8739b236fb674c2c3516bc43ecf4b6583ea22ca0d4b2fe417b6223d654d52011

Resubmissions

28-05-2024 02:35

240528-c3cl8acg65 10

28-05-2024 02:34

240528-c2ncbsbe8y 10

Analysis

max time kernel
93s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28-05-2024 02:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SynapseX.Revamped.V1.5.rar
Size

6.9MB
MD5

358e3fc465a47e440775cd04fe9e9650
SHA1

c0dea173ba12149b325de5831c2e08d8c3ff7b21
SHA256

8739b236fb674c2c3516bc43ecf4b6583ea22ca0d4b2fe417b6223d654d52011
SHA512

1a8dad583487280053ec13a088f02f54177f2c14318d9edfc60121884e6bda8e06979c47fa2e9100db21ecedcb30431a1842c2a6ef3c69f20b703ea07865348f
SSDEEP

196608:SGOV4gKBR19F8lsJ7WJ+ZVNXARR+n9fmYclvlcf:SB4LFXKsJ7QmVNXARkVwl9cf

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

OpenWith.execmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	cmd.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

392 NOTEPAD.EXE
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

OpenWith.exe

pid process

3024 OpenWith.exe

pid	process
392	NOTEPAD.EXE

Suspicious use of SetWindowsHookEx 39 IoCs

Processes:

OpenWith.exe

pid	process
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

OpenWith.exe

description	pid	process	target process
PID 3024 wrote to memory of 392	3024	OpenWith.exe	NOTEPAD.EXE
PID 3024 wrote to memory of 392	3024	OpenWith.exe	NOTEPAD.EXE

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\SynapseX.Revamped.V1.5.rar
1⤵
- Modifies registry class
PID:4788

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\SynapseX.Revamped.V1.5.rar
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads