a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e

Analysis

max time kernel
148s
max time network
151s
platform
windows7_x64
resource
win7v20210410
submitted
11-05-2021 11:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe
Size

806KB
MD5

e0d4f53863efe1f8dcba04f558bb5326
SHA1

1a1d25bf141ae1feb0915aac8f9cff569b4e2bdc
SHA256

a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e
SHA512

27dc23e8d05eba49eba0a3bc1dc39809f53bbdef49259077b35dbe973cbe32c4b2e1ffdd4111975153f8f798c0514813f7bd4e80811820433111e53e10ac9907

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

Processes:

._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exeSynaptics.exeAu_.exe

pid process

1280 ._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe
1264 Synaptics.exe
1400 Au_.exe

pid	process
1280	._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe
1264	Synaptics.exe
1400	Au_.exe

Loads dropped DLL 11 IoCs

Processes:

a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exeAu_.exe

pid	process
1056	a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe
1280	._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe
1280	._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe
1280	._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe
1056	a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe
1056	a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe
1280	._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe
1400	Au_.exe
1400	Au_.exe
1400	Au_.exe
1400	Au_.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SS CRACK RETRIX = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 24 IoCs

installer

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe	nsis_installer_1
\Users\Admin\AppData\Local\Temp\._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe	nsis_installer_2
\Users\Admin\AppData\Local\Temp\._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe	nsis_installer_1
\Users\Admin\AppData\Local\Temp\._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe	nsis_installer_2
\Users\Admin\AppData\Local\Temp\._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe	nsis_installer_1
\Users\Admin\AppData\Local\Temp\._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe	nsis_installer_2
\Users\Admin\AppData\Local\Temp\._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe	nsis_installer_1
\Users\Admin\AppData\Local\Temp\._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe	nsis_installer_2
\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe	nsis_installer_1
\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe	nsis_installer_2
\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe	nsis_installer_1
\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe	nsis_installer_2
\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe	nsis_installer_1
\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe	nsis_installer_2
\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe	nsis_installer_1
\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe	nsis_installer_2

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe

description	pid	process	target process
PID 1056 wrote to memory of 1280	1056	a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe	._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe
PID 1056 wrote to memory of 1280	1056	a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe	._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe
PID 1056 wrote to memory of 1280	1056	a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe	._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe
PID 1056 wrote to memory of 1280	1056	a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe	._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe
PID 1056 wrote to memory of 1280	1056	a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe	._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe
PID 1056 wrote to memory of 1280	1056	a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe	._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe
PID 1056 wrote to memory of 1280	1056	a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe	._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe
PID 1056 wrote to memory of 1264	1056	a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe	Synaptics.exe
PID 1056 wrote to memory of 1264	1056	a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe	Synaptics.exe
PID 1056 wrote to memory of 1264	1056	a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe	Synaptics.exe
PID 1056 wrote to memory of 1264	1056	a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe	Synaptics.exe
PID 1280 wrote to memory of 1400	1280	._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe	Au_.exe
PID 1280 wrote to memory of 1400	1280	._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe	Au_.exe
PID 1280 wrote to memory of 1400	1280	._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe	Au_.exe
PID 1280 wrote to memory of 1400	1280	._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe	Au_.exe
PID 1280 wrote to memory of 1400	1280	._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe	Au_.exe
PID 1280 wrote to memory of 1400	1280	._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe	Au_.exe
PID 1280 wrote to memory of 1400	1280	._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe	Au_.exe

C:\Users\Admin\AppData\Local\Temp\a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe
"C:\Users\Admin\AppData\Local\Temp\a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1056

C:\Users\Admin\AppData\Local\Temp\._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe
"C:\Users\Admin\AppData\Local\Temp\._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1280

C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1400

C:\ProgramData\Synaptics\Synaptics.exe
"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
2⤵
- Executes dropped EXE
PID:1264

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe
MD5
2783f7626d30818ef156885b11ec8b50

SHA1
2c593c07ab0fe2d1e53abd41ef14fa56a444df7f

SHA256
df0a47aee55dea6a32dca96cab5673ecbec9e4c4ab87d2f01d2b2bdbc7795b0a

SHA512
080801d49b85731845a132f66acbf4328380f028480ee0ee165fdec3e929132bdc794cc325128ee4ad03ab7c1c2eb9ed37133f3e1187803068a09fec5a1a9a9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe
MD5
f897cf66755902a298444bc23e8d3757

SHA1
bacc5f8bb2d170f6784653fa2d9c6a8321fd93ba

SHA256
0f86541f30ef1ed7da5c50e1f5e72318f5ba396e609dcdfdc00c6fd3487f1bab

SHA512
977bd7ad15e54a64d1bc6c3448aee118d0d9ec50a7e7007fd923c2cabbadf4fa1a191c239c8cb1c0c5828cc88446b1dd02f69addde99e9bd333e5649d7270e7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe
MD5
f897cf66755902a298444bc23e8d3757

SHA1
bacc5f8bb2d170f6784653fa2d9c6a8321fd93ba

SHA256
0f86541f30ef1ed7da5c50e1f5e72318f5ba396e609dcdfdc00c6fd3487f1bab

SHA512
977bd7ad15e54a64d1bc6c3448aee118d0d9ec50a7e7007fd923c2cabbadf4fa1a191c239c8cb1c0c5828cc88446b1dd02f69addde99e9bd333e5649d7270e7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
MD5
f897cf66755902a298444bc23e8d3757

SHA1
bacc5f8bb2d170f6784653fa2d9c6a8321fd93ba

SHA256
0f86541f30ef1ed7da5c50e1f5e72318f5ba396e609dcdfdc00c6fd3487f1bab

SHA512
977bd7ad15e54a64d1bc6c3448aee118d0d9ec50a7e7007fd923c2cabbadf4fa1a191c239c8cb1c0c5828cc88446b1dd02f69addde99e9bd333e5649d7270e7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
MD5
f897cf66755902a298444bc23e8d3757

SHA1
bacc5f8bb2d170f6784653fa2d9c6a8321fd93ba

SHA256
0f86541f30ef1ed7da5c50e1f5e72318f5ba396e609dcdfdc00c6fd3487f1bab

SHA512
977bd7ad15e54a64d1bc6c3448aee118d0d9ec50a7e7007fd923c2cabbadf4fa1a191c239c8cb1c0c5828cc88446b1dd02f69addde99e9bd333e5649d7270e7e

Download Submit
\ProgramData\Synaptics\Synaptics.exe
MD5
2783f7626d30818ef156885b11ec8b50

SHA1
2c593c07ab0fe2d1e53abd41ef14fa56a444df7f

SHA256
df0a47aee55dea6a32dca96cab5673ecbec9e4c4ab87d2f01d2b2bdbc7795b0a

SHA512
080801d49b85731845a132f66acbf4328380f028480ee0ee165fdec3e929132bdc794cc325128ee4ad03ab7c1c2eb9ed37133f3e1187803068a09fec5a1a9a9e

Download Submit
\ProgramData\Synaptics\Synaptics.exe
MD5
2783f7626d30818ef156885b11ec8b50

SHA1
2c593c07ab0fe2d1e53abd41ef14fa56a444df7f

SHA256
df0a47aee55dea6a32dca96cab5673ecbec9e4c4ab87d2f01d2b2bdbc7795b0a

SHA512
080801d49b85731845a132f66acbf4328380f028480ee0ee165fdec3e929132bdc794cc325128ee4ad03ab7c1c2eb9ed37133f3e1187803068a09fec5a1a9a9e

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe
MD5
f897cf66755902a298444bc23e8d3757

SHA1
bacc5f8bb2d170f6784653fa2d9c6a8321fd93ba

SHA256
0f86541f30ef1ed7da5c50e1f5e72318f5ba396e609dcdfdc00c6fd3487f1bab

SHA512
977bd7ad15e54a64d1bc6c3448aee118d0d9ec50a7e7007fd923c2cabbadf4fa1a191c239c8cb1c0c5828cc88446b1dd02f69addde99e9bd333e5649d7270e7e

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe
MD5
f897cf66755902a298444bc23e8d3757

SHA1
bacc5f8bb2d170f6784653fa2d9c6a8321fd93ba

SHA256
0f86541f30ef1ed7da5c50e1f5e72318f5ba396e609dcdfdc00c6fd3487f1bab

SHA512
977bd7ad15e54a64d1bc6c3448aee118d0d9ec50a7e7007fd923c2cabbadf4fa1a191c239c8cb1c0c5828cc88446b1dd02f69addde99e9bd333e5649d7270e7e

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe
MD5
f897cf66755902a298444bc23e8d3757

SHA1
bacc5f8bb2d170f6784653fa2d9c6a8321fd93ba

SHA256
0f86541f30ef1ed7da5c50e1f5e72318f5ba396e609dcdfdc00c6fd3487f1bab

SHA512
977bd7ad15e54a64d1bc6c3448aee118d0d9ec50a7e7007fd923c2cabbadf4fa1a191c239c8cb1c0c5828cc88446b1dd02f69addde99e9bd333e5649d7270e7e

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe
MD5
f897cf66755902a298444bc23e8d3757

SHA1
bacc5f8bb2d170f6784653fa2d9c6a8321fd93ba

SHA256
0f86541f30ef1ed7da5c50e1f5e72318f5ba396e609dcdfdc00c6fd3487f1bab

SHA512
977bd7ad15e54a64d1bc6c3448aee118d0d9ec50a7e7007fd923c2cabbadf4fa1a191c239c8cb1c0c5828cc88446b1dd02f69addde99e9bd333e5649d7270e7e

Download Submit
\Users\Admin\AppData\Local\Temp\nsn4220.tmp\System.dll
MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
MD5
f897cf66755902a298444bc23e8d3757

SHA1
bacc5f8bb2d170f6784653fa2d9c6a8321fd93ba

SHA256
0f86541f30ef1ed7da5c50e1f5e72318f5ba396e609dcdfdc00c6fd3487f1bab

SHA512
977bd7ad15e54a64d1bc6c3448aee118d0d9ec50a7e7007fd923c2cabbadf4fa1a191c239c8cb1c0c5828cc88446b1dd02f69addde99e9bd333e5649d7270e7e

Download Submit
\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
MD5
f897cf66755902a298444bc23e8d3757

SHA1
bacc5f8bb2d170f6784653fa2d9c6a8321fd93ba

SHA256
0f86541f30ef1ed7da5c50e1f5e72318f5ba396e609dcdfdc00c6fd3487f1bab

SHA512
977bd7ad15e54a64d1bc6c3448aee118d0d9ec50a7e7007fd923c2cabbadf4fa1a191c239c8cb1c0c5828cc88446b1dd02f69addde99e9bd333e5649d7270e7e

Download Submit
\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
MD5
f897cf66755902a298444bc23e8d3757

SHA1
bacc5f8bb2d170f6784653fa2d9c6a8321fd93ba

SHA256
0f86541f30ef1ed7da5c50e1f5e72318f5ba396e609dcdfdc00c6fd3487f1bab

SHA512
977bd7ad15e54a64d1bc6c3448aee118d0d9ec50a7e7007fd923c2cabbadf4fa1a191c239c8cb1c0c5828cc88446b1dd02f69addde99e9bd333e5649d7270e7e

Download Submit
\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
MD5
f897cf66755902a298444bc23e8d3757

SHA1
bacc5f8bb2d170f6784653fa2d9c6a8321fd93ba

SHA256
0f86541f30ef1ed7da5c50e1f5e72318f5ba396e609dcdfdc00c6fd3487f1bab

SHA512
977bd7ad15e54a64d1bc6c3448aee118d0d9ec50a7e7007fd923c2cabbadf4fa1a191c239c8cb1c0c5828cc88446b1dd02f69addde99e9bd333e5649d7270e7e

Download Submit
memory/1056-60-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/1056-61-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1264-72-0x0000000000000000-mapping.dmp

Download
memory/1264-83-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1280-63-0x0000000000000000-mapping.dmp

Download
memory/1400-74-0x0000000000000000-mapping.dmp

Download