cryptbase.dll

MITRE ATT&CK Mapping ... Initial Access Supply Chain Compromise: Compromise Software Supply Chain T1195.002 Modified download links on cpuid.com

For CPU-Z, the hackers bundled a malicious, Zig-compiled file named CRYPTBASE.dll with the otherwise clean CPU-Z application, so that when you run it, the program unknowingly loads the fake, malicious DLL file into its memory space first.

The source code shows the malware bypassing User Account Control (UAC) via a DLL hijack of sysprep.exe... it was found to be vulnerable to a DLL hijacking attack and would load a maliciously planted DLL (named cryptbase.dll) into its elevated process context.

MITRE ATT&CK Mapping ... Defense Evasion Obfuscated Files or Information T1027 Multi-stage in-memory execution

MITRE ATT&CK Mapping ... Defense Evasion System Binary Proxy Execution T1218 NTDLL function proxying

MITRE ATT&CK Mapping ... Defense Evasion Virtualization/Sandbox Evasion T1497 BIOS checks, VM detection, WMI

For CPU-Z, the hackers bundled a malicious, Zig-compiled file named CRYPTBASE.dll with the otherwise clean CPU-Z application, so that when you run it, the program unknowingly loads the fake, malicious DLL file into its memory space first.

MITRE ATT&CK Mapping ... Defense Evasion Reflective Code Loading T1620 .NET assembly loaded in-memory

MITRE ATT&CK Mapping ... Discovery System Information Discovery T1082 CPU name, BIOS, hardware enumeration

MITRE ATT&CK Mapping ... Defense Evasion Virtualization/Sandbox Evasion T1497 BIOS checks, VM detection, WMI

MITRE ATT&CK Mapping ... Command and Control Application Layer Protocol T1071 C2 on port 31415

MITRE ATT&CK Mapping ... Command and Control Encrypted Channel: Asymmetric Cryptography T1573.002 DNS-over-HTTPS for C2 resolution