Analysis
-
max time kernel
151s -
max time network
150s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
11-05-2021 12:19
Static task
static1
Behavioral task
behavioral1
Sample
ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exe
Resource
win10v20210410
General
-
Target
ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exe
-
Size
2.6MB
-
MD5
87d3d3a927c330c16c4b628a501409df
-
SHA1
39e79273a41f84d068bb56052e575341ee166cae
-
SHA256
ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9
-
SHA512
0f260e8304bd784acfc628f95d667fda4a335e96e169d5974ed2b136dc804d45b86321dbf1ee6f7059258a044618576dc91a2a1d9d76441e814b462d486d40ea
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
._cache_ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exeSynaptics.exepid process 2016 ._cache_ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exe 1988 Synaptics.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\vEqQjbWG.xlsm office_macros -
Loads dropped DLL 11 IoCs
Processes:
ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exeWerFault.exepid process 784 ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exe 784 ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exe 784 ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exe 784 ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exe 944 WerFault.exe 944 WerFault.exe 944 WerFault.exe 944 WerFault.exe 944 WerFault.exe 944 WerFault.exe 944 WerFault.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SS CRACK RETRIX = "C:\\ProgramData\\Synaptics\\Synaptics.exe" ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 944 2016 WerFault.exe ._cache_ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Processes:
iexplore.exeEXCEL.EXEIEXPLORE.EXEdescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000529101d5c9814b4eb0f580b37542e45000000000020000000000106600000001000020000000642cbf4989ecafd8b4dc4fc7a30833846b975134f02c11ef3240405016cb8e1e000000000e8000000002000020000000c1785eae635ec650ce8f3f57252f02864a94feb3d0673d2c6d8e9d8916a7071f20000000a5430382eda49bc0f67b42fa9606c26dc47ed04f3bffa329d7f33bce424bb7c540000000735f590a53b98890d9bd9743b737d4330a3053e8719184a5330afdda8dda368dbd02a25b9e76d5ca32a1d1a9744814301b1562499077372cdc905c306373a358 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000529101d5c9814b4eb0f580b37542e45000000000020000000000106600000001000020000000b4b3c745e29077be0a5b52f9fcacfef8b93f88b22f4784e1d258145f60bf6f96000000000e800000000200002000000097b6380b45fa9b13b6e78426a2c4ecb81a5d8008e5689ce870ca6ee699fd06de900000002d771cd7f9f57b65fdde83f6620401defbef8034621e064f874584b76ee1ecfb2466ff582807267bc8d9fcfeb9ea8315c105f5822ffec3fd7f187a7ba83283758d7a04de0eefacc5e6a2206745193f7d5349ff0b9a501b0ba3de392169788f79044001b1cc95e5d2539e5c04e0663407a914475915a0695ee18d06ba6e0a84fe629e6a868604f1b6f0891f63d51763ac40000000a812d5f671316129eccddc62b1643bcb303cfbfea3fa411b05f680185fdcd9057a196a3063d41e934640a7f9dfc0565a7df4dd3304636dd91e0ecd4aff5b09f8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "327526782" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10fbea159d46d701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{36F41C31-B290-11EB-8C4D-4A399A711051} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe -
Processes:
Synaptics.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 Synaptics.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a Synaptics.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a Synaptics.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1076 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
WerFault.exepid process 944 WerFault.exe 944 WerFault.exe 944 WerFault.exe 944 WerFault.exe 944 WerFault.exe 944 WerFault.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
WerFault.exepid process 944 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WerFault.exedescription pid process Token: SeDebugPrivilege 944 WerFault.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1748 iexplore.exe -
Suspicious use of SetWindowsHookEx 11 IoCs
Processes:
._cache_ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exeiexplore.exeIEXPLORE.EXEEXCEL.EXEpid process 2016 ._cache_ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exe 2016 ._cache_ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exe 1748 iexplore.exe 1748 iexplore.exe 1448 IEXPLORE.EXE 1448 IEXPLORE.EXE 1076 EXCEL.EXE 2016 ._cache_ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exe 2016 ._cache_ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exe 1448 IEXPLORE.EXE 1448 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exe._cache_ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exeiexplore.exedescription pid process target process PID 784 wrote to memory of 2016 784 ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exe ._cache_ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exe PID 784 wrote to memory of 2016 784 ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exe ._cache_ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exe PID 784 wrote to memory of 2016 784 ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exe ._cache_ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exe PID 784 wrote to memory of 2016 784 ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exe ._cache_ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exe PID 784 wrote to memory of 1988 784 ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exe Synaptics.exe PID 784 wrote to memory of 1988 784 ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exe Synaptics.exe PID 784 wrote to memory of 1988 784 ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exe Synaptics.exe PID 784 wrote to memory of 1988 784 ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exe Synaptics.exe PID 2016 wrote to memory of 1748 2016 ._cache_ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exe iexplore.exe PID 2016 wrote to memory of 1748 2016 ._cache_ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exe iexplore.exe PID 2016 wrote to memory of 1748 2016 ._cache_ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exe iexplore.exe PID 2016 wrote to memory of 1748 2016 ._cache_ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exe iexplore.exe PID 1748 wrote to memory of 1448 1748 iexplore.exe IEXPLORE.EXE PID 1748 wrote to memory of 1448 1748 iexplore.exe IEXPLORE.EXE PID 1748 wrote to memory of 1448 1748 iexplore.exe IEXPLORE.EXE PID 1748 wrote to memory of 1448 1748 iexplore.exe IEXPLORE.EXE PID 2016 wrote to memory of 944 2016 ._cache_ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exe WerFault.exe PID 2016 wrote to memory of 944 2016 ._cache_ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exe WerFault.exe PID 2016 wrote to memory of 944 2016 ._cache_ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exe WerFault.exe PID 2016 wrote to memory of 944 2016 ._cache_ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exe"C:\Users\Admin\AppData\Local\Temp\ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exe"C:\Users\Admin\AppData\Local\Temp\._cache_ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://jq.qq.com/?_wv=1027&k=57Cts1S3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1748 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 3283⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- Modifies system certificate store
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Synaptics\Synaptics.exeMD5
f65d4cf706c2add18897c640b67c8b84
SHA1dd63c38d5fd4a2d466a36dc35e8c082237de24f8
SHA256f1a5a873cc3987b2a2a756aec8bacfb6d2c922892ce07a0ffb820a332fe82655
SHA512b0e5c1a9d5dd2aff80485b2b237e6350fbd14d67323fd6a85fbc221e45a2bc0b48a2d46bb371d5498f9246943c8015bacce15d20c4c453bb772690534babf2e6
-
C:\ProgramData\Synaptics\Synaptics.exeMD5
f65d4cf706c2add18897c640b67c8b84
SHA1dd63c38d5fd4a2d466a36dc35e8c082237de24f8
SHA256f1a5a873cc3987b2a2a756aec8bacfb6d2c922892ce07a0ffb820a332fe82655
SHA512b0e5c1a9d5dd2aff80485b2b237e6350fbd14d67323fd6a85fbc221e45a2bc0b48a2d46bb371d5498f9246943c8015bacce15d20c4c453bb772690534babf2e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357MD5
a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015MD5
25fe10f2ee389b1d2600345229c12ced
SHA111d5cfe84723f9c254c0943b491e43dfe4c6d19f
SHA256bf38cbc15830e7b767668a35d7b3b6c9f55589f2993606b3476933b2ee0b929f
SHA512e1c62d5348d8eca3205c4449b9ab84c5e41c50645a329ebe7d01d0ae2013d366bf9a153bdc2612801f10a58a3af62bd415247c3fb6c5b20dc7451b79de8d1953
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357MD5
6eb890333eeea82797b34eb8ac379ccc
SHA1e5b4114613e6ed73af3ad602c358df5d2624b25d
SHA2566cb72b54e41e4053a26a9ad7812b0018406f9069323f4253d10ff7e2b4b58784
SHA512a3d89cf8356e2c398895bbebf4659897f2b11b92a45fa3c30bcb0e8e699c3277b8126f0f3124021eb8f6a54e57e0d3171fb1c696fe09243dee802c8f33908564
-
C:\Users\Admin\AppData\Local\Temp\._cache_ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exeMD5
e89d858f8b9cf41e090c446513a79138
SHA1ee899c233da667985eb6dcc3023d7d80e7384687
SHA256b908c4c07042d2b4045ce0c67a32a7025a7b851567dfcf84e4b53adfb66cf282
SHA512dc0efd00b9f113068ecf1fe07e62dfff052c24430681e6b4f63e56456e191f4b882e4d6a843ce14aa0b7405d5cb830c8fb27dd52613e3610cb417472fbc3aed5
-
C:\Users\Admin\AppData\Local\Temp\._cache_ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exeMD5
e89d858f8b9cf41e090c446513a79138
SHA1ee899c233da667985eb6dcc3023d7d80e7384687
SHA256b908c4c07042d2b4045ce0c67a32a7025a7b851567dfcf84e4b53adfb66cf282
SHA512dc0efd00b9f113068ecf1fe07e62dfff052c24430681e6b4f63e56456e191f4b882e4d6a843ce14aa0b7405d5cb830c8fb27dd52613e3610cb417472fbc3aed5
-
C:\Users\Admin\AppData\Local\Temp\vEqQjbWG.xlsmMD5
e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\4F19J3IC.txtMD5
045d3c961b1f9c0951e4d3cc94605f34
SHA17234e26a83aaf98ac34c8dd8ed2f8653760f60b4
SHA256cf990323f6c3cdf7150d96af8e742b235874fc27274f6a4fe0b0587b0baa04bc
SHA512910c240bf0f210231ed195a9ee4f656cef457d186a1f2b3a087af112dcf50e44006be9d5dd9f8eb0e56c512c71b8ce6733cbda6a7befb1a0509520638be394a5
-
\ProgramData\Synaptics\Synaptics.exeMD5
f65d4cf706c2add18897c640b67c8b84
SHA1dd63c38d5fd4a2d466a36dc35e8c082237de24f8
SHA256f1a5a873cc3987b2a2a756aec8bacfb6d2c922892ce07a0ffb820a332fe82655
SHA512b0e5c1a9d5dd2aff80485b2b237e6350fbd14d67323fd6a85fbc221e45a2bc0b48a2d46bb371d5498f9246943c8015bacce15d20c4c453bb772690534babf2e6
-
\ProgramData\Synaptics\Synaptics.exeMD5
f65d4cf706c2add18897c640b67c8b84
SHA1dd63c38d5fd4a2d466a36dc35e8c082237de24f8
SHA256f1a5a873cc3987b2a2a756aec8bacfb6d2c922892ce07a0ffb820a332fe82655
SHA512b0e5c1a9d5dd2aff80485b2b237e6350fbd14d67323fd6a85fbc221e45a2bc0b48a2d46bb371d5498f9246943c8015bacce15d20c4c453bb772690534babf2e6
-
\Users\Admin\AppData\Local\Temp\._cache_ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exeMD5
e89d858f8b9cf41e090c446513a79138
SHA1ee899c233da667985eb6dcc3023d7d80e7384687
SHA256b908c4c07042d2b4045ce0c67a32a7025a7b851567dfcf84e4b53adfb66cf282
SHA512dc0efd00b9f113068ecf1fe07e62dfff052c24430681e6b4f63e56456e191f4b882e4d6a843ce14aa0b7405d5cb830c8fb27dd52613e3610cb417472fbc3aed5
-
\Users\Admin\AppData\Local\Temp\._cache_ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exeMD5
e89d858f8b9cf41e090c446513a79138
SHA1ee899c233da667985eb6dcc3023d7d80e7384687
SHA256b908c4c07042d2b4045ce0c67a32a7025a7b851567dfcf84e4b53adfb66cf282
SHA512dc0efd00b9f113068ecf1fe07e62dfff052c24430681e6b4f63e56456e191f4b882e4d6a843ce14aa0b7405d5cb830c8fb27dd52613e3610cb417472fbc3aed5
-
\Users\Admin\AppData\Local\Temp\._cache_ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exeMD5
e89d858f8b9cf41e090c446513a79138
SHA1ee899c233da667985eb6dcc3023d7d80e7384687
SHA256b908c4c07042d2b4045ce0c67a32a7025a7b851567dfcf84e4b53adfb66cf282
SHA512dc0efd00b9f113068ecf1fe07e62dfff052c24430681e6b4f63e56456e191f4b882e4d6a843ce14aa0b7405d5cb830c8fb27dd52613e3610cb417472fbc3aed5
-
\Users\Admin\AppData\Local\Temp\._cache_ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exeMD5
e89d858f8b9cf41e090c446513a79138
SHA1ee899c233da667985eb6dcc3023d7d80e7384687
SHA256b908c4c07042d2b4045ce0c67a32a7025a7b851567dfcf84e4b53adfb66cf282
SHA512dc0efd00b9f113068ecf1fe07e62dfff052c24430681e6b4f63e56456e191f4b882e4d6a843ce14aa0b7405d5cb830c8fb27dd52613e3610cb417472fbc3aed5
-
\Users\Admin\AppData\Local\Temp\._cache_ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exeMD5
e89d858f8b9cf41e090c446513a79138
SHA1ee899c233da667985eb6dcc3023d7d80e7384687
SHA256b908c4c07042d2b4045ce0c67a32a7025a7b851567dfcf84e4b53adfb66cf282
SHA512dc0efd00b9f113068ecf1fe07e62dfff052c24430681e6b4f63e56456e191f4b882e4d6a843ce14aa0b7405d5cb830c8fb27dd52613e3610cb417472fbc3aed5
-
\Users\Admin\AppData\Local\Temp\._cache_ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exeMD5
e89d858f8b9cf41e090c446513a79138
SHA1ee899c233da667985eb6dcc3023d7d80e7384687
SHA256b908c4c07042d2b4045ce0c67a32a7025a7b851567dfcf84e4b53adfb66cf282
SHA512dc0efd00b9f113068ecf1fe07e62dfff052c24430681e6b4f63e56456e191f4b882e4d6a843ce14aa0b7405d5cb830c8fb27dd52613e3610cb417472fbc3aed5
-
\Users\Admin\AppData\Local\Temp\._cache_ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exeMD5
e89d858f8b9cf41e090c446513a79138
SHA1ee899c233da667985eb6dcc3023d7d80e7384687
SHA256b908c4c07042d2b4045ce0c67a32a7025a7b851567dfcf84e4b53adfb66cf282
SHA512dc0efd00b9f113068ecf1fe07e62dfff052c24430681e6b4f63e56456e191f4b882e4d6a843ce14aa0b7405d5cb830c8fb27dd52613e3610cb417472fbc3aed5
-
\Users\Admin\AppData\Local\Temp\._cache_ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exeMD5
e89d858f8b9cf41e090c446513a79138
SHA1ee899c233da667985eb6dcc3023d7d80e7384687
SHA256b908c4c07042d2b4045ce0c67a32a7025a7b851567dfcf84e4b53adfb66cf282
SHA512dc0efd00b9f113068ecf1fe07e62dfff052c24430681e6b4f63e56456e191f4b882e4d6a843ce14aa0b7405d5cb830c8fb27dd52613e3610cb417472fbc3aed5
-
\Users\Admin\AppData\Local\Temp\._cache_ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exeMD5
e89d858f8b9cf41e090c446513a79138
SHA1ee899c233da667985eb6dcc3023d7d80e7384687
SHA256b908c4c07042d2b4045ce0c67a32a7025a7b851567dfcf84e4b53adfb66cf282
SHA512dc0efd00b9f113068ecf1fe07e62dfff052c24430681e6b4f63e56456e191f4b882e4d6a843ce14aa0b7405d5cb830c8fb27dd52613e3610cb417472fbc3aed5
-
memory/784-60-0x0000000075AA1000-0x0000000075AA3000-memory.dmpFilesize
8KB
-
memory/784-61-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/944-81-0x0000000000000000-mapping.dmp
-
memory/944-90-0x0000000000360000-0x0000000000361000-memory.dmpFilesize
4KB
-
memory/1076-78-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1076-77-0x000000006F871000-0x000000006F873000-memory.dmpFilesize
8KB
-
memory/1076-76-0x000000002F8F1000-0x000000002F8F4000-memory.dmpFilesize
12KB
-
memory/1448-75-0x0000000000000000-mapping.dmp
-
memory/1748-74-0x0000000000000000-mapping.dmp
-
memory/1988-73-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1988-70-0x0000000000000000-mapping.dmp
-
memory/2016-67-0x0000000000850000-0x000000000095D000-memory.dmpFilesize
1.1MB
-
memory/2016-64-0x0000000000000000-mapping.dmp