adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28

General

Target

adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe
Size

939KB
MD5

3c421e69d0be9accecfe6ace1928c3c6
SHA1

33d3c93af60f4702e34d6d435affff390bcbe897
SHA256

adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28
SHA512

7fefb37f607147d320477ad2156bc2f7f428ba3de3f29532fcef0dd327285f74e6355ae032fa495ccb785eb254dba51609f457c13b368764528f9bbfcc6021b3

Score

8^/10

macro persistence vmprotect

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

._cache_adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exeSynaptics.exe

pid process

3284 ._cache_adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe
500 Synaptics.exe

pid	process
3284	._cache_adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe
500	Synaptics.exe

Suspicious Office macro 1 IoCs

Office document equipped with macros.

macro

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Hz2tyurm.xlsm	office_macros

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\._cache_adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe	vmprotect
C:\Users\Admin\AppData\Local\Temp\._cache_adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe	vmprotect
behavioral2/memory/3284-123-0x00000000009C0000-0x00000000009C1000-memory.dmp	vmprotect

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation	adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2124 3284 WerFault.exe ._cache_adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe

pid	pid_target	process	target process
2124	3284	WerFault.exe	._cache_adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies registry class 1 IoCs

Processes:

adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance	adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

Synaptics.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Synaptics.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Synaptics.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

632 EXCEL.EXE

pid	process
632	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
2124	WerFault.exe
2124	WerFault.exe
2124	WerFault.exe
2124	WerFault.exe
2124	WerFault.exe
2124	WerFault.exe
2124	WerFault.exe
2124	WerFault.exe
2124	WerFault.exe
2124	WerFault.exe
2124	WerFault.exe
2124	WerFault.exe
2124	WerFault.exe
2124	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2124 WerFault.exe
Token: SeBackupPrivilege 2124 WerFault.exe
Token: SeDebugPrivilege 2124 WerFault.exe
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

EXCEL.EXE

pid process

632 EXCEL.EXE
632 EXCEL.EXE
632 EXCEL.EXE
632 EXCEL.EXE
632 EXCEL.EXE

description	pid	process
Token: SeRestorePrivilege	2124	WerFault.exe
Token: SeBackupPrivilege	2124	WerFault.exe
Token: SeDebugPrivilege	2124	WerFault.exe

pid	process
632	EXCEL.EXE
632	EXCEL.EXE
632	EXCEL.EXE
632	EXCEL.EXE
632	EXCEL.EXE

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe

description	pid	process	target process
PID 640 wrote to memory of 3284	640	adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe	._cache_adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe
PID 640 wrote to memory of 3284	640	adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe	._cache_adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe
PID 640 wrote to memory of 3284	640	adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe	._cache_adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe
PID 640 wrote to memory of 500	640	adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe	Synaptics.exe
PID 640 wrote to memory of 500	640	adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe	Synaptics.exe
PID 640 wrote to memory of 500	640	adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe	Synaptics.exe

C:\Users\Admin\AppData\Local\Temp\adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe
"C:\Users\Admin\AppData\Local\Temp\adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:640

C:\Users\Admin\AppData\Local\Temp\._cache_adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe
"C:\Users\Admin\AppData\Local\Temp\._cache_adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe"
2⤵
- Executes dropped EXE
PID:3284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3284 -s 840
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2124

C:\ProgramData\Synaptics\Synaptics.exe
"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
2⤵
- Executes dropped EXE
- Modifies system certificate store
PID:500

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:632

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Install Root Certificate

1

T1130

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe
MD5
17d6f5e04057dc97d2b85ce7280b91f9

SHA1
80455f1cc09b53bb3de182b022ade40ced6e8496

SHA256
05c8d54f83ae4bb668fcf0cfc0ae79ebdd7b93acf85e5bb17a9ec5851369d1d7

SHA512
a1883f10007e97588a3ec4b107ba4967086d1895caaabdd23a538a6988967860401f7400ec8f80c507cfcca0aff467ecae695367150e91c5d10b0d226d222976

Download Submit
C:\ProgramData\Synaptics\Synaptics.exe
MD5
17d6f5e04057dc97d2b85ce7280b91f9

SHA1
80455f1cc09b53bb3de182b022ade40ced6e8496

SHA256
05c8d54f83ae4bb668fcf0cfc0ae79ebdd7b93acf85e5bb17a9ec5851369d1d7

SHA512
a1883f10007e97588a3ec4b107ba4967086d1895caaabdd23a538a6988967860401f7400ec8f80c507cfcca0aff467ecae695367150e91c5d10b0d226d222976

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe
MD5
2683402f267742314f82a5f9f75d4401

SHA1
6c4ee0f59eb2ebf9b9bea81769fe14b7219c2b16

SHA256
9175f7e7700e28fb568d1e0090ee39d87089003fb1ba02f8223f4f1643f7c16e

SHA512
61e9d520db82aa16ce5fc1fd095c278d0b07b259029d6d5c288b8ec8e4f9660c85d1edb26f7993bef0a112cfc2dc19e28eb6622b51a786098988e391475cd3df

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_adf7a959c5811b91c0a4caf2acb794129a1faed7318e16aba22fd49d039bcd28.exe
MD5
2683402f267742314f82a5f9f75d4401

SHA1
6c4ee0f59eb2ebf9b9bea81769fe14b7219c2b16

SHA256
9175f7e7700e28fb568d1e0090ee39d87089003fb1ba02f8223f4f1643f7c16e

SHA512
61e9d520db82aa16ce5fc1fd095c278d0b07b259029d6d5c288b8ec8e4f9660c85d1edb26f7993bef0a112cfc2dc19e28eb6622b51a786098988e391475cd3df

Download Submit
C:\Users\Admin\AppData\Local\Temp\Hz2tyurm.xlsm
MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
memory/500-122-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/500-118-0x0000000000000000-mapping.dmp

Download
memory/632-128-0x00007FFAC4B10000-0x00007FFAC4B20000-memory.dmp

Filesize
64KB

Download
memory/632-121-0x00007FF67D8A0000-0x00007FF680E56000-memory.dmp

Filesize
53.7MB

Download
memory/632-127-0x00007FFAC4B10000-0x00007FFAC4B20000-memory.dmp

Filesize
64KB

Download
memory/632-129-0x00007FFAC4B10000-0x00007FFAC4B20000-memory.dmp

Filesize
64KB

Download
memory/632-130-0x00007FFAC4B10000-0x00007FFAC4B20000-memory.dmp

Filesize
64KB

Download
memory/632-133-0x00007FFAC4B10000-0x00007FFAC4B20000-memory.dmp

Filesize
64KB

Download
memory/632-134-0x00007FFAE5C10000-0x00007FFAE6CFE000-memory.dmp

Filesize
16.9MB

Download
memory/632-135-0x00007FFAE3D10000-0x00007FFAE5C05000-memory.dmp

Filesize
31.0MB

Download
memory/640-114-0x00000000006B0000-0x00000000006B1000-memory.dmp

Filesize
4KB

Download
memory/3284-123-0x00000000009C0000-0x00000000009C1000-memory.dmp

Filesize
4KB

Download
memory/3284-126-0x0000000009DE0000-0x0000000009DE1000-memory.dmp

Filesize
4KB

Download
memory/3284-115-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads