Malware Analysis Report

2025-06-16 02:26

Sample ID 220222-z3676adgh6
Target 0a6122f38d670eec50dfb91aeb8791c7ce24928480e4a32793d71e472a55c1f7
SHA256 0a6122f38d670eec50dfb91aeb8791c7ce24928480e4a32793d71e472a55c1f7
Tags
hawkeye collection keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0a6122f38d670eec50dfb91aeb8791c7ce24928480e4a32793d71e472a55c1f7

Threat Level: Known bad

The file 0a6122f38d670eec50dfb91aeb8791c7ce24928480e4a32793d71e472a55c1f7 was found to be: Known bad.

Malicious Activity Summary

hawkeye collection keylogger persistence spyware stealer trojan

Nirsoft

HawkEye

NirSoft WebBrowserPassView

Nirsoft

NirSoft MailPassView

Executes dropped EXE

Checks computer location settings

Uses the VBS compiler for execution

Loads dropped DLL

Reads user/profile data of web browsers

Accesses Microsoft Outlook accounts

Looks up external IP address via web service

Adds Run key to start application

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Modifies Internet Explorer settings

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-02-22 21:15

Signatures

Nirsoft

Description Indicator Process Target
N/A N/A N/A N/A

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-02-22 21:15

Reported

2022-02-22 21:27

Platform

win7-en-20211208

Max time kernel

156s

Max time network

160s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0a6122f38d670eec50dfb91aeb8791c7ce24928480e4a32793d71e472a55c1f7.exe"

Signatures

HawkEye

keylogger trojan stealer spyware hawkeye

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Nirsoft

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Synapse.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Synapse.exe N/A

Reads user/profile data of web browsers

spyware stealer

Uses the VBS compiler for execution

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe" C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A whatismyipaddress.com N/A N/A
N/A whatismyipaddress.com N/A N/A
N/A whatismyipaddress.com N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1300 set thread context of 1564 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1300 set thread context of 1124 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0578ec73228d801 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000029a8fa03d77d0143b95f148165a5bc92000000000200000000001066000000010000200000005b102842d62c3ecc918d259a96c37f8510781cb79d91b0c71b199bcaaf9b17d0000000000e8000000002000020000000d132dfe74f1336cac9675464b35c60908ba95b0df322739e5939521abc2a5e3a200000003ae19fa7403c85ea3cb7819191a79631c8f30c02877f6f80918e92640456c722400000001ce332bb4fae766b9afedf7490999261903b91dc69cf832ffe8c74e7a2f15c13afb18b335391c86f4b137763379916d981d41042b193ff9e4f90ee3a38251b8f C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "352330088" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EBA68B81-9425-11EC-A181-E61AA6254D84} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000029a8fa03d77d0143b95f148165a5bc92000000000200000000001066000000010000200000000df4d2acadef1e93209e313162819cf46c6d0765dd4600a8b67ec302a3a62281000000000e800000000200002000000085f5a4f0ef96fb52e2227291ec8709736099c90ea271d6c305459a65cb7f017a90000000e72a9458eac4edf4958d369afcde020bf93c5cf383e2bb8f49f71ff0e65ce07ce2b63b20319dafefba54be072a9adc1c90a18d4ebba28bc405551b1f631dc2d8e5aeafb27e1371f2aa09eb6b2e158ff4642c4c57bea47dbdf9d70cbdbfac339579e2056a5dd49b9650612f51fe7f314330b6b2a5527bb2b9a723980b375b6b073cb495f57bd6fc1ea26a98ba88c9df2540000000e19e3568d46274d528c981b31dd7432bba8173248e914321313f3ce887af636efa7a44a2bca0d99f304237af6e6a2aeb321078b75b99040d161d482229f271b0 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" C:\Program Files\Internet Explorer\iexplore.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6252DC40F71143A22FDE9EF7348E064251B18118 C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6252DC40F71143A22FDE9EF7348E064251B18118\Blob = 0f00000001000000140000001e427a3639cce4c27e94b1777964ca289a722cad09000000010000003e000000303c06082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030806082b060105050703091400000001000000140000006daa9b0987c4d0d422ed4007374d19f191ffded31d000000010000001000000096f98b6e79a74810ce7d398a82f977780b000000010000000e000000430065007200740075006d0000000300000001000000140000006252dc40f71143a22fde9ef7348e064251b181182000000001000000100300003082030c308201f4a0030201020203010020300d06092a864886f70d0101050500303e310b300906035504061302504c311b3019060355040a1312556e697a65746f2053702e207a206f2e6f2e311230100603550403130943657274756d204341301e170d3032303631313130343633395a170d3237303631313130343633395a303e310b300906035504061302504c311b3019060355040a1312556e697a65746f2053702e207a206f2e6f2e311230100603550403130943657274756d20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ceb1c12ed34f7ccd25ce183e4fc48c6f806a73c85b51f89bd2dcbb005cb1a0fc7503ee81f088ee2352e9e615338dac2d09c576f92b398089e4974b90a5a878f873437ba461b0d858cce16c667e9cf3095e556384d5a8eff3b12e3068b3c43cd8ac6e8d995a904e34dc369a8f818850b76d964209f3d795830d414bb06a6bf8fc0f7e629f67c4ed265f10260f084ff0a45728ce8fb8ed45f66eee255daa6e39bee4932fd947a072ebfaa65bafca533fe20ec69656116ef7e966a926d87f9553ed0a8588ba4f29a5428c5eb6fc852000aa680ba11a85019cc446638288b622b1eefeaa46597ecf352cd5b6da5df748331454b6ebd96fcecd88d6ab1bda963b1d590203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d01010505000382010100b88dceefe714bacfeeb044926cb4393ea2846eadb82177d2d4778287e6204181eee2f811b763d11737be1976241c041a4ceb3daa676f2dd4cdfe653170c51ba6020aba607b6d58c29a49fe63320b6be33ac0acab3bb0e8d309518c1083c634e0c52be01ab66014276c32778cbcb27298cfcdcc3fb9c8244214d657fce62643a91de58090ce0354283ef73fd3f84ded6a0a3a93139b3b142313639c3fd1872779e54c51e301ad855d1a3bb1d57310a4d3f2bc6e64f55a5690a8c70e4c740f2e713bf7c847f4696f15f2115e831e9c7c52aefd02da12a8596718dbbc70dd9bb169ed80ce8940486a0e35ca29661521942ce8602a9b854a40f36b8a24ec06162c73 C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6252DC40F71143A22FDE9EF7348E064251B18118\Blob = 0400000001000000100000002c8f9f661d1890b147269d8e86828ca90300000001000000140000006252dc40f71143a22fde9ef7348e064251b181180b000000010000000e000000430065007200740075006d0000001d000000010000001000000096f98b6e79a74810ce7d398a82f977781400000001000000140000006daa9b0987c4d0d422ed4007374d19f191ffded309000000010000003e000000303c06082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030806082b060105050703090f00000001000000140000001e427a3639cce4c27e94b1777964ca289a722cad2000000001000000100300003082030c308201f4a0030201020203010020300d06092a864886f70d0101050500303e310b300906035504061302504c311b3019060355040a1312556e697a65746f2053702e207a206f2e6f2e311230100603550403130943657274756d204341301e170d3032303631313130343633395a170d3237303631313130343633395a303e310b300906035504061302504c311b3019060355040a1312556e697a65746f2053702e207a206f2e6f2e311230100603550403130943657274756d20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ceb1c12ed34f7ccd25ce183e4fc48c6f806a73c85b51f89bd2dcbb005cb1a0fc7503ee81f088ee2352e9e615338dac2d09c576f92b398089e4974b90a5a878f873437ba461b0d858cce16c667e9cf3095e556384d5a8eff3b12e3068b3c43cd8ac6e8d995a904e34dc369a8f818850b76d964209f3d795830d414bb06a6bf8fc0f7e629f67c4ed265f10260f084ff0a45728ce8fb8ed45f66eee255daa6e39bee4932fd947a072ebfaa65bafca533fe20ec69656116ef7e966a926d87f9553ed0a8588ba4f29a5428c5eb6fc852000aa680ba11a85019cc446638288b622b1eefeaa46597ecf352cd5b6da5df748331454b6ebd96fcecd88d6ab1bda963b1d590203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d01010505000382010100b88dceefe714bacfeeb044926cb4393ea2846eadb82177d2d4778287e6204181eee2f811b763d11737be1976241c041a4ceb3daa676f2dd4cdfe653170c51ba6020aba607b6d58c29a49fe63320b6be33ac0acab3bb0e8d309518c1083c634e0c52be01ab66014276c32778cbcb27298cfcdcc3fb9c8244214d657fce62643a91de58090ce0354283ef73fd3f84ded6a0a3a93139b3b142313639c3fd1872779e54c51e301ad855d1a3bb1d57310a4d3f2bc6e64f55a5690a8c70e4c740f2e713bf7c847f4696f15f2115e831e9c7c52aefd02da12a8596718dbbc70dd9bb169ed80ce8940486a0e35ca29661521942ce8602a9b854a40f36b8a24ec06162c73 C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6252DC40F71143A22FDE9EF7348E064251B18118\Blob = 1900000001000000100000000b6cd9778e41ad67fd6be0a6903710440f00000001000000140000001e427a3639cce4c27e94b1777964ca289a722cad09000000010000003e000000303c06082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030806082b060105050703091400000001000000140000006daa9b0987c4d0d422ed4007374d19f191ffded31d000000010000001000000096f98b6e79a74810ce7d398a82f977780b000000010000000e000000430065007200740075006d0000000300000001000000140000006252dc40f71143a22fde9ef7348e064251b181180400000001000000100000002c8f9f661d1890b147269d8e86828ca92000000001000000100300003082030c308201f4a0030201020203010020300d06092a864886f70d0101050500303e310b300906035504061302504c311b3019060355040a1312556e697a65746f2053702e207a206f2e6f2e311230100603550403130943657274756d204341301e170d3032303631313130343633395a170d3237303631313130343633395a303e310b300906035504061302504c311b3019060355040a1312556e697a65746f2053702e207a206f2e6f2e311230100603550403130943657274756d20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ceb1c12ed34f7ccd25ce183e4fc48c6f806a73c85b51f89bd2dcbb005cb1a0fc7503ee81f088ee2352e9e615338dac2d09c576f92b398089e4974b90a5a878f873437ba461b0d858cce16c667e9cf3095e556384d5a8eff3b12e3068b3c43cd8ac6e8d995a904e34dc369a8f818850b76d964209f3d795830d414bb06a6bf8fc0f7e629f67c4ed265f10260f084ff0a45728ce8fb8ed45f66eee255daa6e39bee4932fd947a072ebfaa65bafca533fe20ec69656116ef7e966a926d87f9553ed0a8588ba4f29a5428c5eb6fc852000aa680ba11a85019cc446638288b622b1eefeaa46597ecf352cd5b6da5df748331454b6ebd96fcecd88d6ab1bda963b1d590203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d01010505000382010100b88dceefe714bacfeeb044926cb4393ea2846eadb82177d2d4778287e6204181eee2f811b763d11737be1976241c041a4ceb3daa676f2dd4cdfe653170c51ba6020aba607b6d58c29a49fe63320b6be33ac0acab3bb0e8d309518c1083c634e0c52be01ab66014276c32778cbcb27298cfcdcc3fb9c8244214d657fce62643a91de58090ce0354283ef73fd3f84ded6a0a3a93139b3b142313639c3fd1872779e54c51e301ad855d1a3bb1d57310a4d3f2bc6e64f55a5690a8c70e4c740f2e713bf7c847f4696f15f2115e831e9c7c52aefd02da12a8596718dbbc70dd9bb169ed80ce8940486a0e35ca29661521942ce8602a9b854a40f36b8a24ec06162c73 C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0a6122f38d670eec50dfb91aeb8791c7ce24928480e4a32793d71e472a55c1f7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 868 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Local\Temp\0a6122f38d670eec50dfb91aeb8791c7ce24928480e4a32793d71e472a55c1f7.exe C:\Users\Admin\AppData\Local\Temp\Synapse.exe
PID 868 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Local\Temp\0a6122f38d670eec50dfb91aeb8791c7ce24928480e4a32793d71e472a55c1f7.exe C:\Users\Admin\AppData\Local\Temp\Synapse.exe
PID 868 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Local\Temp\0a6122f38d670eec50dfb91aeb8791c7ce24928480e4a32793d71e472a55c1f7.exe C:\Users\Admin\AppData\Local\Temp\Synapse.exe
PID 868 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Local\Temp\0a6122f38d670eec50dfb91aeb8791c7ce24928480e4a32793d71e472a55c1f7.exe C:\Users\Admin\AppData\Local\Temp\Synapse.exe
PID 1348 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Local\Temp\Synapse.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1348 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Local\Temp\Synapse.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1348 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Local\Temp\Synapse.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1348 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Local\Temp\Synapse.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1348 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Local\Temp\Synapse.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1348 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Local\Temp\Synapse.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1348 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Local\Temp\Synapse.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1300 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\SysWOW64\WScript.exe
PID 1300 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\SysWOW64\WScript.exe
PID 1300 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\SysWOW64\WScript.exe
PID 1300 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\SysWOW64\WScript.exe
PID 1300 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\SysWOW64\cmd.exe
PID 1300 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\SysWOW64\cmd.exe
PID 1300 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\SysWOW64\cmd.exe
PID 1300 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\SysWOW64\cmd.exe
PID 1300 wrote to memory of 636 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1300 wrote to memory of 636 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1300 wrote to memory of 636 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1300 wrote to memory of 636 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 636 wrote to memory of 1552 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 636 wrote to memory of 1552 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 636 wrote to memory of 1552 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 636 wrote to memory of 1552 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1300 wrote to memory of 1564 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1300 wrote to memory of 1564 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1300 wrote to memory of 1564 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1300 wrote to memory of 1564 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1300 wrote to memory of 1564 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1300 wrote to memory of 1564 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1300 wrote to memory of 1564 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1300 wrote to memory of 1564 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1300 wrote to memory of 1564 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1300 wrote to memory of 1564 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1300 wrote to memory of 1124 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1300 wrote to memory of 1124 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1300 wrote to memory of 1124 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1300 wrote to memory of 1124 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1300 wrote to memory of 1124 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1300 wrote to memory of 1124 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1300 wrote to memory of 1124 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1300 wrote to memory of 1124 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1300 wrote to memory of 1124 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1300 wrote to memory of 1124 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\0a6122f38d670eec50dfb91aeb8791c7ce24928480e4a32793d71e472a55c1f7.exe

"C:\Users\Admin\AppData\Local\Temp\0a6122f38d670eec50dfb91aeb8791c7ce24928480e4a32793d71e472a55c1f7.exe"

C:\Users\Admin\AppData\Local\Temp\Synapse.exe

"C:\Users\Admin\AppData\Local\Temp\Synapse.exe"

C:\Users\Admin\AppData\Roaming\Windows Update.exe

"C:\Users\Admin\AppData\Roaming\Windows Update.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\BFile_1.vbs"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\BFile_2.bat" "

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" http://https//www.youtube.com/channel/UC4EA30fMnAwmEYC_CWHhz-g?sub_confirmation=1

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:636 CREDAT:275457 /prefetch:2

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"

Network

Country Destination Domain Proto
US 8.8.8.8:53 discordapp.com udp
US 162.159.134.233:443 discordapp.com tcp
US 8.8.8.8:53 cookiemuncher.x10host.com udp
US 8.8.8.8:53 whatismyipaddress.com udp
US 104.16.155.36:80 whatismyipaddress.com tcp
US 104.16.155.36:443 whatismyipaddress.com tcp
US 104.16.155.36:443 whatismyipaddress.com tcp
US 8.8.8.8:53 smtp.yandex.com udp
RU 77.88.21.158:587 smtp.yandex.com tcp
US 8.8.8.8:53 repository.certum.pl udp
NL 104.110.191.15:80 repository.certum.pl tcp
RU 77.88.21.158:587 smtp.yandex.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

memory/868-54-0x000007FEF50F3000-0x000007FEF50F4000-memory.dmp

memory/868-55-0x0000000000C70000-0x0000000000EA4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Synapse.exe

MD5 e91811fb1b9dd032147306fe68c5def8
SHA1 c9dc6902c0a3fddbd6d422752afd269463f59bea
SHA256 6a22b3a88d9c0a2db9a9556957e530a0bbf069cc85f9e3515b3e3b5394e407b5
SHA512 a03c60252397c5f5fad0a72d309a554829b69cd793fa828cf94ee5e3f32c04990eca6ba70c57ec461f6ed5d37689518822d3e6c3d81a0d2a304184cbe02a39d7

C:\Users\Admin\AppData\Local\Temp\Synapse.exe

MD5 e91811fb1b9dd032147306fe68c5def8
SHA1 c9dc6902c0a3fddbd6d422752afd269463f59bea
SHA256 6a22b3a88d9c0a2db9a9556957e530a0bbf069cc85f9e3515b3e3b5394e407b5
SHA512 a03c60252397c5f5fad0a72d309a554829b69cd793fa828cf94ee5e3f32c04990eca6ba70c57ec461f6ed5d37689518822d3e6c3d81a0d2a304184cbe02a39d7

memory/1348-58-0x0000000075761000-0x0000000075763000-memory.dmp

memory/1348-59-0x00000000747F1000-0x00000000747F2000-memory.dmp

memory/1348-61-0x00000000747F2000-0x00000000747F4000-memory.dmp

memory/1348-60-0x00000000009A0000-0x00000000009A1000-memory.dmp

memory/868-62-0x000000001B720000-0x000000001B722000-memory.dmp

\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 e91811fb1b9dd032147306fe68c5def8
SHA1 c9dc6902c0a3fddbd6d422752afd269463f59bea
SHA256 6a22b3a88d9c0a2db9a9556957e530a0bbf069cc85f9e3515b3e3b5394e407b5
SHA512 a03c60252397c5f5fad0a72d309a554829b69cd793fa828cf94ee5e3f32c04990eca6ba70c57ec461f6ed5d37689518822d3e6c3d81a0d2a304184cbe02a39d7

C:\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 e91811fb1b9dd032147306fe68c5def8
SHA1 c9dc6902c0a3fddbd6d422752afd269463f59bea
SHA256 6a22b3a88d9c0a2db9a9556957e530a0bbf069cc85f9e3515b3e3b5394e407b5
SHA512 a03c60252397c5f5fad0a72d309a554829b69cd793fa828cf94ee5e3f32c04990eca6ba70c57ec461f6ed5d37689518822d3e6c3d81a0d2a304184cbe02a39d7

C:\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 e91811fb1b9dd032147306fe68c5def8
SHA1 c9dc6902c0a3fddbd6d422752afd269463f59bea
SHA256 6a22b3a88d9c0a2db9a9556957e530a0bbf069cc85f9e3515b3e3b5394e407b5
SHA512 a03c60252397c5f5fad0a72d309a554829b69cd793fa828cf94ee5e3f32c04990eca6ba70c57ec461f6ed5d37689518822d3e6c3d81a0d2a304184cbe02a39d7

memory/1300-68-0x0000000000B20000-0x0000000000B21000-memory.dmp

memory/1300-67-0x00000000747F1000-0x00000000747F2000-memory.dmp

memory/1300-69-0x00000000747F2000-0x00000000747F4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

MD5 a162aa906647b2207d99d3665987a2ee
SHA1 38e902889d73e11107c5534ecc969d0019376814
SHA256 09194974bf3ae3b3236edfbdd62b47d1f70461dbd96b771b489c35140fbb3652
SHA512 db61512c5a7ec3f3a6415dbfc0f1e46cd97fa3a38adb99ef7ea97fcd37d655074344b8ef39971b960ebe8bfdbc7f1cea89548c9479e91be3b0f5f05db1e98de5

C:\Users\Admin\AppData\Local\Temp\BFile_1.vbs

MD5 f8048fba2c228bc90a63e3cbbd102528
SHA1 ea6e71c06c449862212eec2b1408763fb13dd2b0
SHA256 ed656138d877dbed0dceadccbed653a9bfce17a0930fac8c3dca88fbbda25769
SHA512 ac0ad86755f90cefec8acd4aab67116709ed2dc19fbbfbcc6ca7d4b9b681ea84a3ed56c82251508d64c3d1ce098642e8f4f32f215fd6bd68c928e76ae278fad7

memory/1300-73-0x0000000000B36000-0x0000000000B37000-memory.dmp

memory/1300-74-0x0000000000B25000-0x0000000000B36000-memory.dmp

memory/1564-75-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1564-77-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1124-78-0x0000000000400000-0x0000000000458000-memory.dmp

memory/1124-80-0x0000000000400000-0x0000000000458000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\holderwb.txt

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 42156f43931d1f827a793318eb4b04ca
SHA1 1cb70f072453f0a98b067fd9bb9ba73c90dba329
SHA256 d1dea64b172cb79a7f26fc2f98073f96123d5b5d29fa844fb0fcd34dbbf21f84
SHA512 88f7f85364bd3275392aeabb2fb894a241e5ee1927f48653d621a1b9d846ce2acfa4254d9b7542e5d9621a8cb2a7ee59cb8e97342f53a945d88e4e9327af158e

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\FXRCMD7S.txt

MD5 b7f4a599eb97529e554126b641608259
SHA1 f9319ff7af1b8039473080caf8e96f8a08e5e3df
SHA256 cc9d55cb36f576c3fa5c9d40e133ba2e6275fe46c466936af1af247b3aa7c4fe
SHA512 c50f86f1a889f692a0e5995d92e0767724f219023c8f05593b550a84f7fe1f60da588475891aca5c80d3d3f3fa4e9cfdb74b4ef434853d1c8e875a86413dffcf

Analysis: behavioral2

Detonation Overview

Submitted

2022-02-22 21:15

Reported

2022-02-22 21:27

Platform

win10v2004-en-20220113

Max time kernel

156s

Max time network

163s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0a6122f38d670eec50dfb91aeb8791c7ce24928480e4a32793d71e472a55c1f7.exe"

Signatures

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Nirsoft

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Synapse.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\0a6122f38d670eec50dfb91aeb8791c7ce24928480e4a32793d71e472a55c1f7.exe N/A

Reads user/profile data of web browsers

spyware stealer

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0a6122f38d670eec50dfb91aeb8791c7ce24928480e4a32793d71e472a55c1f7.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\0a6122f38d670eec50dfb91aeb8791c7ce24928480e4a32793d71e472a55c1f7.exe

"C:\Users\Admin\AppData\Local\Temp\0a6122f38d670eec50dfb91aeb8791c7ce24928480e4a32793d71e472a55c1f7.exe"

C:\Users\Admin\AppData\Local\Temp\Synapse.exe

"C:\Users\Admin\AppData\Local\Temp\Synapse.exe"

C:\Windows\SysWOW64\fondue.exe

"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll

C:\Windows\system32\FonDUE.EXE

"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll

Network

Country Destination Domain Proto
RU 91.243.59.39:3224 tcp
US 72.21.81.240:80 tcp
US 72.21.81.240:80 tcp
US 8.8.8.8:53 discordapp.com udp
US 162.159.133.233:443 discordapp.com tcp
US 8.8.8.8:53 cookiemuncher.x10host.com udp
US 52.109.12.20:443 tcp
US 52.168.112.66:443 tcp

Files

memory/3540-130-0x00007FFC00513000-0x00007FFC00515000-memory.dmp

memory/3540-131-0x00000000003A0000-0x00000000005D4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Synapse.exe

MD5 e91811fb1b9dd032147306fe68c5def8
SHA1 c9dc6902c0a3fddbd6d422752afd269463f59bea
SHA256 6a22b3a88d9c0a2db9a9556957e530a0bbf069cc85f9e3515b3e3b5394e407b5
SHA512 a03c60252397c5f5fad0a72d309a554829b69cd793fa828cf94ee5e3f32c04990eca6ba70c57ec461f6ed5d37689518822d3e6c3d81a0d2a304184cbe02a39d7

memory/3540-133-0x000000001D0E0000-0x000000001D0E2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Synapse.exe

MD5 e91811fb1b9dd032147306fe68c5def8
SHA1 c9dc6902c0a3fddbd6d422752afd269463f59bea
SHA256 6a22b3a88d9c0a2db9a9556957e530a0bbf069cc85f9e3515b3e3b5394e407b5
SHA512 a03c60252397c5f5fad0a72d309a554829b69cd793fa828cf94ee5e3f32c04990eca6ba70c57ec461f6ed5d37689518822d3e6c3d81a0d2a304184cbe02a39d7