Analysis
-
max time kernel
19s -
max time network
37s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 11:17
Static task
static1
Behavioral task
behavioral1
Sample
ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe
Resource
win10v2004-20220414-en
General
-
Target
ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe
-
Size
904KB
-
MD5
174dd7939ab780f7cf8118f9a8967afe
-
SHA1
4fb8476faa85c3ba287c170ebd749331488be2f1
-
SHA256
ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4
-
SHA512
918b267890e2befea1abc78643338acd9edbf0c40bc3edcba293278425c41cf3f80eaa4c507bf7802b3c69afa64e9e411842bf9848877a235d2b70fb3e1f4958
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exeSynaptics.exepid process 4504 ._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe 2116 Synaptics.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows\CurrentVersion\Run ._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe" ._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exedescription ioc process File opened for modification \??\PhysicalDrive0 ._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2552 4504 WerFault.exe ._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 1 IoCs
Processes:
ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exepid process 4504 ._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe 4504 ._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe 4504 ._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe 4504 ._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe 4504 ._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe 4504 ._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exedescription pid process Token: SeDebugPrivilege 4504 ._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exedescription pid process target process PID 2360 wrote to memory of 4504 2360 ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe ._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe PID 2360 wrote to memory of 4504 2360 ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe ._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe PID 2360 wrote to memory of 4504 2360 ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe ._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe PID 4504 wrote to memory of 4996 4504 ._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe schtasks.exe PID 4504 wrote to memory of 4996 4504 ._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe schtasks.exe PID 4504 wrote to memory of 4996 4504 ._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe schtasks.exe PID 2360 wrote to memory of 2116 2360 ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe Synaptics.exe PID 2360 wrote to memory of 2116 2360 ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe Synaptics.exe PID 2360 wrote to memory of 2116 2360 ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe Synaptics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe"C:\Users\Admin\AppData\Local\Temp\ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe"C:\Users\Admin\AppData\Local\Temp\._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR "C:\Users\Admin\AppData\Local\Temp\._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exe"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 5083⤵
- Program crash
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4504 -ip 45041⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Synaptics\Synaptics.exeFilesize
753KB
MD5d39c83fa94398010bc7a281fcd781369
SHA1cf0352fe8bd177507456f65c54c806fe1ca85507
SHA256e173266e3d9af60add936ab2b0de936d1e35fa85556ea5c60bad7c75e818c4e3
SHA5125688c1d2a02fa4d2da2d3711a3cea12e6f8585eb9d7d28df0fc5f835be075e371e5ac1f991352beb9a71b9fcd1f32f744e7af7b8068095f1bffceebdb711daa4
-
C:\ProgramData\Synaptics\Synaptics.exeFilesize
753KB
MD5d39c83fa94398010bc7a281fcd781369
SHA1cf0352fe8bd177507456f65c54c806fe1ca85507
SHA256e173266e3d9af60add936ab2b0de936d1e35fa85556ea5c60bad7c75e818c4e3
SHA5125688c1d2a02fa4d2da2d3711a3cea12e6f8585eb9d7d28df0fc5f835be075e371e5ac1f991352beb9a71b9fcd1f32f744e7af7b8068095f1bffceebdb711daa4
-
C:\Users\Admin\AppData\Local\Temp\._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exeFilesize
150KB
MD5b22a39290f8d3bfa63521368b32b1004
SHA199c2f942b56d1c8fd180d1464f3218bb66cc2016
SHA2561c9c800d28964e7672d59e733c8eba0a262fe1d80cdee042f376927ee296c560
SHA512b9d8cb98028ed01b58e7f7715372e31c647a9e6506119d497668b55f1ab56854b842a7b4f82c9cdff35ccab1ba168d5afe6f161beabdff903c499b27599da7f4
-
C:\Users\Admin\AppData\Local\Temp\._cache_ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4.exeFilesize
150KB
MD5b22a39290f8d3bfa63521368b32b1004
SHA199c2f942b56d1c8fd180d1464f3218bb66cc2016
SHA2561c9c800d28964e7672d59e733c8eba0a262fe1d80cdee042f376927ee296c560
SHA512b9d8cb98028ed01b58e7f7715372e31c647a9e6506119d497668b55f1ab56854b842a7b4f82c9cdff35ccab1ba168d5afe6f161beabdff903c499b27599da7f4
-
memory/2116-134-0x0000000000000000-mapping.dmp
-
memory/4504-130-0x0000000000000000-mapping.dmp
-
memory/4996-133-0x0000000000000000-mapping.dmp