a92725d2b5309af4d6691f5317171930abf96de0a62fab74a61d3351a3fa46a5

Analysis

max time kernel
151s
max time network
148s
platform
windows7_x64
resource
win7v20210408
submitted
11-05-2021 10:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a92725d2b5309af4d6691f5317171930abf96de0a62fab74a61d3351a3fa46a5.exe
Size

1.1MB
MD5

b6215e79025364c262eca72ed1567ec1
SHA1

de4ee49ce7dc4d8a2d210193559c4e6a1ce95f49
SHA256

a92725d2b5309af4d6691f5317171930abf96de0a62fab74a61d3351a3fa46a5
SHA512

6ecb20b6713b40f6a491b585c3fa6b3c76307038a35f47830b6994b4643bf03179d778bb6ac85af1f7ebc2499b51af110c50263763a741e8e1536a6aa73e8053

Score

8^/10

macro persistence

Malware Config

Signatures

Executes dropped EXE 5 IoCs

Processes:

._cache_a92725d2b5309af4d6691f5317171930abf96de0a62fab74a61d3351a3fa46a5.exesvchost.exe._cache_a92725d2b5309af4d6691f5317171930abf96de0a62fab74a61d3351a3fa46a5.exesvchost.exeSynaptics.exe

pid	process
1524	._cache_a92725d2b5309af4d6691f5317171930abf96de0a62fab74a61d3351a3fa46a5.exe
1968	svchost.exe
1864	._cache_a92725d2b5309af4d6691f5317171930abf96de0a62fab74a61d3351a3fa46a5.exe
1704	svchost.exe
1848	Synaptics.exe

Suspicious Office macro 1 IoCs

Office document equipped with macros.

macro

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\8YHqyLFh.xlsm	office_macros

Loads dropped DLL 4 IoCs

Processes:

a92725d2b5309af4d6691f5317171930abf96de0a62fab74a61d3351a3fa46a5.exesvchost.exe

pid	process
1996	a92725d2b5309af4d6691f5317171930abf96de0a62fab74a61d3351a3fa46a5.exe
1968	svchost.exe
1996	a92725d2b5309af4d6691f5317171930abf96de0a62fab74a61d3351a3fa46a5.exe
1996	a92725d2b5309af4d6691f5317171930abf96de0a62fab74a61d3351a3fa46a5.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

a92725d2b5309af4d6691f5317171930abf96de0a62fab74a61d3351a3fa46a5.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	a92725d2b5309af4d6691f5317171930abf96de0a62fab74a61d3351a3fa46a5.exe

Drops file in Windows directory 1 IoCs

Processes:

._cache_a92725d2b5309af4d6691f5317171930abf96de0a62fab74a61d3351a3fa46a5.exe

description ioc process

File created C:\Windows\svchost.exe ._cache_a92725d2b5309af4d6691f5317171930abf96de0a62fab74a61d3351a3fa46a5.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE

description	ioc	process
File created	C:\Windows\svchost.exe	._cache_a92725d2b5309af4d6691f5317171930abf96de0a62fab74a61d3351a3fa46a5.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

EXCEL.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1712 EXCEL.EXE
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

EXCEL.EXE

pid process

1712 EXCEL.EXE

pid	process
1712	EXCEL.EXE

pid	process
1712	EXCEL.EXE

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

a92725d2b5309af4d6691f5317171930abf96de0a62fab74a61d3351a3fa46a5.exe._cache_a92725d2b5309af4d6691f5317171930abf96de0a62fab74a61d3351a3fa46a5.exesvchost.exe

description	pid	process	target process
PID 1996 wrote to memory of 1524	1996	a92725d2b5309af4d6691f5317171930abf96de0a62fab74a61d3351a3fa46a5.exe	._cache_a92725d2b5309af4d6691f5317171930abf96de0a62fab74a61d3351a3fa46a5.exe
PID 1996 wrote to memory of 1524	1996	a92725d2b5309af4d6691f5317171930abf96de0a62fab74a61d3351a3fa46a5.exe	._cache_a92725d2b5309af4d6691f5317171930abf96de0a62fab74a61d3351a3fa46a5.exe
PID 1996 wrote to memory of 1524	1996	a92725d2b5309af4d6691f5317171930abf96de0a62fab74a61d3351a3fa46a5.exe	._cache_a92725d2b5309af4d6691f5317171930abf96de0a62fab74a61d3351a3fa46a5.exe
PID 1996 wrote to memory of 1524	1996	a92725d2b5309af4d6691f5317171930abf96de0a62fab74a61d3351a3fa46a5.exe	._cache_a92725d2b5309af4d6691f5317171930abf96de0a62fab74a61d3351a3fa46a5.exe
PID 1524 wrote to memory of 1968	1524	._cache_a92725d2b5309af4d6691f5317171930abf96de0a62fab74a61d3351a3fa46a5.exe	svchost.exe
PID 1524 wrote to memory of 1968	1524	._cache_a92725d2b5309af4d6691f5317171930abf96de0a62fab74a61d3351a3fa46a5.exe	svchost.exe
PID 1524 wrote to memory of 1968	1524	._cache_a92725d2b5309af4d6691f5317171930abf96de0a62fab74a61d3351a3fa46a5.exe	svchost.exe
PID 1524 wrote to memory of 1968	1524	._cache_a92725d2b5309af4d6691f5317171930abf96de0a62fab74a61d3351a3fa46a5.exe	svchost.exe
PID 1968 wrote to memory of 1864	1968	svchost.exe	._cache_a92725d2b5309af4d6691f5317171930abf96de0a62fab74a61d3351a3fa46a5.exe
PID 1968 wrote to memory of 1864	1968	svchost.exe	._cache_a92725d2b5309af4d6691f5317171930abf96de0a62fab74a61d3351a3fa46a5.exe
PID 1968 wrote to memory of 1864	1968	svchost.exe	._cache_a92725d2b5309af4d6691f5317171930abf96de0a62fab74a61d3351a3fa46a5.exe
PID 1968 wrote to memory of 1864	1968	svchost.exe	._cache_a92725d2b5309af4d6691f5317171930abf96de0a62fab74a61d3351a3fa46a5.exe
PID 1996 wrote to memory of 1848	1996	a92725d2b5309af4d6691f5317171930abf96de0a62fab74a61d3351a3fa46a5.exe	Synaptics.exe
PID 1996 wrote to memory of 1848	1996	a92725d2b5309af4d6691f5317171930abf96de0a62fab74a61d3351a3fa46a5.exe	Synaptics.exe
PID 1996 wrote to memory of 1848	1996	a92725d2b5309af4d6691f5317171930abf96de0a62fab74a61d3351a3fa46a5.exe	Synaptics.exe
PID 1996 wrote to memory of 1848	1996	a92725d2b5309af4d6691f5317171930abf96de0a62fab74a61d3351a3fa46a5.exe	Synaptics.exe

C:\Users\Admin\AppData\Local\Temp\a92725d2b5309af4d6691f5317171930abf96de0a62fab74a61d3351a3fa46a5.exe
"C:\Users\Admin\AppData\Local\Temp\a92725d2b5309af4d6691f5317171930abf96de0a62fab74a61d3351a3fa46a5.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1996

C:\Users\Admin\AppData\Local\Temp\._cache_a92725d2b5309af4d6691f5317171930abf96de0a62fab74a61d3351a3fa46a5.exe
"C:\Users\Admin\AppData\Local\Temp\._cache_a92725d2b5309af4d6691f5317171930abf96de0a62fab74a61d3351a3fa46a5.exe"
2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1524

C:\Windows\svchost.exe
"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\._cache_a92725d2b5309af4d6691f5317171930abf96de0a62fab74a61d3351a3fa46a5.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1968

C:\Users\Admin\AppData\Local\Temp\._cache_a92725d2b5309af4d6691f5317171930abf96de0a62fab74a61d3351a3fa46a5.exe
"C:\Users\Admin\AppData\Local\Temp\._cache_a92725d2b5309af4d6691f5317171930abf96de0a62fab74a61d3351a3fa46a5.exe"
4⤵
- Executes dropped EXE
PID:1864

C:\ProgramData\Synaptics\Synaptics.exe
"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
2⤵
- Executes dropped EXE
PID:1848

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
PID:1704

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1712

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe
MD5
0a29cf78243106fbec0dc90111e13812

SHA1
1c83a013b65ebfb8051cd5c61b700fcb75bd6e5e

SHA256
817778d149ebc48fde392291d9c088ac57b7ee29bf5d94687f2696378132b582

SHA512
612b8b099976bd8900585e6b39eaa9913565b48a3666b3dc4d329bf56f30200b664927f20fad1683ca760e33dd8361b3d11b2ef3a507344982d8d9d41bd2e4b0

Download Submit
C:\ProgramData\Synaptics\Synaptics.exe
MD5
0a29cf78243106fbec0dc90111e13812

SHA1
1c83a013b65ebfb8051cd5c61b700fcb75bd6e5e

SHA256
817778d149ebc48fde392291d9c088ac57b7ee29bf5d94687f2696378132b582

SHA512
612b8b099976bd8900585e6b39eaa9913565b48a3666b3dc4d329bf56f30200b664927f20fad1683ca760e33dd8361b3d11b2ef3a507344982d8d9d41bd2e4b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_a92725d2b5309af4d6691f5317171930abf96de0a62fab74a61d3351a3fa46a5.exe
MD5
a48b83085ce6e5a5169ae72cc938d779

SHA1
9011bf8ea58e8bc2d60238145dc1ece718878148

SHA256
3ab30138a0be46183ab91711546320db6f1ad8b417a9bf44f406d003325dca8f

SHA512
c4b6454b64ef39d97ec87362366c1eb9701bd2546ab034beeae30343dcd442ecef0f6dabc00bdd4448c7afd8e4a3f01734b49a72d999c4046fb28c98950c959a

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_a92725d2b5309af4d6691f5317171930abf96de0a62fab74a61d3351a3fa46a5.exe
MD5
a48b83085ce6e5a5169ae72cc938d779

SHA1
9011bf8ea58e8bc2d60238145dc1ece718878148

SHA256
3ab30138a0be46183ab91711546320db6f1ad8b417a9bf44f406d003325dca8f

SHA512
c4b6454b64ef39d97ec87362366c1eb9701bd2546ab034beeae30343dcd442ecef0f6dabc00bdd4448c7afd8e4a3f01734b49a72d999c4046fb28c98950c959a

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_a92725d2b5309af4d6691f5317171930abf96de0a62fab74a61d3351a3fa46a5.exe
MD5
f2cf9150977a8e72cb2849a77e29c14d

SHA1
1a51219355e6bc40ac857e4933d6f0a41d08b544

SHA256
73ca903f4a0e1b8e4ea6d82e12f0ee745e75c39d29840383603a8289eda82fd1

SHA512
9d538f4ffa317eb7748d55dac5c1631f1b952b7e475e610a11856cf871fff47f0de67683c2e6ee648383e2cca3a0b76f1eaa13133e6170724052cc58dd3f3116

Download Submit
C:\Users\Admin\AppData\Local\Temp\8YHqyLFh.xlsm
MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Windows\svchost.exe
MD5
9e3c13b6556d5636b745d3e466d47467

SHA1
2ac1c19e268c49bc508f83fe3d20f495deb3e538

SHA256
20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8

SHA512
5a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b

Download Submit
C:\Windows\svchost.exe
MD5
9e3c13b6556d5636b745d3e466d47467

SHA1
2ac1c19e268c49bc508f83fe3d20f495deb3e538

SHA256
20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8

SHA512
5a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b

Download Submit
C:\Windows\svchost.exe
MD5
9e3c13b6556d5636b745d3e466d47467

SHA1
2ac1c19e268c49bc508f83fe3d20f495deb3e538

SHA256
20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8

SHA512
5a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b

Download Submit
\ProgramData\Synaptics\Synaptics.exe
MD5
0a29cf78243106fbec0dc90111e13812

SHA1
1c83a013b65ebfb8051cd5c61b700fcb75bd6e5e

SHA256
817778d149ebc48fde392291d9c088ac57b7ee29bf5d94687f2696378132b582

SHA512
612b8b099976bd8900585e6b39eaa9913565b48a3666b3dc4d329bf56f30200b664927f20fad1683ca760e33dd8361b3d11b2ef3a507344982d8d9d41bd2e4b0

Download Submit
\ProgramData\Synaptics\Synaptics.exe
MD5
0a29cf78243106fbec0dc90111e13812

SHA1
1c83a013b65ebfb8051cd5c61b700fcb75bd6e5e

SHA256
817778d149ebc48fde392291d9c088ac57b7ee29bf5d94687f2696378132b582

SHA512
612b8b099976bd8900585e6b39eaa9913565b48a3666b3dc4d329bf56f30200b664927f20fad1683ca760e33dd8361b3d11b2ef3a507344982d8d9d41bd2e4b0

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_a92725d2b5309af4d6691f5317171930abf96de0a62fab74a61d3351a3fa46a5.exe
MD5
a48b83085ce6e5a5169ae72cc938d779

SHA1
9011bf8ea58e8bc2d60238145dc1ece718878148

SHA256
3ab30138a0be46183ab91711546320db6f1ad8b417a9bf44f406d003325dca8f

SHA512
c4b6454b64ef39d97ec87362366c1eb9701bd2546ab034beeae30343dcd442ecef0f6dabc00bdd4448c7afd8e4a3f01734b49a72d999c4046fb28c98950c959a

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_a92725d2b5309af4d6691f5317171930abf96de0a62fab74a61d3351a3fa46a5.exe
MD5
f2cf9150977a8e72cb2849a77e29c14d

SHA1
1a51219355e6bc40ac857e4933d6f0a41d08b544

SHA256
73ca903f4a0e1b8e4ea6d82e12f0ee745e75c39d29840383603a8289eda82fd1

SHA512
9d538f4ffa317eb7748d55dac5c1631f1b952b7e475e610a11856cf871fff47f0de67683c2e6ee648383e2cca3a0b76f1eaa13133e6170724052cc58dd3f3116

Download Submit
memory/1524-63-0x0000000000000000-mapping.dmp

Download
memory/1712-82-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1712-81-0x0000000071851000-0x0000000071853000-memory.dmp

Filesize
8KB

Download
memory/1712-80-0x000000002F301000-0x000000002F304000-memory.dmp

Filesize
12KB

Download
memory/1848-79-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1848-76-0x0000000000000000-mapping.dmp

Download
memory/1864-70-0x0000000000000000-mapping.dmp

Download
memory/1968-66-0x0000000000000000-mapping.dmp

Download
memory/1996-60-0x00000000767B1000-0x00000000767B3000-memory.dmp

Filesize
8KB

Download
memory/1996-61-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download