Technical Information
Malicious functions
Injects code into
the following user processes:
- entropy.exe
Modifies file system
Creates the following files
- %TEMP%\nsa52e1.tmp\system.dll
- %APPDATA%\entropy\code cache\js\index-dir\temp-index
- %APPDATA%\entropy\gpucache\data_3
- %APPDATA%\entropy\gpucache\data_2
- %APPDATA%\entropy\gpucache\data_1
- %APPDATA%\entropy\gpucache\data_0
- %APPDATA%\entropy\gpucache\index
- %APPDATA%\entropy\code cache\wasm\index-dir\temp-index
- %APPDATA%\entropy\local storage\leveldb\000001.dbtmp
- %APPDATA%\entropy\local storage\leveldb\log
- %APPDATA%\entropy\code cache\wasm\index
- %APPDATA%\entropy\code cache\js\index
- %TEMP%\nsa52e1.tmp\stdutils.dll
- %TEMP%\2mykxjbnv7eo9lf69xywldxzdn7\swiftshader\libglesv2.dll
- %TEMP%\2mykxjbnv7eo9lf69xywldxzdn7\swiftshader\libegl.dll
- %APPDATA%\entropy\local storage\leveldb\manifest-000001
- %APPDATA%\entropy\cookies
- %APPDATA%\ca0282c6-70fb-47ef-8c8d-724538525e31.tmp
- %APPDATA%\entropy\cache\data_0
- %TEMP%\6c10376e-ab26-4482-9ff6-4620721ba170.tmp
- %APPDATA%\entropy\fontlookuptablecache\font_unique_name_table.pb
- %APPDATA%\entropy\fe8560f7-ef1f-42aa-96a9-9e9506c70e81.tmp
- %APPDATA%\entropy\cache\f_000003
- %APPDATA%\entropy\cache\f_000002
- %APPDATA%\entropy\cache\f_000001
- %TEMP%\2mykxjbnv7eo9lf69xywldxzdn7\resources\elevate.exe
- %APPDATA%\entropy\dictionaries\en-us-9-0.bdic
- %APPDATA%\entropy\cookies-journal
- %APPDATA%\entropy\59e1a7d1-5440-495e-bed2-06842c961f16.tmp
- %APPDATA%\entropy\0b4b4920-e966-4da9-b9ba-ba2c4441fe67.tmp
- %APPDATA%\entropy\cache\data_3
- %APPDATA%\entropy\cache\data_2
- %APPDATA%\entropy\cache\data_1
- %TEMP%\2mykxjbnv7eo9lf69xywldxzdn7\debug.log
- %APPDATA%\entropy\cache\index
- %TEMP%\2mykxjbnv7eo9lf69xywldxzdn7\resources\app.asar
- %TEMP%\nsa52e1.tmp\7z-out\swiftshader\libegl.dll
- %TEMP%\nsa52e1.tmp\7z-out\libegl.dll
- %TEMP%\nsa52e1.tmp\7z-out\ffmpeg.dll
- %TEMP%\nsa52e1.tmp\7z-out\entropy.exe
- %TEMP%\nsa52e1.tmp\7z-out\d3dcompiler_47.dll
- %TEMP%\nsa52e1.tmp\7z-out\vk_swiftshader_icd.json
- %TEMP%\nsa52e1.tmp\7z-out\v8_context_snapshot.bin
- %TEMP%\nsa52e1.tmp\7z-out\libglesv2.dll
- %TEMP%\nsa52e1.tmp\7z-out\snapshot_blob.bin
- %TEMP%\nsa52e1.tmp\7z-out\license.electron.txt
- %TEMP%\nsa52e1.tmp\7z-out\icudtl.dat
- %TEMP%\nsa52e1.tmp\7z-out\chrome_200_percent.pak
- %TEMP%\nsa52e1.tmp\7z-out\chrome_100_percent.pak
- %TEMP%\nsa52e1.tmp\nsis7z.dll
- %TEMP%\nsa52e1.tmp\app-32.7z
- %TEMP%\nsa52e1.tmp\7z-out\resources\app.asar
- %TEMP%\2mykxjbnv7eo9lf69xywldxzdn7\ffmpeg.dll
- %TEMP%\2mykxjbnv7eo9lf69xywldxzdn7\vk_swiftshader_icd.json
- %TEMP%\nsa52e1.tmp\7z-out\swiftshader\libglesv2.dll
- %TEMP%\2mykxjbnv7eo9lf69xywldxzdn7\vk_swiftshader.dll
- %TEMP%\2mykxjbnv7eo9lf69xywldxzdn7\v8_context_snapshot.bin
- %TEMP%\2mykxjbnv7eo9lf69xywldxzdn7\snapshot_blob.bin
- %TEMP%\2mykxjbnv7eo9lf69xywldxzdn7\license.electron.txt
- %TEMP%\2mykxjbnv7eo9lf69xywldxzdn7\libglesv2.dll
- %TEMP%\2mykxjbnv7eo9lf69xywldxzdn7\libegl.dll
- %TEMP%\2mykxjbnv7eo9lf69xywldxzdn7\vulkan-1.dll
- %TEMP%\2mykxjbnv7eo9lf69xywldxzdn7\icudtl.dat
- %TEMP%\2mykxjbnv7eo9lf69xywldxzdn7\entropy.exe
- %TEMP%\2mykxjbnv7eo9lf69xywldxzdn7\d3dcompiler_47.dll
- %TEMP%\2mykxjbnv7eo9lf69xywldxzdn7\chrome_200_percent.pak
- %TEMP%\2mykxjbnv7eo9lf69xywldxzdn7\chrome_100_percent.pak
- %TEMP%\nsa52e1.tmp\7z-out\vulkan-1.dll
- %TEMP%\nsa52e1.tmp\7z-out\vk_swiftshader.dll
- %TEMP%\nsa52e1.tmp\7z-out\resources\elevate.exe
- %APPDATA%\entropy\b66023f2-8730-40bf-8423-6743323bf23f.tmp
Deletes the following files
- %APPDATA%\entropy\network persistent state~rfed1df.tmp
Moves the following files
- from %APPDATA%\entropy\local storage\leveldb\000001.dbtmp to %APPDATA%\entropy\local storage\leveldb\current
- from %APPDATA%\entropy\code cache\js\index-dir\temp-index to %APPDATA%\entropy\code cache\js\index-dir\the-real-index
- from %APPDATA%\entropy\code cache\wasm\index-dir\temp-index to %APPDATA%\entropy\code cache\wasm\index-dir\the-real-index
- from %APPDATA%\entropy\0b4b4920-e966-4da9-b9ba-ba2c4441fe67.tmp to %APPDATA%\entropy\local state
- from %APPDATA%\entropy\59e1a7d1-5440-495e-bed2-06842c961f16.tmp to %APPDATA%\entropy\preferences
- from %APPDATA%\entropy\fe8560f7-ef1f-42aa-96a9-9e9506c70e81.tmp to %APPDATA%\entropy\network persistent state
- from %APPDATA%\ca0282c6-70fb-47ef-8c8d-724538525e31.tmp to %APPDATA%\entropy
- from %APPDATA%\entropy\network persistent state to %APPDATA%\entropy\network persistent state~rfed1df.tmp
Substitutes the following files
- %APPDATA%\entropy\network persistent state
Network activity
Connects to
- 're####ctor.gvt1.com':443
- 'dn#.google':443
- '10#.#1.86.83':443
- '16#.#59.129.233':443
- '35.#90.80.1':443
- 'microsoft.com':80
TCP
HTTP GET requests
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
Other
- 're####ctor.gvt1.com':443
- 'dn#.google':443
- '17#.#94.180.227':443
- '16#.#59.129.233':443
- '10#.#1.86.83':443
- '35.#90.80.1':443
UDP
- DNS ASK re####ctor.gvt1.com
- DNS ASK dn#.google
- DNS ASK microsoft.com
- 'dn#.google':443
- '17#.#94.180.227':443
- '10#.#1.86.83':443
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: ''
Creates and executes the following
- '%TEMP%\2mykxjbnv7eo9lf69xywldxzdn7\entropy.exe'
- '%TEMP%\2mykxjbnv7eo9lf69xywldxzdn7\entropy.exe' --type=gpu-process --field-trial-handle=1040,10944676107457194809,3956049224241239571,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --user-data-dir...
- '%TEMP%\2mykxjbnv7eo9lf69xywldxzdn7\entropy.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1040,10944676107457194809,3956049224241239571,131072 --disable-features=SpareRendererForSitePerProcess,WinRet...
- '%TEMP%\2mykxjbnv7eo9lf69xywldxzdn7\entropy.exe' --type=renderer --user-data-dir="%APPDATA%\entropy" --app-path="%TEMP%\2MyKXjBnV7eo9Lf69xYWlDXzDn7\resources\app.asar" --no-sandbox --no-zygote --field-trial-handle=1040,10944676107457194809,39...
