Analysis
-
max time kernel
146s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
20-03-2023 09:22
Static task
static1
Behavioral task
behavioral1
Sample
BlitzedGrabberV12.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
BlitzedGrabberV12.exe
Resource
win10v2004-20230220-en
General
-
Target
BlitzedGrabberV12.exe
-
Size
2.6MB
-
MD5
7e8af75409c8c12e267b3011320cb4e6
-
SHA1
d0b90d69b340c0eb2f37a4945b894a20467dd132
-
SHA256
729c2c5ba395ea043061650dae5c184c10ad288bf0b458dbb30f4837e8b25e9e
-
SHA512
440ed601073dcfa9a76b4b5693c5ad0790cd5093f8d8c6dc28275cb7146f2d98e95575d5b05bed402c47b10cbe3d98b0eec49036e9de847182ccc3c386f76e17
-
SSDEEP
49152:8nsHyjtk2MYC5GDQmAznU4n9t2ELj18p4BDifoM83ig9Apl14yGN:8nsmtk2au49wi73fWcb
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
._cache_BlitzedGrabberV12.exeSynaptics.exe._cache_Synaptics.exepid process 756 ._cache_BlitzedGrabberV12.exe 1464 Synaptics.exe 1460 ._cache_Synaptics.exe -
Loads dropped DLL 11 IoCs
Processes:
BlitzedGrabberV12.exeSynaptics.exe._cache_BlitzedGrabberV12.exeWerFault.exepid process 1476 BlitzedGrabberV12.exe 1476 BlitzedGrabberV12.exe 1476 BlitzedGrabberV12.exe 1464 Synaptics.exe 1464 Synaptics.exe 756 ._cache_BlitzedGrabberV12.exe 1172 WerFault.exe 1172 WerFault.exe 1172 WerFault.exe 1172 WerFault.exe 1172 WerFault.exe -
Obfuscated with Agile.Net obfuscator 3 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral1/memory/1460-94-0x00000000052D0000-0x00000000054C2000-memory.dmp agile_net behavioral1/memory/756-104-0x0000000005070000-0x000000000525E000-memory.dmp agile_net behavioral1/memory/756-105-0x0000000005070000-0x000000000525E000-memory.dmp agile_net -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
BlitzedGrabberV12.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" BlitzedGrabberV12.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1172 1460 WerFault.exe ._cache_Synaptics.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE -
Modifies registry class 64 IoCs
Processes:
EXCEL.EXEdescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1604 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
EXCEL.EXEpid process 1604 EXCEL.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
BlitzedGrabberV12.exeSynaptics.exe._cache_Synaptics.exedescription pid process target process PID 1476 wrote to memory of 756 1476 BlitzedGrabberV12.exe ._cache_BlitzedGrabberV12.exe PID 1476 wrote to memory of 756 1476 BlitzedGrabberV12.exe ._cache_BlitzedGrabberV12.exe PID 1476 wrote to memory of 756 1476 BlitzedGrabberV12.exe ._cache_BlitzedGrabberV12.exe PID 1476 wrote to memory of 756 1476 BlitzedGrabberV12.exe ._cache_BlitzedGrabberV12.exe PID 1476 wrote to memory of 1464 1476 BlitzedGrabberV12.exe Synaptics.exe PID 1476 wrote to memory of 1464 1476 BlitzedGrabberV12.exe Synaptics.exe PID 1476 wrote to memory of 1464 1476 BlitzedGrabberV12.exe Synaptics.exe PID 1476 wrote to memory of 1464 1476 BlitzedGrabberV12.exe Synaptics.exe PID 1464 wrote to memory of 1460 1464 Synaptics.exe ._cache_Synaptics.exe PID 1464 wrote to memory of 1460 1464 Synaptics.exe ._cache_Synaptics.exe PID 1464 wrote to memory of 1460 1464 Synaptics.exe ._cache_Synaptics.exe PID 1464 wrote to memory of 1460 1464 Synaptics.exe ._cache_Synaptics.exe PID 1460 wrote to memory of 1172 1460 ._cache_Synaptics.exe WerFault.exe PID 1460 wrote to memory of 1172 1460 ._cache_Synaptics.exe WerFault.exe PID 1460 wrote to memory of 1172 1460 ._cache_Synaptics.exe WerFault.exe PID 1460 wrote to memory of 1172 1460 ._cache_Synaptics.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_BlitzedGrabberV12.exe"C:\Users\Admin\AppData\Local\Temp\._cache_BlitzedGrabberV12.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 6564⤵
- Loads dropped DLL
- Program crash
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Synaptics\Synaptics.exeFilesize
2.6MB
MD57e8af75409c8c12e267b3011320cb4e6
SHA1d0b90d69b340c0eb2f37a4945b894a20467dd132
SHA256729c2c5ba395ea043061650dae5c184c10ad288bf0b458dbb30f4837e8b25e9e
SHA512440ed601073dcfa9a76b4b5693c5ad0790cd5093f8d8c6dc28275cb7146f2d98e95575d5b05bed402c47b10cbe3d98b0eec49036e9de847182ccc3c386f76e17
-
C:\ProgramData\Synaptics\Synaptics.exeFilesize
2.6MB
MD57e8af75409c8c12e267b3011320cb4e6
SHA1d0b90d69b340c0eb2f37a4945b894a20467dd132
SHA256729c2c5ba395ea043061650dae5c184c10ad288bf0b458dbb30f4837e8b25e9e
SHA512440ed601073dcfa9a76b4b5693c5ad0790cd5093f8d8c6dc28275cb7146f2d98e95575d5b05bed402c47b10cbe3d98b0eec49036e9de847182ccc3c386f76e17
-
C:\ProgramData\Synaptics\Synaptics.exeFilesize
2.6MB
MD57e8af75409c8c12e267b3011320cb4e6
SHA1d0b90d69b340c0eb2f37a4945b894a20467dd132
SHA256729c2c5ba395ea043061650dae5c184c10ad288bf0b458dbb30f4837e8b25e9e
SHA512440ed601073dcfa9a76b4b5693c5ad0790cd5093f8d8c6dc28275cb7146f2d98e95575d5b05bed402c47b10cbe3d98b0eec49036e9de847182ccc3c386f76e17
-
C:\Users\Admin\AppData\Local\Temp\._cache_BlitzedGrabberV12.exeFilesize
1.9MB
MD5006cd7ac7f04dfecdb6c58c9e380aca0
SHA1fd06e16fd731dacb516a945a6cb619b30ecf7ff4
SHA256b0ec85887a9ad75110914916ab2a2d45487e4b65713d4272c050430d80665e64
SHA51247014779312ec5d9481a3c2c97d7e48884e8f61b7a03ee980c2b40fb9e32cfa078554abc45b67d04f6786d2013b0cec0d8be700bda150990f7c44dc6469bef09
-
C:\Users\Admin\AppData\Local\Temp\._cache_BlitzedGrabberV12.exeFilesize
1.9MB
MD5006cd7ac7f04dfecdb6c58c9e380aca0
SHA1fd06e16fd731dacb516a945a6cb619b30ecf7ff4
SHA256b0ec85887a9ad75110914916ab2a2d45487e4b65713d4272c050430d80665e64
SHA51247014779312ec5d9481a3c2c97d7e48884e8f61b7a03ee980c2b40fb9e32cfa078554abc45b67d04f6786d2013b0cec0d8be700bda150990f7c44dc6469bef09
-
C:\Users\Admin\AppData\Local\Temp\._cache_BlitzedGrabberV12.exeFilesize
1.9MB
MD5006cd7ac7f04dfecdb6c58c9e380aca0
SHA1fd06e16fd731dacb516a945a6cb619b30ecf7ff4
SHA256b0ec85887a9ad75110914916ab2a2d45487e4b65713d4272c050430d80665e64
SHA51247014779312ec5d9481a3c2c97d7e48884e8f61b7a03ee980c2b40fb9e32cfa078554abc45b67d04f6786d2013b0cec0d8be700bda150990f7c44dc6469bef09
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exeFilesize
1.9MB
MD5006cd7ac7f04dfecdb6c58c9e380aca0
SHA1fd06e16fd731dacb516a945a6cb619b30ecf7ff4
SHA256b0ec85887a9ad75110914916ab2a2d45487e4b65713d4272c050430d80665e64
SHA51247014779312ec5d9481a3c2c97d7e48884e8f61b7a03ee980c2b40fb9e32cfa078554abc45b67d04f6786d2013b0cec0d8be700bda150990f7c44dc6469bef09
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exeFilesize
1.9MB
MD5006cd7ac7f04dfecdb6c58c9e380aca0
SHA1fd06e16fd731dacb516a945a6cb619b30ecf7ff4
SHA256b0ec85887a9ad75110914916ab2a2d45487e4b65713d4272c050430d80665e64
SHA51247014779312ec5d9481a3c2c97d7e48884e8f61b7a03ee980c2b40fb9e32cfa078554abc45b67d04f6786d2013b0cec0d8be700bda150990f7c44dc6469bef09
-
C:\Users\Admin\AppData\Local\Temp\a9ErvxNq.xlsmFilesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
C:\Users\Admin\AppData\Local\Temp\dcfb00f9-5ae7-4197-ba59-e48107e40d35\GunaDotNetRT.dllFilesize
136KB
MD59af5eb006bb0bab7f226272d82c896c7
SHA1c2a5bb42a5f08f4dc821be374b700652262308f0
SHA25677dc05a6bda90757f66552ee3f469b09f1e00732b4edca0f542872fb591ed9db
SHA5127badd41be4c1039302fda9bba19d374ec9446ce24b7db33b66bee4ef38180d1abcd666d2aea468e7e452aa1e1565eedfefed582bf1c2fe477a4171d99d48772a
-
\ProgramData\Synaptics\Synaptics.exeFilesize
2.6MB
MD57e8af75409c8c12e267b3011320cb4e6
SHA1d0b90d69b340c0eb2f37a4945b894a20467dd132
SHA256729c2c5ba395ea043061650dae5c184c10ad288bf0b458dbb30f4837e8b25e9e
SHA512440ed601073dcfa9a76b4b5693c5ad0790cd5093f8d8c6dc28275cb7146f2d98e95575d5b05bed402c47b10cbe3d98b0eec49036e9de847182ccc3c386f76e17
-
\ProgramData\Synaptics\Synaptics.exeFilesize
2.6MB
MD57e8af75409c8c12e267b3011320cb4e6
SHA1d0b90d69b340c0eb2f37a4945b894a20467dd132
SHA256729c2c5ba395ea043061650dae5c184c10ad288bf0b458dbb30f4837e8b25e9e
SHA512440ed601073dcfa9a76b4b5693c5ad0790cd5093f8d8c6dc28275cb7146f2d98e95575d5b05bed402c47b10cbe3d98b0eec49036e9de847182ccc3c386f76e17
-
\ProgramData\Synaptics\Synaptics.exeFilesize
2.6MB
MD57e8af75409c8c12e267b3011320cb4e6
SHA1d0b90d69b340c0eb2f37a4945b894a20467dd132
SHA256729c2c5ba395ea043061650dae5c184c10ad288bf0b458dbb30f4837e8b25e9e
SHA512440ed601073dcfa9a76b4b5693c5ad0790cd5093f8d8c6dc28275cb7146f2d98e95575d5b05bed402c47b10cbe3d98b0eec49036e9de847182ccc3c386f76e17
-
\Users\Admin\AppData\Local\Temp\._cache_BlitzedGrabberV12.exeFilesize
1.9MB
MD5006cd7ac7f04dfecdb6c58c9e380aca0
SHA1fd06e16fd731dacb516a945a6cb619b30ecf7ff4
SHA256b0ec85887a9ad75110914916ab2a2d45487e4b65713d4272c050430d80665e64
SHA51247014779312ec5d9481a3c2c97d7e48884e8f61b7a03ee980c2b40fb9e32cfa078554abc45b67d04f6786d2013b0cec0d8be700bda150990f7c44dc6469bef09
-
\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exeFilesize
1.9MB
MD5006cd7ac7f04dfecdb6c58c9e380aca0
SHA1fd06e16fd731dacb516a945a6cb619b30ecf7ff4
SHA256b0ec85887a9ad75110914916ab2a2d45487e4b65713d4272c050430d80665e64
SHA51247014779312ec5d9481a3c2c97d7e48884e8f61b7a03ee980c2b40fb9e32cfa078554abc45b67d04f6786d2013b0cec0d8be700bda150990f7c44dc6469bef09
-
\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exeFilesize
1.9MB
MD5006cd7ac7f04dfecdb6c58c9e380aca0
SHA1fd06e16fd731dacb516a945a6cb619b30ecf7ff4
SHA256b0ec85887a9ad75110914916ab2a2d45487e4b65713d4272c050430d80665e64
SHA51247014779312ec5d9481a3c2c97d7e48884e8f61b7a03ee980c2b40fb9e32cfa078554abc45b67d04f6786d2013b0cec0d8be700bda150990f7c44dc6469bef09
-
\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exeFilesize
1.9MB
MD5006cd7ac7f04dfecdb6c58c9e380aca0
SHA1fd06e16fd731dacb516a945a6cb619b30ecf7ff4
SHA256b0ec85887a9ad75110914916ab2a2d45487e4b65713d4272c050430d80665e64
SHA51247014779312ec5d9481a3c2c97d7e48884e8f61b7a03ee980c2b40fb9e32cfa078554abc45b67d04f6786d2013b0cec0d8be700bda150990f7c44dc6469bef09
-
\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exeFilesize
1.9MB
MD5006cd7ac7f04dfecdb6c58c9e380aca0
SHA1fd06e16fd731dacb516a945a6cb619b30ecf7ff4
SHA256b0ec85887a9ad75110914916ab2a2d45487e4b65713d4272c050430d80665e64
SHA51247014779312ec5d9481a3c2c97d7e48884e8f61b7a03ee980c2b40fb9e32cfa078554abc45b67d04f6786d2013b0cec0d8be700bda150990f7c44dc6469bef09
-
\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exeFilesize
1.9MB
MD5006cd7ac7f04dfecdb6c58c9e380aca0
SHA1fd06e16fd731dacb516a945a6cb619b30ecf7ff4
SHA256b0ec85887a9ad75110914916ab2a2d45487e4b65713d4272c050430d80665e64
SHA51247014779312ec5d9481a3c2c97d7e48884e8f61b7a03ee980c2b40fb9e32cfa078554abc45b67d04f6786d2013b0cec0d8be700bda150990f7c44dc6469bef09
-
\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exeFilesize
1.9MB
MD5006cd7ac7f04dfecdb6c58c9e380aca0
SHA1fd06e16fd731dacb516a945a6cb619b30ecf7ff4
SHA256b0ec85887a9ad75110914916ab2a2d45487e4b65713d4272c050430d80665e64
SHA51247014779312ec5d9481a3c2c97d7e48884e8f61b7a03ee980c2b40fb9e32cfa078554abc45b67d04f6786d2013b0cec0d8be700bda150990f7c44dc6469bef09
-
\Users\Admin\AppData\Local\Temp\dcfb00f9-5ae7-4197-ba59-e48107e40d35\GunaDotNetRT.dllFilesize
136KB
MD59af5eb006bb0bab7f226272d82c896c7
SHA1c2a5bb42a5f08f4dc821be374b700652262308f0
SHA25677dc05a6bda90757f66552ee3f469b09f1e00732b4edca0f542872fb591ed9db
SHA5127badd41be4c1039302fda9bba19d374ec9446ce24b7db33b66bee4ef38180d1abcd666d2aea468e7e452aa1e1565eedfefed582bf1c2fe477a4171d99d48772a
-
memory/756-107-0x0000000074480000-0x00000000744B7000-memory.dmpFilesize
220KB
-
memory/756-92-0x0000000000D80000-0x0000000000F70000-memory.dmpFilesize
1.9MB
-
memory/756-103-0x0000000074E70000-0x0000000074EF0000-memory.dmpFilesize
512KB
-
memory/756-104-0x0000000005070000-0x000000000525E000-memory.dmpFilesize
1.9MB
-
memory/756-105-0x0000000005070000-0x000000000525E000-memory.dmpFilesize
1.9MB
-
memory/756-136-0x0000000004B30000-0x0000000004B70000-memory.dmpFilesize
256KB
-
memory/756-95-0x0000000004B30000-0x0000000004B70000-memory.dmpFilesize
256KB
-
memory/756-137-0x0000000074480000-0x00000000744B7000-memory.dmpFilesize
220KB
-
memory/1460-96-0x0000000004D40000-0x0000000004D80000-memory.dmpFilesize
256KB
-
memory/1460-94-0x00000000052D0000-0x00000000054C2000-memory.dmpFilesize
1.9MB
-
memory/1460-91-0x0000000000FE0000-0x00000000011D0000-memory.dmpFilesize
1.9MB
-
memory/1464-116-0x0000000000400000-0x00000000006AC000-memory.dmpFilesize
2.7MB
-
memory/1464-134-0x00000000003B0000-0x00000000003B1000-memory.dmpFilesize
4KB
-
memory/1464-140-0x0000000000400000-0x00000000006AC000-memory.dmpFilesize
2.7MB
-
memory/1464-138-0x0000000000400000-0x00000000006AC000-memory.dmpFilesize
2.7MB
-
memory/1464-93-0x00000000003B0000-0x00000000003B1000-memory.dmpFilesize
4KB
-
memory/1464-168-0x0000000000400000-0x00000000006AC000-memory.dmpFilesize
2.7MB
-
memory/1464-135-0x0000000000400000-0x00000000006AC000-memory.dmpFilesize
2.7MB
-
memory/1476-80-0x0000000000400000-0x00000000006AC000-memory.dmpFilesize
2.7MB
-
memory/1476-56-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1604-121-0x0000000000440000-0x0000000000540000-memory.dmpFilesize
1024KB
-
memory/1604-125-0x0000000000440000-0x0000000000540000-memory.dmpFilesize
1024KB
-
memory/1604-126-0x0000000000440000-0x0000000000540000-memory.dmpFilesize
1024KB
-
memory/1604-127-0x0000000000440000-0x0000000000540000-memory.dmpFilesize
1024KB
-
memory/1604-128-0x0000000000440000-0x0000000000540000-memory.dmpFilesize
1024KB
-
memory/1604-118-0x0000000000440000-0x0000000000540000-memory.dmpFilesize
1024KB
-
memory/1604-124-0x0000000000440000-0x0000000000540000-memory.dmpFilesize
1024KB
-
memory/1604-123-0x0000000000440000-0x0000000000540000-memory.dmpFilesize
1024KB
-
memory/1604-122-0x0000000000440000-0x0000000000540000-memory.dmpFilesize
1024KB
-
memory/1604-120-0x0000000000440000-0x0000000000540000-memory.dmpFilesize
1024KB
-
memory/1604-119-0x0000000000440000-0x0000000000540000-memory.dmpFilesize
1024KB
-
memory/1604-117-0x0000000000440000-0x0000000000540000-memory.dmpFilesize
1024KB
-
memory/1604-108-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB