darkcomet | 6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175

Analysis

max time kernel
151s
max time network
150s
platform
windows7_x64
resource
win7-20220414-en
submitted
24-05-2022 23:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe
Size

1.6MB
MD5

36a1093ba903a8f60018be5a47b64f4d
SHA1

29e900950b9f4910bfbb6d40425c4acf9860050d
SHA256

6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175
SHA512

ccc024b732e2b0a9770ce6db9dd5bbbeeeddaa6c6e8ac492eab099abb7354246bc6b2b80b137d6a5215f6648295c1edbc871fcaf6cc55d46eab1c762674f8dd9

Score

10^/10

darkcomet sazan persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Sazan

127.0.0.1:1604

Mutex

DC_MUTEX-XYKG11G

Attributes

gencode
UtdF4g2keNM8
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Executes dropped EXE 2 IoCs

Processes:

._cache_6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exeSynaptics.exe

pid process

1524 ._cache_6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe
336 Synaptics.exe

pid	process
1524	._cache_6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe
336	Synaptics.exe

Loads dropped DLL 4 IoCs

Processes:

6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe

pid	process
1660	6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe
1660	6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe
1660	6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe
1660	6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RIP crack dragonjin = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

._cache_6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe

description	pid	process	target process
PID 1524 set thread context of 1152	1524	._cache_6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe	iexplore.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

EXCEL.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE

Modifies registry class 64 IoCs

Processes:

EXCEL.EXE

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1176 EXCEL.EXE

pid	process
1176	EXCEL.EXE

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

._cache_6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exeiexplore.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1524	._cache_6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe
Token: SeSecurityPrivilege	1524	._cache_6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe
Token: SeTakeOwnershipPrivilege	1524	._cache_6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe
Token: SeLoadDriverPrivilege	1524	._cache_6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe
Token: SeSystemProfilePrivilege	1524	._cache_6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe
Token: SeSystemtimePrivilege	1524	._cache_6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe
Token: SeProfSingleProcessPrivilege	1524	._cache_6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe
Token: SeIncBasePriorityPrivilege	1524	._cache_6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe
Token: SeCreatePagefilePrivilege	1524	._cache_6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe
Token: SeBackupPrivilege	1524	._cache_6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe
Token: SeRestorePrivilege	1524	._cache_6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe
Token: SeShutdownPrivilege	1524	._cache_6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe
Token: SeDebugPrivilege	1524	._cache_6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe
Token: SeSystemEnvironmentPrivilege	1524	._cache_6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe
Token: SeChangeNotifyPrivilege	1524	._cache_6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe
Token: SeRemoteShutdownPrivilege	1524	._cache_6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe
Token: SeUndockPrivilege	1524	._cache_6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe
Token: SeManageVolumePrivilege	1524	._cache_6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe
Token: SeImpersonatePrivilege	1524	._cache_6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe
Token: SeCreateGlobalPrivilege	1524	._cache_6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe
Token: 33	1524	._cache_6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe
Token: 34	1524	._cache_6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe
Token: 35	1524	._cache_6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe
Token: SeIncreaseQuotaPrivilege	1152	iexplore.exe
Token: SeSecurityPrivilege	1152	iexplore.exe
Token: SeTakeOwnershipPrivilege	1152	iexplore.exe
Token: SeLoadDriverPrivilege	1152	iexplore.exe
Token: SeSystemProfilePrivilege	1152	iexplore.exe
Token: SeSystemtimePrivilege	1152	iexplore.exe
Token: SeProfSingleProcessPrivilege	1152	iexplore.exe
Token: SeIncBasePriorityPrivilege	1152	iexplore.exe
Token: SeCreatePagefilePrivilege	1152	iexplore.exe
Token: SeBackupPrivilege	1152	iexplore.exe
Token: SeRestorePrivilege	1152	iexplore.exe
Token: SeShutdownPrivilege	1152	iexplore.exe
Token: SeDebugPrivilege	1152	iexplore.exe
Token: SeSystemEnvironmentPrivilege	1152	iexplore.exe
Token: SeChangeNotifyPrivilege	1152	iexplore.exe
Token: SeRemoteShutdownPrivilege	1152	iexplore.exe
Token: SeUndockPrivilege	1152	iexplore.exe
Token: SeManageVolumePrivilege	1152	iexplore.exe
Token: SeImpersonatePrivilege	1152	iexplore.exe
Token: SeCreateGlobalPrivilege	1152	iexplore.exe
Token: 33	1152	iexplore.exe
Token: 34	1152	iexplore.exe
Token: 35	1152	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

iexplore.exeEXCEL.EXE

pid process

1152 iexplore.exe
1176 EXCEL.EXE

pid	process
1152	iexplore.exe
1176	EXCEL.EXE

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe._cache_6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe

description	pid	process	target process
PID 1660 wrote to memory of 1524	1660	6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe	._cache_6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe
PID 1660 wrote to memory of 1524	1660	6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe	._cache_6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe
PID 1660 wrote to memory of 1524	1660	6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe	._cache_6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe
PID 1660 wrote to memory of 1524	1660	6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe	._cache_6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe
PID 1660 wrote to memory of 336	1660	6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe	Synaptics.exe
PID 1660 wrote to memory of 336	1660	6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe	Synaptics.exe
PID 1660 wrote to memory of 336	1660	6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe	Synaptics.exe
PID 1660 wrote to memory of 336	1660	6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe	Synaptics.exe
PID 1524 wrote to memory of 1152	1524	._cache_6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe	iexplore.exe
PID 1524 wrote to memory of 1152	1524	._cache_6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe	iexplore.exe
PID 1524 wrote to memory of 1152	1524	._cache_6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe	iexplore.exe
PID 1524 wrote to memory of 1152	1524	._cache_6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe	iexplore.exe
PID 1524 wrote to memory of 1152	1524	._cache_6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe	iexplore.exe
PID 1524 wrote to memory of 1152	1524	._cache_6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe	iexplore.exe

C:\Users\Admin\AppData\Local\Temp\6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe
"C:\Users\Admin\AppData\Local\Temp\6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1660

C:\Users\Admin\AppData\Local\Temp\._cache_6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe
"C:\Users\Admin\AppData\Local\Temp\._cache_6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1524

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1152

C:\ProgramData\Synaptics\Synaptics.exe
"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
2⤵
- Executes dropped EXE
PID:336

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1176

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe
Filesize
939KB

MD5
98d222f9a9fca39bab9d912ed68aeffd

SHA1
76ff31de379f20edb7f6c7f2564aefc6c567870a

SHA256
5d302d9a9667d9bf513f4d8ef3fabddcd51a55b57e6e8ad8b9420ed8a7dfaa84

SHA512
62e70ea31737cf89aa0baadc04549ea53e427a558224c00159b065676b2eb698bd72b3fe8b1d7a44c60735806693b0baece26d37a199f54badd1a6ea9edc4998

Download Submit
C:\ProgramData\Synaptics\Synaptics.exe
Filesize
939KB

MD5
98d222f9a9fca39bab9d912ed68aeffd

SHA1
76ff31de379f20edb7f6c7f2564aefc6c567870a

SHA256
5d302d9a9667d9bf513f4d8ef3fabddcd51a55b57e6e8ad8b9420ed8a7dfaa84

SHA512
62e70ea31737cf89aa0baadc04549ea53e427a558224c00159b065676b2eb698bd72b3fe8b1d7a44c60735806693b0baece26d37a199f54badd1a6ea9edc4998

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe
Filesize
658KB

MD5
1a35d962d2a525e0fddf7759dc427ac3

SHA1
458b85dcdaf3f8519d53d79e45d110e15e61213e

SHA256
e35a989e764b96036d184eed4e97c193bb36a709b28971f34d6415ac63472511

SHA512
e813a29a4bc511c6479ca3e8a6b34404779a22ff09f79b4069b4b45c5f402e471d629fd078ca893f441f1808e0c0d52d264f7a155b3aaebec15396ba42fdd19a

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe
Filesize
658KB

MD5
1a35d962d2a525e0fddf7759dc427ac3

SHA1
458b85dcdaf3f8519d53d79e45d110e15e61213e

SHA256
e35a989e764b96036d184eed4e97c193bb36a709b28971f34d6415ac63472511

SHA512
e813a29a4bc511c6479ca3e8a6b34404779a22ff09f79b4069b4b45c5f402e471d629fd078ca893f441f1808e0c0d52d264f7a155b3aaebec15396ba42fdd19a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Xar14Egv.xlsm
Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
\ProgramData\Synaptics\Synaptics.exe
Filesize
939KB

MD5
98d222f9a9fca39bab9d912ed68aeffd

SHA1
76ff31de379f20edb7f6c7f2564aefc6c567870a

SHA256
5d302d9a9667d9bf513f4d8ef3fabddcd51a55b57e6e8ad8b9420ed8a7dfaa84

SHA512
62e70ea31737cf89aa0baadc04549ea53e427a558224c00159b065676b2eb698bd72b3fe8b1d7a44c60735806693b0baece26d37a199f54badd1a6ea9edc4998

Download Submit
\ProgramData\Synaptics\Synaptics.exe
Filesize
939KB

MD5
98d222f9a9fca39bab9d912ed68aeffd

SHA1
76ff31de379f20edb7f6c7f2564aefc6c567870a

SHA256
5d302d9a9667d9bf513f4d8ef3fabddcd51a55b57e6e8ad8b9420ed8a7dfaa84

SHA512
62e70ea31737cf89aa0baadc04549ea53e427a558224c00159b065676b2eb698bd72b3fe8b1d7a44c60735806693b0baece26d37a199f54badd1a6ea9edc4998

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe
Filesize
658KB

MD5
1a35d962d2a525e0fddf7759dc427ac3

SHA1
458b85dcdaf3f8519d53d79e45d110e15e61213e

SHA256
e35a989e764b96036d184eed4e97c193bb36a709b28971f34d6415ac63472511

SHA512
e813a29a4bc511c6479ca3e8a6b34404779a22ff09f79b4069b4b45c5f402e471d629fd078ca893f441f1808e0c0d52d264f7a155b3aaebec15396ba42fdd19a

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_6d1a5fa7760661ff4862aa01fc461f5e8260b290b1e97dc33eede2a3d9b66175.exe
Filesize
658KB

MD5
1a35d962d2a525e0fddf7759dc427ac3

SHA1
458b85dcdaf3f8519d53d79e45d110e15e61213e

SHA256
e35a989e764b96036d184eed4e97c193bb36a709b28971f34d6415ac63472511

SHA512
e813a29a4bc511c6479ca3e8a6b34404779a22ff09f79b4069b4b45c5f402e471d629fd078ca893f441f1808e0c0d52d264f7a155b3aaebec15396ba42fdd19a

Download Submit
memory/336-62-0x0000000000000000-mapping.dmp

Download
memory/1176-66-0x000000002F851000-0x000000002F854000-memory.dmp

Filesize
12KB

Download
memory/1176-67-0x0000000071B91000-0x0000000071B93000-memory.dmp

Filesize
8KB

Download
memory/1176-68-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1176-69-0x0000000072B7D000-0x0000000072B88000-memory.dmp

Filesize
44KB

Download
memory/1524-57-0x0000000000000000-mapping.dmp

Download
memory/1660-54-0x0000000075F21000-0x0000000075F23000-memory.dmp

Filesize
8KB

Download