Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
11-05-2021 11:22
Static task
static1
Behavioral task
behavioral1
Sample
a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe
Resource
win10v20210408
General
-
Target
a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe
-
Size
806KB
-
MD5
e0d4f53863efe1f8dcba04f558bb5326
-
SHA1
1a1d25bf141ae1feb0915aac8f9cff569b4e2bdc
-
SHA256
a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e
-
SHA512
27dc23e8d05eba49eba0a3bc1dc39809f53bbdef49259077b35dbe973cbe32c4b2e1ffdd4111975153f8f798c0514813f7bd4e80811820433111e53e10ac9907
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exeAu_.exeSynaptics.exepid process 3980 ._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe 508 Au_.exe 336 Synaptics.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\zMqTpxwB.xlsm office_macros -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe -
Loads dropped DLL 1 IoCs
Processes:
Au_.exepid process 508 Au_.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SS CRACK RETRIX = "C:\\ProgramData\\Synaptics\\Synaptics.exe" a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 8 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe nsis_installer_1 C:\Users\Admin\AppData\Local\Temp\._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe nsis_installer_2 C:\Users\Admin\AppData\Local\Temp\._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe nsis_installer_1 C:\Users\Admin\AppData\Local\Temp\._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe nsis_installer_2 C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe nsis_installer_1 C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe nsis_installer_2 C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe nsis_installer_1 C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe nsis_installer_2 -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE -
Modifies registry class 1 IoCs
Processes:
a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 3988 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
EXCEL.EXEpid process 3988 EXCEL.EXE 3988 EXCEL.EXE 3988 EXCEL.EXE 3988 EXCEL.EXE 3988 EXCEL.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exedescription pid process target process PID 804 wrote to memory of 3980 804 a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe ._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe PID 804 wrote to memory of 3980 804 a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe ._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe PID 804 wrote to memory of 3980 804 a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe ._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe PID 3980 wrote to memory of 508 3980 ._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe Au_.exe PID 3980 wrote to memory of 508 3980 ._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe Au_.exe PID 3980 wrote to memory of 508 3980 ._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe Au_.exe PID 804 wrote to memory of 336 804 a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe Synaptics.exe PID 804 wrote to memory of 336 804 a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe Synaptics.exe PID 804 wrote to memory of 336 804 a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe Synaptics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe"C:\Users\Admin\AppData\Local\Temp\a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe"C:\Users\Admin\AppData\Local\Temp\._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Synaptics\Synaptics.exeMD5
2783f7626d30818ef156885b11ec8b50
SHA12c593c07ab0fe2d1e53abd41ef14fa56a444df7f
SHA256df0a47aee55dea6a32dca96cab5673ecbec9e4c4ab87d2f01d2b2bdbc7795b0a
SHA512080801d49b85731845a132f66acbf4328380f028480ee0ee165fdec3e929132bdc794cc325128ee4ad03ab7c1c2eb9ed37133f3e1187803068a09fec5a1a9a9e
-
C:\ProgramData\Synaptics\Synaptics.exeMD5
2783f7626d30818ef156885b11ec8b50
SHA12c593c07ab0fe2d1e53abd41ef14fa56a444df7f
SHA256df0a47aee55dea6a32dca96cab5673ecbec9e4c4ab87d2f01d2b2bdbc7795b0a
SHA512080801d49b85731845a132f66acbf4328380f028480ee0ee165fdec3e929132bdc794cc325128ee4ad03ab7c1c2eb9ed37133f3e1187803068a09fec5a1a9a9e
-
C:\Users\Admin\AppData\Local\Temp\._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exeMD5
f897cf66755902a298444bc23e8d3757
SHA1bacc5f8bb2d170f6784653fa2d9c6a8321fd93ba
SHA2560f86541f30ef1ed7da5c50e1f5e72318f5ba396e609dcdfdc00c6fd3487f1bab
SHA512977bd7ad15e54a64d1bc6c3448aee118d0d9ec50a7e7007fd923c2cabbadf4fa1a191c239c8cb1c0c5828cc88446b1dd02f69addde99e9bd333e5649d7270e7e
-
C:\Users\Admin\AppData\Local\Temp\._cache_a361f369cc49015aa078503ba003350556e377946a50536f81d819eb0fcbf86e.exeMD5
f897cf66755902a298444bc23e8d3757
SHA1bacc5f8bb2d170f6784653fa2d9c6a8321fd93ba
SHA2560f86541f30ef1ed7da5c50e1f5e72318f5ba396e609dcdfdc00c6fd3487f1bab
SHA512977bd7ad15e54a64d1bc6c3448aee118d0d9ec50a7e7007fd923c2cabbadf4fa1a191c239c8cb1c0c5828cc88446b1dd02f69addde99e9bd333e5649d7270e7e
-
C:\Users\Admin\AppData\Local\Temp\zMqTpxwB.xlsmMD5
e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exeMD5
f897cf66755902a298444bc23e8d3757
SHA1bacc5f8bb2d170f6784653fa2d9c6a8321fd93ba
SHA2560f86541f30ef1ed7da5c50e1f5e72318f5ba396e609dcdfdc00c6fd3487f1bab
SHA512977bd7ad15e54a64d1bc6c3448aee118d0d9ec50a7e7007fd923c2cabbadf4fa1a191c239c8cb1c0c5828cc88446b1dd02f69addde99e9bd333e5649d7270e7e
-
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exeMD5
f897cf66755902a298444bc23e8d3757
SHA1bacc5f8bb2d170f6784653fa2d9c6a8321fd93ba
SHA2560f86541f30ef1ed7da5c50e1f5e72318f5ba396e609dcdfdc00c6fd3487f1bab
SHA512977bd7ad15e54a64d1bc6c3448aee118d0d9ec50a7e7007fd923c2cabbadf4fa1a191c239c8cb1c0c5828cc88446b1dd02f69addde99e9bd333e5649d7270e7e
-
\Users\Admin\AppData\Local\Temp\nsaAE09.tmp\System.dllMD5
c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
memory/336-125-0x00000000004D0000-0x000000000057E000-memory.dmpFilesize
696KB
-
memory/336-121-0x0000000000000000-mapping.dmp
-
memory/508-118-0x0000000000000000-mapping.dmp
-
memory/804-114-0x00000000023D0000-0x00000000023D1000-memory.dmpFilesize
4KB
-
memory/3980-115-0x0000000000000000-mapping.dmp
-
memory/3988-124-0x00007FF6E9240000-0x00007FF6EC7F6000-memory.dmpFilesize
53.7MB
-
memory/3988-127-0x00007FFD2ADC0000-0x00007FFD2ADD0000-memory.dmpFilesize
64KB
-
memory/3988-128-0x00007FFD2ADC0000-0x00007FFD2ADD0000-memory.dmpFilesize
64KB
-
memory/3988-129-0x00007FFD2ADC0000-0x00007FFD2ADD0000-memory.dmpFilesize
64KB
-
memory/3988-130-0x00007FFD2ADC0000-0x00007FFD2ADD0000-memory.dmpFilesize
64KB
-
memory/3988-133-0x00007FFD2ADC0000-0x00007FFD2ADD0000-memory.dmpFilesize
64KB
-
memory/3988-134-0x00007FFD4C3C0000-0x00007FFD4D4AE000-memory.dmpFilesize
16.9MB
-
memory/3988-135-0x00007FFD4A4C0000-0x00007FFD4C3B5000-memory.dmpFilesize
31.0MB