYSTEM32>\reg.exe' query "HKLM\\SOFTWARE\\Microsoft\\Cryptography" /v MachineGuid
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\\SOFTWARE\\Microsoft\\Cryptography" /v MachineGuid"' (with hidden window)