Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
20s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
15/05/2023, 02:38
Static task
static1
Behavioral task
behavioral1
Sample
27d3c4f58b48471511fd2597f39987384f76b3113ea5df3a94c55ffe340ea257.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
27d3c4f58b48471511fd2597f39987384f76b3113ea5df3a94c55ffe340ea257.exe
Resource
win10v2004-20230220-en
General
-
Target
27d3c4f58b48471511fd2597f39987384f76b3113ea5df3a94c55ffe340ea257.exe
-
Size
3.8MB
-
MD5
bb822e95e45231a03a063a791d66df2b
-
SHA1
4a6d37d130631be7e24a28d618d30de48d7aa042
-
SHA256
27d3c4f58b48471511fd2597f39987384f76b3113ea5df3a94c55ffe340ea257
-
SHA512
8fb86d9b49db91e26678084c266e95039f1dfe0c9ff0d5dff5f4fd7baeb09e9cf4ef8c46d407cdb6fb1ce409d35f0fac252c8ab70cdd4f46d9b6732531b395e1
-
SSDEEP
98304:mnsmtk2anG8nAiYW1xjfAVXCnXrDgInJBNV/:YLcggoVXiXtJBNV/
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 1156 ._cache_27d3c4f58b48471511fd2597f39987384f76b3113ea5df3a94c55ffe340ea257.exe 1488 Synaptics.exe 1132 ._cache_Synaptics.exe -
Loads dropped DLL 5 IoCs
pid Process 1520 27d3c4f58b48471511fd2597f39987384f76b3113ea5df3a94c55ffe340ea257.exe 1520 27d3c4f58b48471511fd2597f39987384f76b3113ea5df3a94c55ffe340ea257.exe 1520 27d3c4f58b48471511fd2597f39987384f76b3113ea5df3a94c55ffe340ea257.exe 1488 Synaptics.exe 1488 Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 27d3c4f58b48471511fd2597f39987384f76b3113ea5df3a94c55ffe340ea257.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 884 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 884 EXCEL.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1520 wrote to memory of 1156 1520 27d3c4f58b48471511fd2597f39987384f76b3113ea5df3a94c55ffe340ea257.exe 28 PID 1520 wrote to memory of 1156 1520 27d3c4f58b48471511fd2597f39987384f76b3113ea5df3a94c55ffe340ea257.exe 28 PID 1520 wrote to memory of 1156 1520 27d3c4f58b48471511fd2597f39987384f76b3113ea5df3a94c55ffe340ea257.exe 28 PID 1520 wrote to memory of 1156 1520 27d3c4f58b48471511fd2597f39987384f76b3113ea5df3a94c55ffe340ea257.exe 28 PID 1520 wrote to memory of 1488 1520 27d3c4f58b48471511fd2597f39987384f76b3113ea5df3a94c55ffe340ea257.exe 29 PID 1520 wrote to memory of 1488 1520 27d3c4f58b48471511fd2597f39987384f76b3113ea5df3a94c55ffe340ea257.exe 29 PID 1520 wrote to memory of 1488 1520 27d3c4f58b48471511fd2597f39987384f76b3113ea5df3a94c55ffe340ea257.exe 29 PID 1520 wrote to memory of 1488 1520 27d3c4f58b48471511fd2597f39987384f76b3113ea5df3a94c55ffe340ea257.exe 29 PID 1488 wrote to memory of 1132 1488 Synaptics.exe 30 PID 1488 wrote to memory of 1132 1488 Synaptics.exe 30 PID 1488 wrote to memory of 1132 1488 Synaptics.exe 30 PID 1488 wrote to memory of 1132 1488 Synaptics.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\27d3c4f58b48471511fd2597f39987384f76b3113ea5df3a94c55ffe340ea257.exe"C:\Users\Admin\AppData\Local\Temp\27d3c4f58b48471511fd2597f39987384f76b3113ea5df3a94c55ffe340ea257.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\._cache_27d3c4f58b48471511fd2597f39987384f76b3113ea5df3a94c55ffe340ea257.exe"C:\Users\Admin\AppData\Local\Temp\._cache_27d3c4f58b48471511fd2597f39987384f76b3113ea5df3a94c55ffe340ea257.exe"2⤵
- Executes dropped EXE
PID:1156
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
PID:1132
-
-
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:884
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.8MB
MD5bb822e95e45231a03a063a791d66df2b
SHA14a6d37d130631be7e24a28d618d30de48d7aa042
SHA25627d3c4f58b48471511fd2597f39987384f76b3113ea5df3a94c55ffe340ea257
SHA5128fb86d9b49db91e26678084c266e95039f1dfe0c9ff0d5dff5f4fd7baeb09e9cf4ef8c46d407cdb6fb1ce409d35f0fac252c8ab70cdd4f46d9b6732531b395e1
-
Filesize
3.8MB
MD5bb822e95e45231a03a063a791d66df2b
SHA14a6d37d130631be7e24a28d618d30de48d7aa042
SHA25627d3c4f58b48471511fd2597f39987384f76b3113ea5df3a94c55ffe340ea257
SHA5128fb86d9b49db91e26678084c266e95039f1dfe0c9ff0d5dff5f4fd7baeb09e9cf4ef8c46d407cdb6fb1ce409d35f0fac252c8ab70cdd4f46d9b6732531b395e1
-
Filesize
3.8MB
MD5bb822e95e45231a03a063a791d66df2b
SHA14a6d37d130631be7e24a28d618d30de48d7aa042
SHA25627d3c4f58b48471511fd2597f39987384f76b3113ea5df3a94c55ffe340ea257
SHA5128fb86d9b49db91e26678084c266e95039f1dfe0c9ff0d5dff5f4fd7baeb09e9cf4ef8c46d407cdb6fb1ce409d35f0fac252c8ab70cdd4f46d9b6732531b395e1
-
C:\Users\Admin\AppData\Local\Temp\._cache_27d3c4f58b48471511fd2597f39987384f76b3113ea5df3a94c55ffe340ea257.exe
Filesize3.0MB
MD5674c64a7e4fa94893123da22f8ea30af
SHA12456068eae785cd2cd70990b61a36c3f999ca0a2
SHA256252f7ce9ebbeb17218d390a322720c04a41c4f4186982472e4885a26dfeef709
SHA5126033ec982c889106d2d765a7227610b478e28620228afeadd3b965724e5e8e87af86de2ab3ab219a98b32ad25fb34f72edcb6b87e4ef06d4a86d1cd823bb190c
-
C:\Users\Admin\AppData\Local\Temp\._cache_27d3c4f58b48471511fd2597f39987384f76b3113ea5df3a94c55ffe340ea257.exe
Filesize3.0MB
MD5674c64a7e4fa94893123da22f8ea30af
SHA12456068eae785cd2cd70990b61a36c3f999ca0a2
SHA256252f7ce9ebbeb17218d390a322720c04a41c4f4186982472e4885a26dfeef709
SHA5126033ec982c889106d2d765a7227610b478e28620228afeadd3b965724e5e8e87af86de2ab3ab219a98b32ad25fb34f72edcb6b87e4ef06d4a86d1cd823bb190c
-
Filesize
3.0MB
MD5674c64a7e4fa94893123da22f8ea30af
SHA12456068eae785cd2cd70990b61a36c3f999ca0a2
SHA256252f7ce9ebbeb17218d390a322720c04a41c4f4186982472e4885a26dfeef709
SHA5126033ec982c889106d2d765a7227610b478e28620228afeadd3b965724e5e8e87af86de2ab3ab219a98b32ad25fb34f72edcb6b87e4ef06d4a86d1cd823bb190c
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
3.8MB
MD5bb822e95e45231a03a063a791d66df2b
SHA14a6d37d130631be7e24a28d618d30de48d7aa042
SHA25627d3c4f58b48471511fd2597f39987384f76b3113ea5df3a94c55ffe340ea257
SHA5128fb86d9b49db91e26678084c266e95039f1dfe0c9ff0d5dff5f4fd7baeb09e9cf4ef8c46d407cdb6fb1ce409d35f0fac252c8ab70cdd4f46d9b6732531b395e1
-
Filesize
3.8MB
MD5bb822e95e45231a03a063a791d66df2b
SHA14a6d37d130631be7e24a28d618d30de48d7aa042
SHA25627d3c4f58b48471511fd2597f39987384f76b3113ea5df3a94c55ffe340ea257
SHA5128fb86d9b49db91e26678084c266e95039f1dfe0c9ff0d5dff5f4fd7baeb09e9cf4ef8c46d407cdb6fb1ce409d35f0fac252c8ab70cdd4f46d9b6732531b395e1
-
Filesize
3.8MB
MD5bb822e95e45231a03a063a791d66df2b
SHA14a6d37d130631be7e24a28d618d30de48d7aa042
SHA25627d3c4f58b48471511fd2597f39987384f76b3113ea5df3a94c55ffe340ea257
SHA5128fb86d9b49db91e26678084c266e95039f1dfe0c9ff0d5dff5f4fd7baeb09e9cf4ef8c46d407cdb6fb1ce409d35f0fac252c8ab70cdd4f46d9b6732531b395e1
-
\Users\Admin\AppData\Local\Temp\._cache_27d3c4f58b48471511fd2597f39987384f76b3113ea5df3a94c55ffe340ea257.exe
Filesize3.0MB
MD5674c64a7e4fa94893123da22f8ea30af
SHA12456068eae785cd2cd70990b61a36c3f999ca0a2
SHA256252f7ce9ebbeb17218d390a322720c04a41c4f4186982472e4885a26dfeef709
SHA5126033ec982c889106d2d765a7227610b478e28620228afeadd3b965724e5e8e87af86de2ab3ab219a98b32ad25fb34f72edcb6b87e4ef06d4a86d1cd823bb190c
-
Filesize
3.0MB
MD5674c64a7e4fa94893123da22f8ea30af
SHA12456068eae785cd2cd70990b61a36c3f999ca0a2
SHA256252f7ce9ebbeb17218d390a322720c04a41c4f4186982472e4885a26dfeef709
SHA5126033ec982c889106d2d765a7227610b478e28620228afeadd3b965724e5e8e87af86de2ab3ab219a98b32ad25fb34f72edcb6b87e4ef06d4a86d1cd823bb190c