Analysis
-
max time kernel
163s -
max time network
175s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
19/10/2022, 13:36
Static task
static1
Behavioral task
behavioral1
Sample
d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe
Resource
win7-20220901-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe
-
Size
109KB
-
MD5
91fc9acf0f5730d67d06bed1032a5b79
-
SHA1
1af80a5d9448e8e784e8d2c944ed2d061ab1c81a
-
SHA256
d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab
-
SHA512
670f8c3f60a6b09467b96b3959522a164cfa06e466bc5095bf545dd52cf34297e6f07d9fc24d841188271f01327908d072e21189545466da0740e6e97de63afe
-
SSDEEP
1536:+go7juQSvUfAMrD/NCPZXOecFoJeMWN4yi6vW36nAzhj9hJeCp0PiWgL:+ljuOIM1SZ+ecsmZC6KJ6qWgL
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe:*:Enabled:Syncronics" d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe -
Executes dropped EXE 2 IoCs
pid Process 116 syntchercui.exe 3520 syntchercui.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 176 netsh.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Syncronics = "syntchercui.exe" d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4868 set thread context of 1436 4868 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 84 PID 116 set thread context of 3520 116 syntchercui.exe 89 -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\syntchercui.exe syntchercui.exe File created C:\Windows\syntchercui.exe d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe File opened for modification C:\Windows\syntchercui.exe d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4868 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 116 syntchercui.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 4868 wrote to memory of 1436 4868 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 84 PID 4868 wrote to memory of 1436 4868 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 84 PID 4868 wrote to memory of 1436 4868 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 84 PID 4868 wrote to memory of 1436 4868 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 84 PID 4868 wrote to memory of 1436 4868 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 84 PID 4868 wrote to memory of 1436 4868 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 84 PID 4868 wrote to memory of 1436 4868 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 84 PID 4868 wrote to memory of 1436 4868 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 84 PID 4868 wrote to memory of 1436 4868 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 84 PID 1436 wrote to memory of 176 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 87 PID 1436 wrote to memory of 176 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 87 PID 1436 wrote to memory of 176 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 87 PID 1436 wrote to memory of 116 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 88 PID 1436 wrote to memory of 116 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 88 PID 1436 wrote to memory of 116 1436 d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe 88 PID 116 wrote to memory of 3520 116 syntchercui.exe 89 PID 116 wrote to memory of 3520 116 syntchercui.exe 89 PID 116 wrote to memory of 3520 116 syntchercui.exe 89 PID 116 wrote to memory of 3520 116 syntchercui.exe 89 PID 116 wrote to memory of 3520 116 syntchercui.exe 89 PID 116 wrote to memory of 3520 116 syntchercui.exe 89 PID 116 wrote to memory of 3520 116 syntchercui.exe 89 PID 116 wrote to memory of 3520 116 syntchercui.exe 89 PID 116 wrote to memory of 3520 116 syntchercui.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe"C:\Users\Admin\AppData\Local\Temp\d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exeC:\Users\Admin\AppData\Local\Temp\d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab.exe2⤵
- Modifies firewall policy service
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram syntchercui.exe 1 ENABLE3⤵
- Modifies Windows Firewall
PID:176
-
-
C:\Windows\syntchercui.exe"C:\Windows\syntchercui.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Windows\syntchercui.exeC:\Windows\syntchercui.exe4⤵
- Executes dropped EXE
PID:3520
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
109KB
MD591fc9acf0f5730d67d06bed1032a5b79
SHA11af80a5d9448e8e784e8d2c944ed2d061ab1c81a
SHA256d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab
SHA512670f8c3f60a6b09467b96b3959522a164cfa06e466bc5095bf545dd52cf34297e6f07d9fc24d841188271f01327908d072e21189545466da0740e6e97de63afe
-
Filesize
109KB
MD591fc9acf0f5730d67d06bed1032a5b79
SHA11af80a5d9448e8e784e8d2c944ed2d061ab1c81a
SHA256d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab
SHA512670f8c3f60a6b09467b96b3959522a164cfa06e466bc5095bf545dd52cf34297e6f07d9fc24d841188271f01327908d072e21189545466da0740e6e97de63afe
-
Filesize
109KB
MD591fc9acf0f5730d67d06bed1032a5b79
SHA11af80a5d9448e8e784e8d2c944ed2d061ab1c81a
SHA256d8b51f952b6ff2d51dca5edfb02098825ac475bf1f46988548284bf8d3637aab
SHA512670f8c3f60a6b09467b96b3959522a164cfa06e466bc5095bf545dd52cf34297e6f07d9fc24d841188271f01327908d072e21189545466da0740e6e97de63afe