edb982889235a7849fb9e56312f209a02c0dd01a76b6fa508e59648c56755147

Analysis

max time kernel
65s
max time network
75s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2023, 17:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

synapse-x-cracked--main/Synapse X.exe
Size

374KB
MD5

b69c13e0099df6821ba000cb9d39819b
SHA1

6a36cf9a4a9ff90f8ddf21f62db94ef2691b85ee
SHA256

cbff32a11e742c778f5d2d94da6699af7302ec751111b06c37f665768eaf2d02
SHA512

0c7b4d42f46a04574d8adf6d6149e0a81bc4cbafcb2e46557b0bd083f82fdd8dbf7cc166ee0da1cdf5048605f0e83f50a1e064a5c581a97b1aefc4533d9954bb
SSDEEP

6144:H83Kwo3BjOALaQIigh4f86OZUjUKnmuv9uVYwEHCnGuBt+1:Hxz7r86h0uv8V5nxj+1

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3356	3164	WerFault.exe	86

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3164	Synapse X.exe

C:\Users\Admin\AppData\Local\Temp\synapse-x-cracked--main\Synapse X.exe
"C:\Users\Admin\AppData\Local\Temp\synapse-x-cracked--main\Synapse X.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3164
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 50408
  2⤵
  - Program crash
  PID:3356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 3164 -ip 3164
1⤵
PID:2152

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3164-133-0x0000000000470000-0x00000000004D2000-memory.dmp

Filesize
392KB

Download
memory/3164-134-0x0000000002730000-0x0000000002740000-memory.dmp

Filesize
64KB

Download
memory/3164-135-0x0000000002730000-0x0000000002740000-memory.dmp

Filesize
64KB

Download
memory/3164-136-0x000000000B930000-0x000000000B968000-memory.dmp

Filesize
224KB

Download
memory/3164-137-0x0000000006F80000-0x0000000006F8E000-memory.dmp

Filesize
56KB

Download