Analysis
-
max time kernel
67s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/11/2022, 15:56
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/AimbotPro2/SynapseXCrack/blob/main/Synapse%20X%20Crack/Synapse%20Launcher.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
https://github.com/AimbotPro2/SynapseXCrack/blob/main/Synapse%20X%20Crack/Synapse%20Launcher.exe
Resource
win10v2004-20220812-en
General
-
Target
https://github.com/AimbotPro2/SynapseXCrack/blob/main/Synapse%20X%20Crack/Synapse%20Launcher.exe
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
pid Process 1044 Synapse Launcher.exe 876 Synapse Launcher.exe 1244 Process not Found -
Loads dropped DLL 2 IoCs
pid Process 1896 iexplore.exe 876 Synapse Launcher.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PhishingFilter iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 202a8f4da5efd801 iexplore.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062e6ef0d45f4454ab79548c962d74cdf000000000200000000001066000000010000200000000bf41af91247be69499f7cb789ce37add69e8f48d4bf04d0d8fe1e47b05bd3c3000000000e8000000002000020000000a66ad1879751dcf5c89582f7ca505c54bdf337b45b74b96f42c1c0d9004d036720000000d0b47edbf7e2d5b274583d912aa187c3b7f18860de5e063ce263ef3bfd93e94c4000000005af01d3213abb03395552ede3051af829f2f0a7912be570f978cb60917facb464aaf93b357876b5f1b23f35a661578542cc8e4da2c0613184db0f6cfad7e780 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "374259580" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7F346451-5B98-11ED-9172-7ADD0904B6AC} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c02c585aa5efd801 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062e6ef0d45f4454ab79548c962d74cdf000000000200000000001066000000010000200000005c58c1690e470d197829df2d6bae468883d747b1b59ad3d87b87af2be929e9df000000000e80000000020000200000001e477641c8cb006acac434508575a16d79acb95aec7b2f6f7119c484f7482d5190000000f6f9775310d01a938679397b0fc95337f473cf41d96ff463c8fc8b9d15690488337c4aef8377dc9e4665feeaf4916f0058a391bfc0dba7f1f64eefdc479529b5d89e153ff4065c352051af65dc479c17fb0afa92ee07c3f8dc8b6a06f36ba6cc5794c44d398ea8925b6431b3b3f83017d9c676be3266957603c45682aadccec91ccd3d211ec05a11eb4ba42e1d441a14400000004cd6f5a1a6d56477440b7c869fbe6f5d49c785325483d629e68204b088681c69e369645668e3bbc298b0de35da02240a0f28958acc18f968fbf7d0b9f8fdb6c3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1896 iexplore.exe 1896 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1896 iexplore.exe 1896 iexplore.exe 1348 IEXPLORE.EXE 1348 IEXPLORE.EXE 1348 IEXPLORE.EXE 1348 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1896 wrote to memory of 1348 1896 iexplore.exe 29 PID 1896 wrote to memory of 1348 1896 iexplore.exe 29 PID 1896 wrote to memory of 1348 1896 iexplore.exe 29 PID 1896 wrote to memory of 1348 1896 iexplore.exe 29 PID 1896 wrote to memory of 1044 1896 iexplore.exe 31 PID 1896 wrote to memory of 1044 1896 iexplore.exe 31 PID 1896 wrote to memory of 1044 1896 iexplore.exe 31 PID 1044 wrote to memory of 876 1044 Synapse Launcher.exe 32 PID 1044 wrote to memory of 876 1044 Synapse Launcher.exe 32 PID 1044 wrote to memory of 876 1044 Synapse Launcher.exe 32
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://github.com/AimbotPro2/SynapseXCrack/blob/main/Synapse%20X%20Crack/Synapse%20Launcher.exe1⤵
- Loads dropped DLL
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1896 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1348
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6ORS647J\Synapse Launcher.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6ORS647J\Synapse Launcher.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6ORS647J\Synapse Launcher.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6ORS647J\Synapse Launcher.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:876
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize340B
MD51ef80bfff3703148c179b918ec467e76
SHA136f8b0d80cc6015df327e15125e8531a428d6881
SHA256a80b642ff08f11d9bd176cc240c1a7fdb4ce5309c5114949901b05e1bd1210de
SHA51211faefa7791eae3550f04daf132a52a372ffd2ecb11734fdc79efbecd6b55e61836300648c73756775f6f179ee001574f75c9c5387a5d22d1465f33a77400cdb
-
Filesize
5KB
MD57ec0c9d246310963bb304444a2e625ac
SHA1b22f80e2da9f89ab7f8ff0ad9b4b8c4d9f5139f8
SHA25664bb61cc82643c66b2d93b024ffe41b5eba09f919929855df3232309498439d0
SHA512b093d50187c191b36ae60ef8380bc38fd59c1cbe6a99cdfa24c899d0fcaeb8f5325fa2d4457451bf6b8609ed70b713c135c6fc2bb8f95d268e6c98dd4ebaf3aa
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6ORS647J\Synapse Launcher.exe
Filesize7.5MB
MD5ba3dfb5265c82c5ec9cd1e51c5f1ffaf
SHA186027debeb3ab05bfcd545079b4e993f54fcf354
SHA256ed7cd2476a127d79b8f4a39c238b21442e3a5938627e4e815b0e681188afe6d4
SHA512e8cae5c12df349517b1e12a18fb9ef2edf56d3bffb155fcff4531865182ba78fa7d59a670e61decc694dca6a2bd2b756a3d8cec040d0ea96279861cfa8870444
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6ORS647J\Synapse Launcher.exe
Filesize7.5MB
MD5ba3dfb5265c82c5ec9cd1e51c5f1ffaf
SHA186027debeb3ab05bfcd545079b4e993f54fcf354
SHA256ed7cd2476a127d79b8f4a39c238b21442e3a5938627e4e815b0e681188afe6d4
SHA512e8cae5c12df349517b1e12a18fb9ef2edf56d3bffb155fcff4531865182ba78fa7d59a670e61decc694dca6a2bd2b756a3d8cec040d0ea96279861cfa8870444
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6ORS647J\Synapse Launcher.exe.qkx5do4.partial
Filesize7.5MB
MD5ba3dfb5265c82c5ec9cd1e51c5f1ffaf
SHA186027debeb3ab05bfcd545079b4e993f54fcf354
SHA256ed7cd2476a127d79b8f4a39c238b21442e3a5938627e4e815b0e681188afe6d4
SHA512e8cae5c12df349517b1e12a18fb9ef2edf56d3bffb155fcff4531865182ba78fa7d59a670e61decc694dca6a2bd2b756a3d8cec040d0ea96279861cfa8870444
-
Filesize
1.4MB
MD544f69298cbea9f2482b74d5ad1007293
SHA1f56d9b7394398173546245dddb668d4253eb9016
SHA256f7e9f9ec45f2dd104e9fb0802d0ced5e45e23227c3d0626e177ab0de893b7eca
SHA512cb60c39c618bfdf16c07a044623f9cc5369b27f17ef6b26526ea8de87d99583274122360e125e5d2c493127b2430440ffd8509271abcbdc4cc3f658b69155f25
-
Filesize
608B
MD51db83571834052183186e89df31c7279
SHA1dd4ce3bd9ec9d00dcace46f1e5bac27a30f69f56
SHA25689d02dbc8bf01c1ef069a1858b07e4f75b208931b3462145c358aeb973687b8f
SHA512399902bb46f52eb5a33066acbd47500c2f487539adfd98e686c1233d5a97cc82f05b504393160b422688d9d75dbe1a258c9233e937ba7a0872c76fd1db043cc5
-
\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6ORS647J\Synapse Launcher.exe
Filesize7.5MB
MD5ba3dfb5265c82c5ec9cd1e51c5f1ffaf
SHA186027debeb3ab05bfcd545079b4e993f54fcf354
SHA256ed7cd2476a127d79b8f4a39c238b21442e3a5938627e4e815b0e681188afe6d4
SHA512e8cae5c12df349517b1e12a18fb9ef2edf56d3bffb155fcff4531865182ba78fa7d59a670e61decc694dca6a2bd2b756a3d8cec040d0ea96279861cfa8870444
-
\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6ORS647J\Synapse Launcher.exe
Filesize7.5MB
MD5ba3dfb5265c82c5ec9cd1e51c5f1ffaf
SHA186027debeb3ab05bfcd545079b4e993f54fcf354
SHA256ed7cd2476a127d79b8f4a39c238b21442e3a5938627e4e815b0e681188afe6d4
SHA512e8cae5c12df349517b1e12a18fb9ef2edf56d3bffb155fcff4531865182ba78fa7d59a670e61decc694dca6a2bd2b756a3d8cec040d0ea96279861cfa8870444
-
Filesize
1.4MB
MD544f69298cbea9f2482b74d5ad1007293
SHA1f56d9b7394398173546245dddb668d4253eb9016
SHA256f7e9f9ec45f2dd104e9fb0802d0ced5e45e23227c3d0626e177ab0de893b7eca
SHA512cb60c39c618bfdf16c07a044623f9cc5369b27f17ef6b26526ea8de87d99583274122360e125e5d2c493127b2430440ffd8509271abcbdc4cc3f658b69155f25