Analysis
-
max time kernel
71s -
max time network
74s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
-
submitted
01-10-2022 04:40
General
-
Target
Synapse Launcher.exe
-
Size
787KB
-
MD5
154e1239c1bb0e04b18f27aabffcd6e7
-
SHA1
0c72c4db91b8ae7e10271aece8db7efb5271f8ec
-
SHA256
93fc4441b3648a74d3bc72cc5f34ced564ceca74a5e560961178b42a6c8416b0
-
SHA512
52d4b91f4610a53ad41e0c73d129b218551ebb70e2162e1c268d84030dc77bc5411926a15fa44ba62f1a93e1c757287c842a217ea25602fac0db157742ee2a05
-
SSDEEP
6144:ARv5ZcPe5q67ue+MNhH0X4wz2HA/z0OqysLAilL2hJO5Hp2y9z89S49htWZ1BXtx:ARv5OIbhH0IwzyE8LyspL9z89x+zHFi
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Loads dropped DLL 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Synapse Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Synapse Launcher.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bin\NAUDxdf.bin"bin\NAUDxdf.bin"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bin\YtsAs.exe"bin\YtsAs.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5ab7ab99485c5fc2bceaae1050613761b
SHA10a28b44687d71f4d1caaf430b6b31b6f799d21c8
SHA256e82f550c965fdbb7429804008461311b53baf9b0bf2436c0b391665ea2bc4ad4
SHA5124061996c11e22fafa4d4be7b47aedc28f38fc410c84c274b24d5170f42a99240043ee4aa58d12ac4894ed1ef72a4f5eea539aac3e0875170de01b51b09ba4972
-
Filesize
2.1MB
MD5ab7ab99485c5fc2bceaae1050613761b
SHA10a28b44687d71f4d1caaf430b6b31b6f799d21c8
SHA256e82f550c965fdbb7429804008461311b53baf9b0bf2436c0b391665ea2bc4ad4
SHA5124061996c11e22fafa4d4be7b47aedc28f38fc410c84c274b24d5170f42a99240043ee4aa58d12ac4894ed1ef72a4f5eea539aac3e0875170de01b51b09ba4972
-
Filesize
6.0MB
MD59b248dfff1d2b73fd639324741fe2e08
SHA1e82684cd6858a6712eff69ace1707b3bcd464105
SHA25639943c30732988289ca346902f007a72124bd98b82e08b0b9739241cdab4018e
SHA51256784a895f113088e3c92ccd96f354473e5d849fb9d0798868ff5e9477f60854e8bc7c9759c63417c9298f8702abab266722439b445977c6e940da393b8b696c
-
Filesize
6.0MB
MD59b248dfff1d2b73fd639324741fe2e08
SHA1e82684cd6858a6712eff69ace1707b3bcd464105
SHA25639943c30732988289ca346902f007a72124bd98b82e08b0b9739241cdab4018e
SHA51256784a895f113088e3c92ccd96f354473e5d849fb9d0798868ff5e9477f60854e8bc7c9759c63417c9298f8702abab266722439b445977c6e940da393b8b696c
-
Filesize
2.1MB
MD5ab7ab99485c5fc2bceaae1050613761b
SHA10a28b44687d71f4d1caaf430b6b31b6f799d21c8
SHA256e82f550c965fdbb7429804008461311b53baf9b0bf2436c0b391665ea2bc4ad4
SHA5124061996c11e22fafa4d4be7b47aedc28f38fc410c84c274b24d5170f42a99240043ee4aa58d12ac4894ed1ef72a4f5eea539aac3e0875170de01b51b09ba4972
-
Filesize
2.1MB
MD5ab7ab99485c5fc2bceaae1050613761b
SHA10a28b44687d71f4d1caaf430b6b31b6f799d21c8
SHA256e82f550c965fdbb7429804008461311b53baf9b0bf2436c0b391665ea2bc4ad4
SHA5124061996c11e22fafa4d4be7b47aedc28f38fc410c84c274b24d5170f42a99240043ee4aa58d12ac4894ed1ef72a4f5eea539aac3e0875170de01b51b09ba4972
-
Filesize
6.0MB
MD59b248dfff1d2b73fd639324741fe2e08
SHA1e82684cd6858a6712eff69ace1707b3bcd464105
SHA25639943c30732988289ca346902f007a72124bd98b82e08b0b9739241cdab4018e
SHA51256784a895f113088e3c92ccd96f354473e5d849fb9d0798868ff5e9477f60854e8bc7c9759c63417c9298f8702abab266722439b445977c6e940da393b8b696c
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
808KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
584KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
5.0MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
672KB
-
Filesize
136KB
-
Filesize
3.3MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
2.1MB
-
Filesize
15.1MB
-
Filesize
15.1MB
-
Filesize
15.1MB
-
Filesize
32KB
-
Filesize
15.1MB
-
Filesize
15.1MB
-
Filesize
224KB
-
Filesize
704KB
-
Filesize
3.3MB
-
Filesize
15.1MB
-
Filesize
320KB
-
Filesize
72KB
-
Filesize
15.1MB
-
Filesize
15.1MB
-
Filesize
15.1MB
-
Filesize
15.1MB
-
Filesize
15.1MB
-
Filesize
208KB
-
Filesize
15.1MB
-
Filesize
15.1MB
-
Filesize
15.1MB
-
Filesize
15.1MB
-
Filesize
5.2MB
-
Filesize
15.1MB
-
Filesize
15.1MB
-
Filesize
15.1MB
-
Filesize
15.1MB
-
Filesize
15.1MB
-
Filesize
15.1MB
-
Filesize
15.1MB
-
Filesize
15.1MB
-
Filesize
15.1MB