7c4299a0d48dee3e4d10826e45d641890fa518664f2bba15f213a1c860b70425

Analysis

max time kernel
137s
max time network
145s
platform
windows7_x64
resource
win7v20210408
submitted
08-05-2021 21:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c4299a0d48dee3e4d10826e45d641890fa518664f2bba15f213a1c860b70425.exe
Size

2.3MB
MD5

e1e7c9167a33853fe5927308ca8fb641
SHA1

7b10e50fb0f08cb4b46bbf84893a80b957e976dc
SHA256

7c4299a0d48dee3e4d10826e45d641890fa518664f2bba15f213a1c860b70425
SHA512

a727afa39c10a269136a732a878d0534660941fc242569bf2428e30e08ce22090e2283a45f210f5c6430cc4bc18029068210e3e6b665f50972b805547253fc9b

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

._cache_7c4299a0d48dee3e4d10826e45d641890fa518664f2bba15f213a1c860b70425.exeSynaptics.exe

pid process

1732 ._cache_7c4299a0d48dee3e4d10826e45d641890fa518664f2bba15f213a1c860b70425.exe
1268 Synaptics.exe

Loads dropped DLL 8 IoCs

Processes:

7c4299a0d48dee3e4d10826e45d641890fa518664f2bba15f213a1c860b70425.exeWerFault.exe

pid	process
1828	7c4299a0d48dee3e4d10826e45d641890fa518664f2bba15f213a1c860b70425.exe
1828	7c4299a0d48dee3e4d10826e45d641890fa518664f2bba15f213a1c860b70425.exe
1828	7c4299a0d48dee3e4d10826e45d641890fa518664f2bba15f213a1c860b70425.exe
1756	WerFault.exe
1756	WerFault.exe
1756	WerFault.exe
1756	WerFault.exe
1756	WerFault.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

7c4299a0d48dee3e4d10826e45d641890fa518664f2bba15f213a1c860b70425.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	7c4299a0d48dee3e4d10826e45d641890fa518664f2bba15f213a1c860b70425.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1756 1732 WerFault.exe ._cache_7c4299a0d48dee3e4d10826e45d641890fa518664f2bba15f213a1c860b70425.exe

pid	pid_target	process	target process
1756	1732	WerFault.exe	._cache_7c4299a0d48dee3e4d10826e45d641890fa518664f2bba15f213a1c860b70425.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

Synaptics.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	Synaptics.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Synaptics.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Synaptics.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

._cache_7c4299a0d48dee3e4d10826e45d641890fa518664f2bba15f213a1c860b70425.exeWerFault.exe

pid	process
1732	._cache_7c4299a0d48dee3e4d10826e45d641890fa518664f2bba15f213a1c860b70425.exe
1756	WerFault.exe
1756	WerFault.exe
1756	WerFault.exe
1756	WerFault.exe
1756	WerFault.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1756 WerFault.exe

pid	process
1756	WerFault.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

._cache_7c4299a0d48dee3e4d10826e45d641890fa518664f2bba15f213a1c860b70425.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	1732	._cache_7c4299a0d48dee3e4d10826e45d641890fa518664f2bba15f213a1c860b70425.exe
Token: SeDebugPrivilege	1756	WerFault.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

7c4299a0d48dee3e4d10826e45d641890fa518664f2bba15f213a1c860b70425.exe._cache_7c4299a0d48dee3e4d10826e45d641890fa518664f2bba15f213a1c860b70425.exe

description	pid	process	target process
PID 1828 wrote to memory of 1732	1828	7c4299a0d48dee3e4d10826e45d641890fa518664f2bba15f213a1c860b70425.exe	._cache_7c4299a0d48dee3e4d10826e45d641890fa518664f2bba15f213a1c860b70425.exe
PID 1828 wrote to memory of 1732	1828	7c4299a0d48dee3e4d10826e45d641890fa518664f2bba15f213a1c860b70425.exe	._cache_7c4299a0d48dee3e4d10826e45d641890fa518664f2bba15f213a1c860b70425.exe
PID 1828 wrote to memory of 1732	1828	7c4299a0d48dee3e4d10826e45d641890fa518664f2bba15f213a1c860b70425.exe	._cache_7c4299a0d48dee3e4d10826e45d641890fa518664f2bba15f213a1c860b70425.exe
PID 1828 wrote to memory of 1732	1828	7c4299a0d48dee3e4d10826e45d641890fa518664f2bba15f213a1c860b70425.exe	._cache_7c4299a0d48dee3e4d10826e45d641890fa518664f2bba15f213a1c860b70425.exe
PID 1828 wrote to memory of 1268	1828	7c4299a0d48dee3e4d10826e45d641890fa518664f2bba15f213a1c860b70425.exe	Synaptics.exe
PID 1828 wrote to memory of 1268	1828	7c4299a0d48dee3e4d10826e45d641890fa518664f2bba15f213a1c860b70425.exe	Synaptics.exe
PID 1828 wrote to memory of 1268	1828	7c4299a0d48dee3e4d10826e45d641890fa518664f2bba15f213a1c860b70425.exe	Synaptics.exe
PID 1828 wrote to memory of 1268	1828	7c4299a0d48dee3e4d10826e45d641890fa518664f2bba15f213a1c860b70425.exe	Synaptics.exe
PID 1732 wrote to memory of 1756	1732	._cache_7c4299a0d48dee3e4d10826e45d641890fa518664f2bba15f213a1c860b70425.exe	WerFault.exe
PID 1732 wrote to memory of 1756	1732	._cache_7c4299a0d48dee3e4d10826e45d641890fa518664f2bba15f213a1c860b70425.exe	WerFault.exe
PID 1732 wrote to memory of 1756	1732	._cache_7c4299a0d48dee3e4d10826e45d641890fa518664f2bba15f213a1c860b70425.exe	WerFault.exe
PID 1732 wrote to memory of 1756	1732	._cache_7c4299a0d48dee3e4d10826e45d641890fa518664f2bba15f213a1c860b70425.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\7c4299a0d48dee3e4d10826e45d641890fa518664f2bba15f213a1c860b70425.exe
"C:\Users\Admin\AppData\Local\Temp\7c4299a0d48dee3e4d10826e45d641890fa518664f2bba15f213a1c860b70425.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1828

C:\Users\Admin\AppData\Local\Temp\._cache_7c4299a0d48dee3e4d10826e45d641890fa518664f2bba15f213a1c860b70425.exe
"C:\Users\Admin\AppData\Local\Temp\._cache_7c4299a0d48dee3e4d10826e45d641890fa518664f2bba15f213a1c860b70425.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 988
3⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1756

C:\ProgramData\Synaptics\Synaptics.exe
"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
2⤵
- Executes dropped EXE
- Modifies system certificate store
PID:1268

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Install Root Certificate

T1130

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe
MD5
cf164330da0dde9201f74ebe2b580d3f

SHA1
2299e06512e6a849cc1765964e7c0cc26f6b188c

SHA256
3235b73709f9eae9b2ea5044a0e11f64a4612a02efb9e618eaf390c2a3edecbc

SHA512
ddd150ba9eb719fac7db15845b35686cff38b2f095fc20d0d48e74f67910ecaf5f36d6a89330efcf59b8e2e42c0c6abdf9b61baf7a52c3892e407baf189a7757

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_7c4299a0d48dee3e4d10826e45d641890fa518664f2bba15f213a1c860b70425.exe
MD5
c4fffdc9f17ef6307357c7f02a244cb6

SHA1
f6ba646d5f8ebd39573412ffbbda393b6392df96

SHA256
8eaffe8ea88de1db38566f48a2843a4e401db8dd650f4ce01c6744bd998f8ff0

SHA512
1eb3025cf0a56f9dab5f8daccae8e7e10068fda4dfd05ef5ac9a55cc3f7b1a0680ab6fbd738b7971ba1974eb1f1e46cf76dbeda999c476e2d4e7e8b40398d8ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_7c4299a0d48dee3e4d10826e45d641890fa518664f2bba15f213a1c860b70425.exe
MD5
c4fffdc9f17ef6307357c7f02a244cb6

SHA1
f6ba646d5f8ebd39573412ffbbda393b6392df96

SHA256
8eaffe8ea88de1db38566f48a2843a4e401db8dd650f4ce01c6744bd998f8ff0

SHA512
1eb3025cf0a56f9dab5f8daccae8e7e10068fda4dfd05ef5ac9a55cc3f7b1a0680ab6fbd738b7971ba1974eb1f1e46cf76dbeda999c476e2d4e7e8b40398d8ac

Download Submit
\ProgramData\Synaptics\Synaptics.exe
MD5
cf164330da0dde9201f74ebe2b580d3f

SHA1
2299e06512e6a849cc1765964e7c0cc26f6b188c

SHA256
3235b73709f9eae9b2ea5044a0e11f64a4612a02efb9e618eaf390c2a3edecbc

SHA512
ddd150ba9eb719fac7db15845b35686cff38b2f095fc20d0d48e74f67910ecaf5f36d6a89330efcf59b8e2e42c0c6abdf9b61baf7a52c3892e407baf189a7757

Download Submit
\ProgramData\Synaptics\Synaptics.exe
MD5
cf164330da0dde9201f74ebe2b580d3f

SHA1
2299e06512e6a849cc1765964e7c0cc26f6b188c

SHA256
3235b73709f9eae9b2ea5044a0e11f64a4612a02efb9e618eaf390c2a3edecbc

SHA512
ddd150ba9eb719fac7db15845b35686cff38b2f095fc20d0d48e74f67910ecaf5f36d6a89330efcf59b8e2e42c0c6abdf9b61baf7a52c3892e407baf189a7757

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_7c4299a0d48dee3e4d10826e45d641890fa518664f2bba15f213a1c860b70425.exe
MD5
c4fffdc9f17ef6307357c7f02a244cb6

SHA1
f6ba646d5f8ebd39573412ffbbda393b6392df96

SHA256
8eaffe8ea88de1db38566f48a2843a4e401db8dd650f4ce01c6744bd998f8ff0

SHA512
1eb3025cf0a56f9dab5f8daccae8e7e10068fda4dfd05ef5ac9a55cc3f7b1a0680ab6fbd738b7971ba1974eb1f1e46cf76dbeda999c476e2d4e7e8b40398d8ac

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_7c4299a0d48dee3e4d10826e45d641890fa518664f2bba15f213a1c860b70425.exe
MD5
c4fffdc9f17ef6307357c7f02a244cb6

SHA1
f6ba646d5f8ebd39573412ffbbda393b6392df96

SHA256
8eaffe8ea88de1db38566f48a2843a4e401db8dd650f4ce01c6744bd998f8ff0

SHA512
1eb3025cf0a56f9dab5f8daccae8e7e10068fda4dfd05ef5ac9a55cc3f7b1a0680ab6fbd738b7971ba1974eb1f1e46cf76dbeda999c476e2d4e7e8b40398d8ac

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_7c4299a0d48dee3e4d10826e45d641890fa518664f2bba15f213a1c860b70425.exe
MD5
c4fffdc9f17ef6307357c7f02a244cb6

SHA1
f6ba646d5f8ebd39573412ffbbda393b6392df96

SHA256
8eaffe8ea88de1db38566f48a2843a4e401db8dd650f4ce01c6744bd998f8ff0

SHA512
1eb3025cf0a56f9dab5f8daccae8e7e10068fda4dfd05ef5ac9a55cc3f7b1a0680ab6fbd738b7971ba1974eb1f1e46cf76dbeda999c476e2d4e7e8b40398d8ac

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_7c4299a0d48dee3e4d10826e45d641890fa518664f2bba15f213a1c860b70425.exe
MD5
c4fffdc9f17ef6307357c7f02a244cb6

SHA1
f6ba646d5f8ebd39573412ffbbda393b6392df96

SHA256
8eaffe8ea88de1db38566f48a2843a4e401db8dd650f4ce01c6744bd998f8ff0

SHA512
1eb3025cf0a56f9dab5f8daccae8e7e10068fda4dfd05ef5ac9a55cc3f7b1a0680ab6fbd738b7971ba1974eb1f1e46cf76dbeda999c476e2d4e7e8b40398d8ac

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_7c4299a0d48dee3e4d10826e45d641890fa518664f2bba15f213a1c860b70425.exe
MD5
c4fffdc9f17ef6307357c7f02a244cb6

SHA1
f6ba646d5f8ebd39573412ffbbda393b6392df96

SHA256
8eaffe8ea88de1db38566f48a2843a4e401db8dd650f4ce01c6744bd998f8ff0

SHA512
1eb3025cf0a56f9dab5f8daccae8e7e10068fda4dfd05ef5ac9a55cc3f7b1a0680ab6fbd738b7971ba1974eb1f1e46cf76dbeda999c476e2d4e7e8b40398d8ac

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_7c4299a0d48dee3e4d10826e45d641890fa518664f2bba15f213a1c860b70425.exe
MD5
c4fffdc9f17ef6307357c7f02a244cb6

SHA1
f6ba646d5f8ebd39573412ffbbda393b6392df96

SHA256
8eaffe8ea88de1db38566f48a2843a4e401db8dd650f4ce01c6744bd998f8ff0

SHA512
1eb3025cf0a56f9dab5f8daccae8e7e10068fda4dfd05ef5ac9a55cc3f7b1a0680ab6fbd738b7971ba1974eb1f1e46cf76dbeda999c476e2d4e7e8b40398d8ac

Download Submit
memory/1268-68-0x0000000000000000-mapping.dmp

Download
memory/1268-71-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/1732-72-0x0000000001190000-0x0000000001191000-memory.dmp

Filesize
4KB

Download
memory/1732-74-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

Filesize
4KB

Download
memory/1732-63-0x0000000000000000-mapping.dmp

Download
memory/1756-75-0x0000000000000000-mapping.dmp

Download
memory/1756-81-0x0000000001C90000-0x0000000001C91000-memory.dmp

Filesize
4KB

Download
memory/1828-60-0x0000000075FF1000-0x0000000075FF3000-memory.dmp

Filesize
8KB

Download
memory/1828-61-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download

pid	process
1732	._cache_7c4299a0d48dee3e4d10826e45d641890fa518664f2bba15f213a1c860b70425.exe
1268	Synaptics.exe