c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7v20210410
submitted
11-05-2021 09:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
Size

2.7MB
MD5

d4bb3c12496bfe033a3163eda9fa9b1b
SHA1

1b93dd31ec5b7fb54e0b3264010d758854df45f3
SHA256

c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596
SHA512

0738d6525fb3f7cde7521b14b894cd270a1239a248e386db5b296683c6781ef2dff77e5ef3f3ff22195cda59295ae1e4756e0be25a093ddb414dbdc1c805e443

Score

8^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exeSynaptics.exe

pid process

1208 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
376 Synaptics.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1208-67-0x0000000000380000-0x00000000003A6000-memory.dmp	upx

Loads dropped DLL 4 IoCs

Processes:

c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe

pid	process
484	c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
484	c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
484	c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
484	c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SS CRACK RETRIX = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000051618adbbbd0f84eb34ff59fe7045e8f00000000020000000000106600000001000020000000669b77e95c27413f96b57153fe6b23ee658f266dcb13a21927800bb8e255f95f000000000e8000000002000020000000aa29eaf3fb7c5222346b917ecfb45380eaf81b3c2e5a7a26075a8aacc050ab0390000000be7a97d280ee76fadc89c3f64f773024545e4c48656cca14184d35adcb83ced11b9a387a19549eab703f7cf438b2d3f8139e5cddf48b1d67d4ef866cd8545f2b7f7ed25cd9213a1fdb86b63a6f6eed0eafde479a05b5351178ea1f7f11967e4ac1fe685767adee574c66df2c4581dd7eaa48bf0dce5d31161d0fbf5fa64ab82ddb19aa28b6062a3f2740cdc474971e7a400000001dcdfce8bd4059e787d18ae3125c43a63701e3b0c2eceab82a6dd42c16b893da13dd7299708bf3fc67e1fd587c00591f8da6526a54079870aa9497805c96a836	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30316f7b5846d701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9BA6D441-B24B-11EB-A60E-EEAC38710E3B} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000051618adbbbd0f84eb34ff59fe7045e8f000000000200000000001066000000010000200000009d155d707225955ce7402bf46f132f7e5810381573941994b23d54b79742497a000000000e8000000002000020000000b5ef46965b683a278e80c166222188240de249008be37083efd5da617b2a531f200000008d9f40ba1a2bbb9dbf830d769910a6ec2654bf361cda4978278bffbea50f96d0400000006576fb0a4041a4991974d62d88055ef8a9dd0fa0a1c0e73b8b2b801070bafe9911a7fa81d679941bcc9160ea2508557c0cb05d7bd51ef1bf2add5f75bf375c24	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "327497312"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe

pid	process
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1016 iexplore.exe

pid	process
1016	iexplore.exe

Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exeiexplore.exeIEXPLORE.EXE

pid	process
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
1016	iexplore.exe
1016	iexplore.exe
1460	IEXPLORE.EXE
1460	IEXPLORE.EXE
1460	IEXPLORE.EXE
1460	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exeiexplore.exe

description	pid	process	target process
PID 484 wrote to memory of 1208	484	c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
PID 484 wrote to memory of 1208	484	c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
PID 484 wrote to memory of 1208	484	c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
PID 484 wrote to memory of 1208	484	c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
PID 1208 wrote to memory of 1016	1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe	iexplore.exe
PID 1208 wrote to memory of 1016	1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe	iexplore.exe
PID 1208 wrote to memory of 1016	1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe	iexplore.exe
PID 1208 wrote to memory of 1016	1208	._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe	iexplore.exe
PID 484 wrote to memory of 376	484	c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe	Synaptics.exe
PID 484 wrote to memory of 376	484	c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe	Synaptics.exe
PID 484 wrote to memory of 376	484	c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe	Synaptics.exe
PID 484 wrote to memory of 376	484	c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe	Synaptics.exe
PID 1016 wrote to memory of 1460	1016	iexplore.exe	IEXPLORE.EXE
PID 1016 wrote to memory of 1460	1016	iexplore.exe	IEXPLORE.EXE
PID 1016 wrote to memory of 1460	1016	iexplore.exe	IEXPLORE.EXE
PID 1016 wrote to memory of 1460	1016	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
"C:\Users\Admin\AppData\Local\Temp\c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:484

C:\Users\Admin\AppData\Local\Temp\._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
"C:\Users\Admin\AppData\Local\Temp\._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1208

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://jq.qq.com/?_wv=1027&k=5xC3q9T
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1016

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1016 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1460

C:\ProgramData\Synaptics\Synaptics.exe
"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
2⤵
- Executes dropped EXE
PID:376

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe
MD5
f65d4cf706c2add18897c640b67c8b84

SHA1
dd63c38d5fd4a2d466a36dc35e8c082237de24f8

SHA256
f1a5a873cc3987b2a2a756aec8bacfb6d2c922892ce07a0ffb820a332fe82655

SHA512
b0e5c1a9d5dd2aff80485b2b237e6350fbd14d67323fd6a85fbc221e45a2bc0b48a2d46bb371d5498f9246943c8015bacce15d20c4c453bb772690534babf2e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
992f161b3984e575f3d87dc63f52310f

SHA1
a74383e224f623f1961d0b97d508c5b400180593

SHA256
43da321bd284c37c1b476abbcf308cad0e746ae2e8661659c252ba03e30ac502

SHA512
609f1963d128b18d03a99e21c68af6b96f3b779d474191fc3d4731fce88907683dd571320121487b17302803f1836f1628228395ab69e66182ea349b60773412

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
MD5
ecbe20289e95bd3573827b251b11a1e4

SHA1
1445a9eb2e0df149c3d7bae5798c320df295b276

SHA256
68b8ea8dea48c2f98fd466dbec3bf12b786709e27e9ed361eb4b038b3edb529c

SHA512
ffc6dbb9f107ac5552644f41d35a1c41f8f7650147b807360732fcd8031dfebfd0b0015749dbc3265cf3b22a81e9d13f24f4b5563953d2838842bae6fe3228ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
MD5
f1796244b47d29ed90750f55a4443eee

SHA1
a9769435121e0c8ae9281799a3217c38024f21f1

SHA256
43d52c745f116feb2507f3434b269a9b8ca93c7bdaabb6a31f6c1f9b12234bf8

SHA512
488e2d4bc577bd6c23ebe723f904220381c3990850eb9440677eba3b9f3f044157509d1216baacb0ca3bbc36f2f3dfa61c295ac0af995668f48af3733ba87f29

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\7FUT3U60.txt
MD5
0738f23326aeff2c0891b2c7780ce637

SHA1
d15a680e58cd03136347345a7057779c1d8e442e

SHA256
a35636393ab4c869fa44c01aaf049171ca71d981ac3e65fff7ba428ba27dc2a7

SHA512
5b2bc3cc7f7a971a687cbc041119e0eec6259232529a2c137b8843d60a204e4b8021d0b3a71f7788559de073a592eb22be6fd750a280a9b8bb5889f494208652

Download Submit
\ProgramData\Synaptics\Synaptics.exe
MD5
f65d4cf706c2add18897c640b67c8b84

SHA1
dd63c38d5fd4a2d466a36dc35e8c082237de24f8

SHA256
f1a5a873cc3987b2a2a756aec8bacfb6d2c922892ce07a0ffb820a332fe82655

SHA512
b0e5c1a9d5dd2aff80485b2b237e6350fbd14d67323fd6a85fbc221e45a2bc0b48a2d46bb371d5498f9246943c8015bacce15d20c4c453bb772690534babf2e6

Download Submit
\ProgramData\Synaptics\Synaptics.exe
MD5
f65d4cf706c2add18897c640b67c8b84

SHA1
dd63c38d5fd4a2d466a36dc35e8c082237de24f8

SHA256
f1a5a873cc3987b2a2a756aec8bacfb6d2c922892ce07a0ffb820a332fe82655

SHA512
b0e5c1a9d5dd2aff80485b2b237e6350fbd14d67323fd6a85fbc221e45a2bc0b48a2d46bb371d5498f9246943c8015bacce15d20c4c453bb772690534babf2e6

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
MD5
f1796244b47d29ed90750f55a4443eee

SHA1
a9769435121e0c8ae9281799a3217c38024f21f1

SHA256
43d52c745f116feb2507f3434b269a9b8ca93c7bdaabb6a31f6c1f9b12234bf8

SHA512
488e2d4bc577bd6c23ebe723f904220381c3990850eb9440677eba3b9f3f044157509d1216baacb0ca3bbc36f2f3dfa61c295ac0af995668f48af3733ba87f29

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
MD5
f1796244b47d29ed90750f55a4443eee

SHA1
a9769435121e0c8ae9281799a3217c38024f21f1

SHA256
43d52c745f116feb2507f3434b269a9b8ca93c7bdaabb6a31f6c1f9b12234bf8

SHA512
488e2d4bc577bd6c23ebe723f904220381c3990850eb9440677eba3b9f3f044157509d1216baacb0ca3bbc36f2f3dfa61c295ac0af995668f48af3733ba87f29

Download Submit
memory/376-71-0x0000000000000000-mapping.dmp

Download
memory/376-77-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/484-59-0x0000000075551000-0x0000000075553000-memory.dmp

Filesize
8KB

Download
memory/484-60-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/1016-68-0x0000000000000000-mapping.dmp

Download
memory/1016-72-0x000007FEFBC81000-0x000007FEFBC83000-memory.dmp

Filesize
8KB

Download
memory/1208-67-0x0000000000380000-0x00000000003A6000-memory.dmp

Filesize
152KB

Download
memory/1208-66-0x0000000000640000-0x000000000076E000-memory.dmp

Filesize
1.2MB

Download
memory/1208-63-0x0000000000000000-mapping.dmp

Download
memory/1460-75-0x0000000000000000-mapping.dmp

Download