Analysis
-
max time kernel
143s -
max time network
144s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
09-05-2021 20:17
Static task
static1
Behavioral task
behavioral1
Sample
9b31da1c58520b87f41454a14c99bc25e55d444386922ceb8b6cd444e574ed8c.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
9b31da1c58520b87f41454a14c99bc25e55d444386922ceb8b6cd444e574ed8c.exe
Resource
win10v20210410
General
-
Target
9b31da1c58520b87f41454a14c99bc25e55d444386922ceb8b6cd444e574ed8c.exe
-
Size
763KB
-
MD5
2ac4366b1e4a0d6cacc879f009556c15
-
SHA1
d103a5be46ae950e6837158de974c0a98daff782
-
SHA256
9b31da1c58520b87f41454a14c99bc25e55d444386922ceb8b6cd444e574ed8c
-
SHA512
c62a8f55ccf8c14e80be1edb69f15cfa9e49403882ef2c073896bd907b95352e2f2ed2ee9589b9fa9f8bbb8bc4fec7059a28aa01dde3cd686bf5c9f8836c8894
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
._cache_9b31da1c58520b87f41454a14c99bc25e55d444386922ceb8b6cd444e574ed8c.exeSynaptics.exepid process 1524 ._cache_9b31da1c58520b87f41454a14c99bc25e55d444386922ceb8b6cd444e574ed8c.exe 2448 Synaptics.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\QtyUu3ic.xlsm office_macros -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
9b31da1c58520b87f41454a14c99bc25e55d444386922ceb8b6cd444e574ed8c.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation 9b31da1c58520b87f41454a14c99bc25e55d444386922ceb8b6cd444e574ed8c.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
9b31da1c58520b87f41454a14c99bc25e55d444386922ceb8b6cd444e574ed8c.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SS CRACK RETRIX = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 9b31da1c58520b87f41454a14c99bc25e55d444386922ceb8b6cd444e574ed8c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3420 1524 WerFault.exe ._cache_9b31da1c58520b87f41454a14c99bc25e55d444386922ceb8b6cd444e574ed8c.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Modifies registry class 1 IoCs
Processes:
9b31da1c58520b87f41454a14c99bc25e55d444386922ceb8b6cd444e574ed8c.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance 9b31da1c58520b87f41454a14c99bc25e55d444386922ceb8b6cd444e574ed8c.exe -
Processes:
Synaptics.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Synaptics.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Synaptics.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 3576 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
WerFault.exepid process 3420 WerFault.exe 3420 WerFault.exe 3420 WerFault.exe 3420 WerFault.exe 3420 WerFault.exe 3420 WerFault.exe 3420 WerFault.exe 3420 WerFault.exe 3420 WerFault.exe 3420 WerFault.exe 3420 WerFault.exe 3420 WerFault.exe 3420 WerFault.exe 3420 WerFault.exe 3420 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 3420 WerFault.exe Token: SeBackupPrivilege 3420 WerFault.exe Token: SeDebugPrivilege 3420 WerFault.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
EXCEL.EXEpid process 3576 EXCEL.EXE 3576 EXCEL.EXE 3576 EXCEL.EXE 3576 EXCEL.EXE 3576 EXCEL.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
9b31da1c58520b87f41454a14c99bc25e55d444386922ceb8b6cd444e574ed8c.exedescription pid process target process PID 4056 wrote to memory of 1524 4056 9b31da1c58520b87f41454a14c99bc25e55d444386922ceb8b6cd444e574ed8c.exe ._cache_9b31da1c58520b87f41454a14c99bc25e55d444386922ceb8b6cd444e574ed8c.exe PID 4056 wrote to memory of 1524 4056 9b31da1c58520b87f41454a14c99bc25e55d444386922ceb8b6cd444e574ed8c.exe ._cache_9b31da1c58520b87f41454a14c99bc25e55d444386922ceb8b6cd444e574ed8c.exe PID 4056 wrote to memory of 1524 4056 9b31da1c58520b87f41454a14c99bc25e55d444386922ceb8b6cd444e574ed8c.exe ._cache_9b31da1c58520b87f41454a14c99bc25e55d444386922ceb8b6cd444e574ed8c.exe PID 4056 wrote to memory of 2448 4056 9b31da1c58520b87f41454a14c99bc25e55d444386922ceb8b6cd444e574ed8c.exe Synaptics.exe PID 4056 wrote to memory of 2448 4056 9b31da1c58520b87f41454a14c99bc25e55d444386922ceb8b6cd444e574ed8c.exe Synaptics.exe PID 4056 wrote to memory of 2448 4056 9b31da1c58520b87f41454a14c99bc25e55d444386922ceb8b6cd444e574ed8c.exe Synaptics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b31da1c58520b87f41454a14c99bc25e55d444386922ceb8b6cd444e574ed8c.exe"C:\Users\Admin\AppData\Local\Temp\9b31da1c58520b87f41454a14c99bc25e55d444386922ceb8b6cd444e574ed8c.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_9b31da1c58520b87f41454a14c99bc25e55d444386922ceb8b6cd444e574ed8c.exe"C:\Users\Admin\AppData\Local\Temp\._cache_9b31da1c58520b87f41454a14c99bc25e55d444386922ceb8b6cd444e574ed8c.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 7723⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- Modifies system certificate store
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Synaptics\Synaptics.exeMD5
f65d4cf706c2add18897c640b67c8b84
SHA1dd63c38d5fd4a2d466a36dc35e8c082237de24f8
SHA256f1a5a873cc3987b2a2a756aec8bacfb6d2c922892ce07a0ffb820a332fe82655
SHA512b0e5c1a9d5dd2aff80485b2b237e6350fbd14d67323fd6a85fbc221e45a2bc0b48a2d46bb371d5498f9246943c8015bacce15d20c4c453bb772690534babf2e6
-
C:\ProgramData\Synaptics\Synaptics.exeMD5
f65d4cf706c2add18897c640b67c8b84
SHA1dd63c38d5fd4a2d466a36dc35e8c082237de24f8
SHA256f1a5a873cc3987b2a2a756aec8bacfb6d2c922892ce07a0ffb820a332fe82655
SHA512b0e5c1a9d5dd2aff80485b2b237e6350fbd14d67323fd6a85fbc221e45a2bc0b48a2d46bb371d5498f9246943c8015bacce15d20c4c453bb772690534babf2e6
-
C:\Users\Admin\AppData\Local\Temp\._cache_9b31da1c58520b87f41454a14c99bc25e55d444386922ceb8b6cd444e574ed8c.exeMD5
02be6d33b1edbc61c79882d3f556bd8a
SHA18d0afa78893ae5f04e505db0d76d0d50cf34e7da
SHA2564c9f9b9de2ffeea9ccc6524d05ea5b78a14c1642cecc189fe40e7a57a6c294b3
SHA51239949d9a14a17d7cf31aa222a6547be7663673872d5091a77c64b0cd863e399dcdfbff70443bc9a2c2dccc658a998afc5189469723bb5f4c8adeecab47b07967
-
C:\Users\Admin\AppData\Local\Temp\._cache_9b31da1c58520b87f41454a14c99bc25e55d444386922ceb8b6cd444e574ed8c.exeMD5
02be6d33b1edbc61c79882d3f556bd8a
SHA18d0afa78893ae5f04e505db0d76d0d50cf34e7da
SHA2564c9f9b9de2ffeea9ccc6524d05ea5b78a14c1642cecc189fe40e7a57a6c294b3
SHA51239949d9a14a17d7cf31aa222a6547be7663673872d5091a77c64b0cd863e399dcdfbff70443bc9a2c2dccc658a998afc5189469723bb5f4c8adeecab47b07967
-
C:\Users\Admin\AppData\Local\Temp\QtyUu3ic.xlsmMD5
e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
memory/1524-121-0x0000000000640000-0x0000000000641000-memory.dmpFilesize
4KB
-
memory/1524-115-0x0000000000000000-mapping.dmp
-
memory/2448-123-0x00000000005D0000-0x00000000005D1000-memory.dmpFilesize
4KB
-
memory/2448-118-0x0000000000000000-mapping.dmp
-
memory/3576-122-0x00007FF68C2E0000-0x00007FF68F896000-memory.dmpFilesize
53.7MB
-
memory/3576-124-0x00007FF800890000-0x00007FF8008A0000-memory.dmpFilesize
64KB
-
memory/3576-125-0x00007FF800890000-0x00007FF8008A0000-memory.dmpFilesize
64KB
-
memory/3576-126-0x00007FF800890000-0x00007FF8008A0000-memory.dmpFilesize
64KB
-
memory/3576-127-0x00007FF800890000-0x00007FF8008A0000-memory.dmpFilesize
64KB
-
memory/3576-131-0x00007FF800890000-0x00007FF8008A0000-memory.dmpFilesize
64KB
-
memory/3576-130-0x00007FF820AD0000-0x00007FF821BBE000-memory.dmpFilesize
16.9MB
-
memory/3576-132-0x00007FF81EBD0000-0x00007FF820AC5000-memory.dmpFilesize
31.0MB
-
memory/4056-114-0x00000000005C0000-0x000000000070A000-memory.dmpFilesize
1.3MB