imminent | 73a921d79c629a62d12cb03c5474b59f2e47fba3cd134d9c297bf6caa9d29be8

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05-05-2024 18:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

18c5c1b72a7764010ddb0c29f6104eaf_JaffaCakes118.msi
Size

2.1MB
MD5

18c5c1b72a7764010ddb0c29f6104eaf
SHA1

c0897b37b631fac818e31aac6fbd76cdbe24d131
SHA256

73a921d79c629a62d12cb03c5474b59f2e47fba3cd134d9c297bf6caa9d29be8
SHA512

635d3f9f13217147daa06938d84998acec57ee81203d4a69ef3eb2154dc1cb79b8696d59e0c585b8fa43d38c2d3aa1a7f2dd1fe2dbab60978c9bc0d9abeb52ed
SSDEEP

49152:H5EVRAJdD1Z/cusQrWxE/J92+DA4sqOo7/z:ZEVRUdDb0+yEB5DKA

Score

10^/10

imminent agilenet spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Drops startup file 1 IoCs

Processes:

SynmatecProcessor.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SynmatecProcessor.lnk	SynmatecProcessor.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral2/memory/4940-91-0x0000000002890000-0x000000000289A000-memory.dmp	agile_net

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

IMSynTPHelper.exeSynmatec.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	IMSynTPHelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	Synmatec.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

SynmatecProcessor.exe

description pid process target process

PID 4940 set thread context of 3980 4940 SynmatecProcessor.exe SynmatecProcessor.exe

description	pid	process	target process
PID 4940 set thread context of 3980	4940	SynmatecProcessor.exe	SynmatecProcessor.exe

Drops file in Windows directory 11 IoCs

Processes:

msiexec.exeexpand.exe

description	ioc	process
File created	C:\Windows\Installer\e577668.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e577668.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	expand.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	expand.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{510DF74D-3785-4680-9766-916601BCA6A2}	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7705.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBD36.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBDA5.tmp	msiexec.exe

Executes dropped EXE 4 IoCs

Processes:

IMSynTPHelper.exeSynmatec.exeSynmatecProcessor.exeSynmatecProcessor.exe

pid process

4940 IMSynTPHelper.exe
5084 Synmatec.exe
4940 SynmatecProcessor.exe
3980 SynmatecProcessor.exe
Loads dropped DLL 2 IoCs

Processes:

MsiExec.exeMsiExec.exe

pid process

4152 MsiExec.exe
4820 MsiExec.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4940	IMSynTPHelper.exe
5084	Synmatec.exe
4940	SynmatecProcessor.exe
3980	SynmatecProcessor.exe

pid	process
4152	MsiExec.exe
4820	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssvc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000324c0cbb4829e1b20000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000324c0cbb0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900324c0cbb000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d324c0cbb000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000324c0cbb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

Processes:

msiexec.exe

description	ioc	process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msiexec.exe

pid process

3584 msiexec.exe
3584 msiexec.exe

pid	process
3584	msiexec.exe
3584	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exeIMSynTPHelper.exesrtasks.exeSynmatec.exeSynmatecProcessor.exe

description	pid	process
Token: SeShutdownPrivilege	3764	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3764	msiexec.exe
Token: SeSecurityPrivilege	3584	msiexec.exe
Token: SeCreateTokenPrivilege	3764	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3764	msiexec.exe
Token: SeLockMemoryPrivilege	3764	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3764	msiexec.exe
Token: SeMachineAccountPrivilege	3764	msiexec.exe
Token: SeTcbPrivilege	3764	msiexec.exe
Token: SeSecurityPrivilege	3764	msiexec.exe
Token: SeTakeOwnershipPrivilege	3764	msiexec.exe
Token: SeLoadDriverPrivilege	3764	msiexec.exe
Token: SeSystemProfilePrivilege	3764	msiexec.exe
Token: SeSystemtimePrivilege	3764	msiexec.exe
Token: SeProfSingleProcessPrivilege	3764	msiexec.exe
Token: SeIncBasePriorityPrivilege	3764	msiexec.exe
Token: SeCreatePagefilePrivilege	3764	msiexec.exe
Token: SeCreatePermanentPrivilege	3764	msiexec.exe
Token: SeBackupPrivilege	3764	msiexec.exe
Token: SeRestorePrivilege	3764	msiexec.exe
Token: SeShutdownPrivilege	3764	msiexec.exe
Token: SeDebugPrivilege	3764	msiexec.exe
Token: SeAuditPrivilege	3764	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3764	msiexec.exe
Token: SeChangeNotifyPrivilege	3764	msiexec.exe
Token: SeRemoteShutdownPrivilege	3764	msiexec.exe
Token: SeUndockPrivilege	3764	msiexec.exe
Token: SeSyncAgentPrivilege	3764	msiexec.exe
Token: SeEnableDelegationPrivilege	3764	msiexec.exe
Token: SeManageVolumePrivilege	3764	msiexec.exe
Token: SeImpersonatePrivilege	3764	msiexec.exe
Token: SeCreateGlobalPrivilege	3764	msiexec.exe
Token: SeBackupPrivilege	2376	vssvc.exe
Token: SeRestorePrivilege	2376	vssvc.exe
Token: SeAuditPrivilege	2376	vssvc.exe
Token: SeBackupPrivilege	3584	msiexec.exe
Token: SeRestorePrivilege	3584	msiexec.exe
Token: SeRestorePrivilege	3584	msiexec.exe
Token: SeTakeOwnershipPrivilege	3584	msiexec.exe
Token: SeRestorePrivilege	3584	msiexec.exe
Token: SeTakeOwnershipPrivilege	3584	msiexec.exe
Token: SeDebugPrivilege	4940	IMSynTPHelper.exe
Token: 33	4940	IMSynTPHelper.exe
Token: SeIncBasePriorityPrivilege	4940	IMSynTPHelper.exe
Token: SeBackupPrivilege	2124	srtasks.exe
Token: SeRestorePrivilege	2124	srtasks.exe
Token: SeSecurityPrivilege	2124	srtasks.exe
Token: SeTakeOwnershipPrivilege	2124	srtasks.exe
Token: SeBackupPrivilege	2124	srtasks.exe
Token: SeRestorePrivilege	2124	srtasks.exe
Token: SeSecurityPrivilege	2124	srtasks.exe
Token: SeTakeOwnershipPrivilege	2124	srtasks.exe
Token: SeRestorePrivilege	3584	msiexec.exe
Token: SeTakeOwnershipPrivilege	3584	msiexec.exe
Token: SeRestorePrivilege	3584	msiexec.exe
Token: SeTakeOwnershipPrivilege	3584	msiexec.exe
Token: SeRestorePrivilege	3584	msiexec.exe
Token: SeTakeOwnershipPrivilege	3584	msiexec.exe
Token: SeRestorePrivilege	3584	msiexec.exe
Token: SeTakeOwnershipPrivilege	3584	msiexec.exe
Token: SeDebugPrivilege	5084	Synmatec.exe
Token: 33	5084	Synmatec.exe
Token: SeIncBasePriorityPrivilege	5084	Synmatec.exe
Token: SeDebugPrivilege	4940	SynmatecProcessor.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

3764 msiexec.exe
3764 msiexec.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

SynmatecProcessor.exe

pid process

3980 SynmatecProcessor.exe

pid	process
3764	msiexec.exe
3764	msiexec.exe

pid	process
3980	SynmatecProcessor.exe

Suspicious use of WriteProcessMemory 40 IoCs

Processes:

msiexec.exeMsiExec.exeIMSynTPHelper.execmd.exeSynmatec.execmd.exeSynmatecProcessor.exe

description	pid	process	target process
PID 3584 wrote to memory of 2124	3584	msiexec.exe	srtasks.exe
PID 3584 wrote to memory of 2124	3584	msiexec.exe	srtasks.exe
PID 3584 wrote to memory of 4152	3584	msiexec.exe	MsiExec.exe
PID 3584 wrote to memory of 4152	3584	msiexec.exe	MsiExec.exe
PID 3584 wrote to memory of 4152	3584	msiexec.exe	MsiExec.exe
PID 4152 wrote to memory of 1924	4152	MsiExec.exe	expand.exe
PID 4152 wrote to memory of 1924	4152	MsiExec.exe	expand.exe
PID 4152 wrote to memory of 1924	4152	MsiExec.exe	expand.exe
PID 4152 wrote to memory of 4940	4152	MsiExec.exe	IMSynTPHelper.exe
PID 4152 wrote to memory of 4940	4152	MsiExec.exe	IMSynTPHelper.exe
PID 4152 wrote to memory of 4940	4152	MsiExec.exe	IMSynTPHelper.exe
PID 4940 wrote to memory of 3260	4940	IMSynTPHelper.exe	cmd.exe
PID 4940 wrote to memory of 3260	4940	IMSynTPHelper.exe	cmd.exe
PID 4940 wrote to memory of 3260	4940	IMSynTPHelper.exe	cmd.exe
PID 3260 wrote to memory of 5084	3260	cmd.exe	Synmatec.exe
PID 3260 wrote to memory of 5084	3260	cmd.exe	Synmatec.exe
PID 3260 wrote to memory of 5084	3260	cmd.exe	Synmatec.exe
PID 3584 wrote to memory of 4820	3584	msiexec.exe	MsiExec.exe
PID 3584 wrote to memory of 4820	3584	msiexec.exe	MsiExec.exe
PID 3584 wrote to memory of 4820	3584	msiexec.exe	MsiExec.exe
PID 5084 wrote to memory of 3944	5084	Synmatec.exe	cmd.exe
PID 5084 wrote to memory of 3944	5084	Synmatec.exe	cmd.exe
PID 5084 wrote to memory of 3944	5084	Synmatec.exe	cmd.exe
PID 5084 wrote to memory of 1920	5084	Synmatec.exe	cmd.exe
PID 5084 wrote to memory of 1920	5084	Synmatec.exe	cmd.exe
PID 5084 wrote to memory of 1920	5084	Synmatec.exe	cmd.exe
PID 5084 wrote to memory of 4232	5084	Synmatec.exe	cmd.exe
PID 5084 wrote to memory of 4232	5084	Synmatec.exe	cmd.exe
PID 5084 wrote to memory of 4232	5084	Synmatec.exe	cmd.exe
PID 4232 wrote to memory of 4940	4232	cmd.exe	SynmatecProcessor.exe
PID 4232 wrote to memory of 4940	4232	cmd.exe	SynmatecProcessor.exe
PID 4232 wrote to memory of 4940	4232	cmd.exe	SynmatecProcessor.exe
PID 4940 wrote to memory of 3980	4940	SynmatecProcessor.exe	SynmatecProcessor.exe
PID 4940 wrote to memory of 3980	4940	SynmatecProcessor.exe	SynmatecProcessor.exe
PID 4940 wrote to memory of 3980	4940	SynmatecProcessor.exe	SynmatecProcessor.exe
PID 4940 wrote to memory of 3980	4940	SynmatecProcessor.exe	SynmatecProcessor.exe
PID 4940 wrote to memory of 3980	4940	SynmatecProcessor.exe	SynmatecProcessor.exe
PID 4940 wrote to memory of 3980	4940	SynmatecProcessor.exe	SynmatecProcessor.exe
PID 4940 wrote to memory of 3980	4940	SynmatecProcessor.exe	SynmatecProcessor.exe
PID 4940 wrote to memory of 3980	4940	SynmatecProcessor.exe	SynmatecProcessor.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\18c5c1b72a7764010ddb0c29f6104eaf_JaffaCakes118.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3764

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3584

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2124

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding BF9330045A1B8BD11F639200A6A6E696
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4152

C:\Windows\SysWOW64\expand.exe
"C:\Windows\System32\expand.exe" -R files.cab -F:* files
3⤵
- Drops file in Windows directory
PID:1924

C:\Users\Admin\AppData\Local\Temp\MW-8dc7a4f6-b75f-4c59-8531-348aafa2242d\files\IMSynTPHelper.exe
"C:\Users\Admin\AppData\Local\Temp\MW-8dc7a4f6-b75f-4c59-8531-348aafa2242d\files\IMSynTPHelper.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4940

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\SysWOW64\cmd.exe" /c, "C:\Users\Admin\AppData\Local\Temp\Synmatec.exe"
4⤵
- Suspicious use of WriteProcessMemory
PID:3260

C:\Users\Admin\AppData\Local\Temp\Synmatec.exe
"C:\Users\Admin\AppData\Local\Temp\Synmatec.exe"
5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5084

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\SysWOW64\cmd.exe" /c, "C:\Users\Admin\Documents\b106484eb915e4ad6df697dc1442cbff-EDITED.jpg"
6⤵
PID:3944

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\SysWOW64\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\Synmatec.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\SynmatecProcessor.exe"
6⤵
PID:1920

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\SysWOW64\cmd.exe" /c, "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\SynmatecProcessor.exe"
6⤵
- Suspicious use of WriteProcessMemory
PID:4232

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\SynmatecProcessor.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\SynmatecProcessor.exe"
7⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4940

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\SynmatecProcessor.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\SynmatecProcessor.exe"
8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3980

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 2DA1E351BE6339B565DF2F95485D2B19 E Global\MSI0000
2⤵
- Loads dropped DLL
PID:4820

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2376

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SynmatecProcessor.exe.log
Filesize
706B

MD5
2ef5ef69dadb8865b3d5b58c956077b8

SHA1
af2d869bac00685c745652bbd8b3fe82829a8998

SHA256
363502eb2a4e53ba02d2d85412b901fcf8e06de221736bdffa949799ef3d21e3

SHA512
66d4db5dd17d88e1d54ea0df3a7211a503dc4355de701259cefccc9f2e4e3ced9534b700099ffbb089a5a3acb082011c80b61801aa14aff76b379ce8f90d4fd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-8dc7a4f6-b75f-4c59-8531-348aafa2242d\files.cab
Filesize
1.9MB

MD5
a9fb9b6b482719cbd7a086cb8091f35a

SHA1
d70c9e4b290df43a28f72f303fb3ee7dc6897400

SHA256
c2d7cab5b45230fb343f200e02427b4c75bbd22817d00f90537b7d242b610d37

SHA512
f9a680eefd943f2c7324df32b70b400065a968fb87e39092e29d994478a638c60fa4a683f7ddfcfbb6ad100e2e463e9a80f877bb14c938da4c15fa1ebdbd403f

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-8dc7a4f6-b75f-4c59-8531-348aafa2242d\files\IMSynTPHelper.exe
Filesize
1.9MB

MD5
40706d9e08a34f0167faa803aad1d4a6

SHA1
b0a958964f6037bc9dbac43124332844902d4c32

SHA256
42ecb43af4bf31dab0599ffdd1156a88347a00e9940b7a984a5533a6c1a5be57

SHA512
e3790550d7d77de24aad3e7f57c525b42069829d3e324e289bd66dc31d8d9365df44ba7e9a48750b648f215312dcf50356a513dfb5e7095c323c22c6eaee5ef7

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-8dc7a4f6-b75f-4c59-8531-348aafa2242d\msiwrapper.ini
Filesize
488B

MD5
72cb2634a1dbbaa6cebbf282f672a36f

SHA1
8aa1381736fd20f0bcf103efd5c8a62b32f14fc4

SHA256
cbc830f5bffde90ecbb026e8fce2921c5b2d2bd3b197b0e6845af8e718588c1d

SHA512
b091dda803d9375aa1b810b105ca259cbb42832561802504a08070c4beff33c0640f53b09e1ec7654435a3b7eaf71cb873b76450c4b0bf9b30662a6ef9945194

Download Submit
C:\Users\Admin\Documents\b106484eb915e4ad6df697dc1442cbff-EDITED.jpg
Filesize
1.2MB

MD5
5b9849e016ab5210cbc8e78a1fdd3671

SHA1
560091b2bdf518dd892016722da62fa613d5e958

SHA256
76a430452cf0bbb0e429675afd0bf1ff9bb9391f6d41dc293afd6ef06abb7c15

SHA512
7975184dadbbb612cad14d01fa03d6ece12d28d9dbd1ba5ccc05b1c10f52b866693354d25c8b667c709ad345ac4a8715ec6e425702d0e3a73d606026bcaba659

Download Submit
C:\Users\Admin\Documents\b106484eb915e4ad6df697dc1442cbff-EDITED.txt
Filesize
32B

MD5
5487dd5ec11b05c9f40df10892a2be77

SHA1
f280495646fbe745db0a59d4c4d9c4529a205321

SHA256
9dbd45db8495aeb79115856938096941222a3860c642a9c42f0c0f186683909a

SHA512
d9128a6bb1534915cc2737d64145fb0e243a5cf709b03d3703570cd3fa6d5d703e02b056b371787288225a7225a3d8f16aee0831ad30e433c2d3110121101945

Download Submit
C:\Windows\Installer\MSI7705.tmp
Filesize
131KB

MD5
a06ba919e980d32e0ebe80ddfa099524

SHA1
2a1c0cbec1cbf5774a6d00fc3a14d2ce979026d1

SHA256
b8074d53c56f7deb5832af3894ec20a21d1162252f177984807eb30fc1152fc8

SHA512
c8be0aa247baec6c2a7061086c0bbec166099de3dd0f40e50558fb1515dbe9324662ea7c80797208e4eb2f2243c96067702edf385602773e7b3ccc36896f1d13

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Filesize
24.1MB

MD5
673aac372c203807f0bc91d5b9924893

SHA1
60a92745ab3f1862b56b25561bdefef9d3e9d079

SHA256
c6e24e303850d97c5c07cd7fede4cf93b4ac2098b792252d2fdb5096bc64c395

SHA512
f74e2b2749a15d37ca1888908c48ea48a7809542bf1b0af1d95d3ae107ed7c9b2a6dc659afd627cf156b904327070574c38f8b1887a882df6d933e2b593782e3

Download Submit
\??\Volume{bb0c4c32-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{6d2dd57b-05ff-46c7-8564-ce612b4dbfd4}_OnDiskSnapshotProp
Filesize
6KB

MD5
89aeacbea3ceaa2c5ae4437a058f8488

SHA1
83dd912a002d1a45293abb7b896623b617a8c27d

SHA256
04875254a08413043d75e898b7363cf2bdd05db239aaa20af9e5d942e5ab2f01

SHA512
2670c8ae2757d2550f4f32a5a6abda2add715c50a7cff76815cd4ede7135089a69f928752fcd9b87eaf2d1f504606fea390a28039c5fd25b1afb0f092c9b12ca

Download Submit
memory/3980-100-0x0000000005E20000-0x0000000005E86000-memory.dmp

Filesize
408KB

Download
memory/3980-101-0x0000000006300000-0x0000000006318000-memory.dmp

Filesize
96KB

Download
memory/3980-99-0x0000000008250000-0x0000000008278000-memory.dmp

Filesize
160KB

Download
memory/3980-98-0x0000000004E20000-0x0000000004ECE000-memory.dmp

Filesize
696KB

Download
memory/3980-102-0x0000000006360000-0x0000000006376000-memory.dmp

Filesize
88KB

Download
memory/3980-103-0x00000000064D0000-0x00000000064DA000-memory.dmp

Filesize
40KB

Download
memory/3980-97-0x0000000000E70000-0x0000000000E80000-memory.dmp

Filesize
64KB

Download
memory/3980-96-0x0000000000830000-0x0000000000886000-memory.dmp

Filesize
344KB

Download
memory/4940-48-0x0000000004C50000-0x0000000004C80000-memory.dmp

Filesize
192KB

Download
memory/4940-92-0x000000000A3E0000-0x000000000A47C000-memory.dmp

Filesize
624KB

Download
memory/4940-91-0x0000000002890000-0x000000000289A000-memory.dmp

Filesize
40KB

Download
memory/4940-54-0x0000000007400000-0x000000000740E000-memory.dmp

Filesize
56KB

Download
memory/4940-53-0x00000000073D0000-0x00000000073DA000-memory.dmp

Filesize
40KB

Download
memory/4940-50-0x0000000007470000-0x0000000007502000-memory.dmp

Filesize
584KB

Download
memory/4940-49-0x0000000007980000-0x0000000007F24000-memory.dmp

Filesize
5.6MB

Download
memory/4940-47-0x0000000007180000-0x0000000007362000-memory.dmp

Filesize
1.9MB

Download
memory/4940-46-0x0000000000100000-0x00000000002F0000-memory.dmp

Filesize
1.9MB

Download