Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
11-05-2021 12:29
Static task
static1
Behavioral task
behavioral1
Sample
e62fe9f785fca1669840b7db105c774bbe00e5f5889720fb33eecf6175b6a51e.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
e62fe9f785fca1669840b7db105c774bbe00e5f5889720fb33eecf6175b6a51e.exe
Resource
win10v20210410
General
-
Target
e62fe9f785fca1669840b7db105c774bbe00e5f5889720fb33eecf6175b6a51e.exe
-
Size
2.2MB
-
MD5
89c466989a3acfa3549909cfb3a2af6e
-
SHA1
6117e6e01fcea6a324c30ffe611ccf625919d9ce
-
SHA256
e62fe9f785fca1669840b7db105c774bbe00e5f5889720fb33eecf6175b6a51e
-
SHA512
dc52f8b7d851f600437f366ceeb0a5031b764a929bd705fc7e32b351c9087a1fa6b267cd0657f89a81bffe76c0ae7e99074bda7dd128420cd092bc2eb35e9bd4
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
._cache_e62fe9f785fca1669840b7db105c774bbe00e5f5889720fb33eecf6175b6a51e.exeSynaptics.exepid process 1488 ._cache_e62fe9f785fca1669840b7db105c774bbe00e5f5889720fb33eecf6175b6a51e.exe 2172 Synaptics.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\UaCN8nSV.xlsm office_macros -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
e62fe9f785fca1669840b7db105c774bbe00e5f5889720fb33eecf6175b6a51e.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation e62fe9f785fca1669840b7db105c774bbe00e5f5889720fb33eecf6175b6a51e.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
e62fe9f785fca1669840b7db105c774bbe00e5f5889720fb33eecf6175b6a51e.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" e62fe9f785fca1669840b7db105c774bbe00e5f5889720fb33eecf6175b6a51e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2032 1488 WerFault.exe ._cache_e62fe9f785fca1669840b7db105c774bbe00e5f5889720fb33eecf6175b6a51e.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Modifies registry class 1 IoCs
Processes:
e62fe9f785fca1669840b7db105c774bbe00e5f5889720fb33eecf6175b6a51e.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance e62fe9f785fca1669840b7db105c774bbe00e5f5889720fb33eecf6175b6a51e.exe -
Processes:
Synaptics.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Synaptics.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Synaptics.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1324 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
WerFault.exepid process 2032 WerFault.exe 2032 WerFault.exe 2032 WerFault.exe 2032 WerFault.exe 2032 WerFault.exe 2032 WerFault.exe 2032 WerFault.exe 2032 WerFault.exe 2032 WerFault.exe 2032 WerFault.exe 2032 WerFault.exe 2032 WerFault.exe 2032 WerFault.exe 2032 WerFault.exe 2032 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 2032 WerFault.exe Token: SeBackupPrivilege 2032 WerFault.exe Token: SeDebugPrivilege 2032 WerFault.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
EXCEL.EXEpid process 1324 EXCEL.EXE 1324 EXCEL.EXE 1324 EXCEL.EXE 1324 EXCEL.EXE 1324 EXCEL.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
e62fe9f785fca1669840b7db105c774bbe00e5f5889720fb33eecf6175b6a51e.exedescription pid process target process PID 1808 wrote to memory of 1488 1808 e62fe9f785fca1669840b7db105c774bbe00e5f5889720fb33eecf6175b6a51e.exe ._cache_e62fe9f785fca1669840b7db105c774bbe00e5f5889720fb33eecf6175b6a51e.exe PID 1808 wrote to memory of 1488 1808 e62fe9f785fca1669840b7db105c774bbe00e5f5889720fb33eecf6175b6a51e.exe ._cache_e62fe9f785fca1669840b7db105c774bbe00e5f5889720fb33eecf6175b6a51e.exe PID 1808 wrote to memory of 1488 1808 e62fe9f785fca1669840b7db105c774bbe00e5f5889720fb33eecf6175b6a51e.exe ._cache_e62fe9f785fca1669840b7db105c774bbe00e5f5889720fb33eecf6175b6a51e.exe PID 1808 wrote to memory of 2172 1808 e62fe9f785fca1669840b7db105c774bbe00e5f5889720fb33eecf6175b6a51e.exe Synaptics.exe PID 1808 wrote to memory of 2172 1808 e62fe9f785fca1669840b7db105c774bbe00e5f5889720fb33eecf6175b6a51e.exe Synaptics.exe PID 1808 wrote to memory of 2172 1808 e62fe9f785fca1669840b7db105c774bbe00e5f5889720fb33eecf6175b6a51e.exe Synaptics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e62fe9f785fca1669840b7db105c774bbe00e5f5889720fb33eecf6175b6a51e.exe"C:\Users\Admin\AppData\Local\Temp\e62fe9f785fca1669840b7db105c774bbe00e5f5889720fb33eecf6175b6a51e.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_e62fe9f785fca1669840b7db105c774bbe00e5f5889720fb33eecf6175b6a51e.exe"C:\Users\Admin\AppData\Local\Temp\._cache_e62fe9f785fca1669840b7db105c774bbe00e5f5889720fb33eecf6175b6a51e.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 8923⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- Modifies system certificate store
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Synaptics\Synaptics.exeMD5
85c4062ca855443ba02c2b83503ddc14
SHA15fa7451b7808c19a3d28dbbd4f662d0a584b6c77
SHA2569770a6476b607f28077320caa244bbdde08611769338485faa64ad3bee4616cf
SHA512851b48968e44604db4d02ec29744e6e2ca006e20bfb8883152860984dd4a648684e20b97b83a0b76afd21a922b3ac1afa9b2d54d9e3125b2e9b6958a8a7f5c7e
-
C:\ProgramData\Synaptics\Synaptics.exeMD5
85c4062ca855443ba02c2b83503ddc14
SHA15fa7451b7808c19a3d28dbbd4f662d0a584b6c77
SHA2569770a6476b607f28077320caa244bbdde08611769338485faa64ad3bee4616cf
SHA512851b48968e44604db4d02ec29744e6e2ca006e20bfb8883152860984dd4a648684e20b97b83a0b76afd21a922b3ac1afa9b2d54d9e3125b2e9b6958a8a7f5c7e
-
C:\Users\Admin\AppData\Local\Temp\._cache_e62fe9f785fca1669840b7db105c774bbe00e5f5889720fb33eecf6175b6a51e.exeMD5
f48d076b2d4237f0e1a8fc5a4d5234ca
SHA1c28d3eacaaededa1d8c5192175925fa4d05c7e3b
SHA2563528c9e999b2a5b14b7cb60122a46c0b0d9185b19b1090155fd152e669a96b86
SHA512cdbc83e869d07a323923a0dc8f013c09be286a1ade9611435dcfb2f05556c709ff761650b216e0fee39d653c7d5c90ba55c06327c7bda05173d569050e4eff06
-
C:\Users\Admin\AppData\Local\Temp\._cache_e62fe9f785fca1669840b7db105c774bbe00e5f5889720fb33eecf6175b6a51e.exeMD5
f48d076b2d4237f0e1a8fc5a4d5234ca
SHA1c28d3eacaaededa1d8c5192175925fa4d05c7e3b
SHA2563528c9e999b2a5b14b7cb60122a46c0b0d9185b19b1090155fd152e669a96b86
SHA512cdbc83e869d07a323923a0dc8f013c09be286a1ade9611435dcfb2f05556c709ff761650b216e0fee39d653c7d5c90ba55c06327c7bda05173d569050e4eff06
-
C:\Users\Admin\AppData\Local\Temp\UaCN8nSV.xlsmMD5
e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
memory/1324-127-0x00007FF94EEB0000-0x00007FF94EEC0000-memory.dmpFilesize
64KB
-
memory/1324-128-0x00007FF94EEB0000-0x00007FF94EEC0000-memory.dmpFilesize
64KB
-
memory/1324-134-0x000002174B500000-0x000002174D3F5000-memory.dmpFilesize
31.0MB
-
memory/1324-132-0x00007FF96F180000-0x00007FF97026E000-memory.dmpFilesize
16.9MB
-
memory/1324-133-0x00007FF94EEB0000-0x00007FF94EEC0000-memory.dmpFilesize
64KB
-
memory/1324-125-0x00007FF72ED20000-0x00007FF7322D6000-memory.dmpFilesize
53.7MB
-
memory/1324-126-0x00007FF94EEB0000-0x00007FF94EEC0000-memory.dmpFilesize
64KB
-
memory/1324-129-0x00007FF94EEB0000-0x00007FF94EEC0000-memory.dmpFilesize
64KB
-
memory/1488-124-0x00000000012D0000-0x00000000012D1000-memory.dmpFilesize
4KB
-
memory/1488-121-0x00000000012E0000-0x00000000012E1000-memory.dmpFilesize
4KB
-
memory/1488-115-0x0000000000000000-mapping.dmp
-
memory/1808-114-0x0000000000890000-0x0000000000891000-memory.dmpFilesize
4KB
-
memory/2172-118-0x0000000000000000-mapping.dmp
-
memory/2172-123-0x00000000004D0000-0x000000000057E000-memory.dmpFilesize
696KB