ef10f89e2974c76e5c9da05957ca8787df4b04ce3fe02199d817cd37aae98754

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
06/08/2024, 16:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Synapse X.exe.xml
Size

186B
MD5

b51c130a957051ba9fb2245bf76fb6f6
SHA1

42181e5745daab2a0e8cf87693142828306f9bda
SHA256

7921098e47e894412fdfd0cafe0f88cc68497740998eac17c68c00129069d803
SHA512

fa2ac3eff5d51aea7acc9cf6aa018a77fae295d55c5bf808c9d7048c801baf4626568f00fb001a9f2780c46dce294482cfeb3045aabe139ddc557c0d3bc11640

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexplore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSOXMLED.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000007656f329b93f08a6cf5c8c0aea1b902aeb5bfba42d51c22572d4febdc647f787000000000e80000000020000200000000faefacdce32d7c066524875eb449eb2fe615fbb5182abec7612c71b3d62974790000000e0d3dd3aab838b8a92bed39562042b99d4b18410be93c168025b7f61a4cc6a0a7d84576e85b950802cf45315fb554ba144b2e47edc1fae186761569753c9a641c602fdb56df8c7714b76e90e25e2bdbc60b59084661e8494211e08aa5181930e7af36d83941352c9b7d6b473a7895ee44436b5db2c7d121b7281d819815219348dc5f53e2a7cdb5299a2f939c143d13140000000a50f8c9603fe7b0ac9a6e9299325eb7ec9779764285025f8642b8b8e88ab851357db84b3ce0ee4cf55faf4b02efd24daaa2b20c000505dfb5a314f842629476c	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10a21a1522e8da01	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429125439"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000000067bccda1e3c222f829390d7d5569de00a8dd2da3f9ac757e22e3569a8a32ad000000000e8000000002000020000000fe29ad1ceae1a4de904439d4b947f45de85b17d8d9fc5580fc775c7d9816901f20000000bfad95c3c39bfc0820e8277ec49b0bdd4b4dbec7aa683105cf821f243c3264a44000000035f2784b3c33a06ee4b6bc9b9a8e468bef2c0cfe1682f9d513f0dd3b1f192d79a3ec24a6b94f61fd6b3c6b5caf7b99f413c2de0bdda2d172019809d22cf10657	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{40927081-5415-11EF-83F9-EE33E2B06AA8} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2408	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2408	IEXPLORE.EXE
2408	IEXPLORE.EXE
2400	IEXPLORE.EXE
2400	IEXPLORE.EXE
2400	IEXPLORE.EXE
2400	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 292 wrote to memory of 2344	292	MSOXMLED.EXE	30
PID 292 wrote to memory of 2344	292	MSOXMLED.EXE	30
PID 292 wrote to memory of 2344	292	MSOXMLED.EXE	30
PID 292 wrote to memory of 2344	292	MSOXMLED.EXE	30
PID 2344 wrote to memory of 2408	2344	iexplore.exe	31
PID 2344 wrote to memory of 2408	2344	iexplore.exe	31
PID 2344 wrote to memory of 2408	2344	iexplore.exe	31
PID 2344 wrote to memory of 2408	2344	iexplore.exe	31
PID 2408 wrote to memory of 2400	2408	IEXPLORE.EXE	32
PID 2408 wrote to memory of 2400	2408	IEXPLORE.EXE	32
PID 2408 wrote to memory of 2400	2408	IEXPLORE.EXE	32
PID 2408 wrote to memory of 2400	2408	IEXPLORE.EXE	32

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Synapse X.exe.xml"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:292
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2344
- - C:\Program Files\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2408
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2408 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
602804c445abdf8372e11669b459cef0

SHA1
0c811375da63e30f6957a226933aab7220ff0351

SHA256
d12f684e9b245451d4a28929b5c933806ff31d20df70537e4d3123aed9d1c94b

SHA512
85c67dff895d1ad96e90c84a1199b01ffc8d3f6f7204b881b683a4e6263857eec74f9dc5b4fbf5e22def9f7ed635f47a06fef566a607a9bd2462d4da18e8e9de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
56e3ffc9c13d1116d2b3cf8daa694b29

SHA1
c90156ee603022085acbc4941336229f8cd80dd8

SHA256
f6b0f5d44faf6584609fca8190309c353ae25a23a94d0dce9684540fa7234fc2

SHA512
e698984fdf4d58a207b71609ca7a4697478b5b510ba1804f23adeb95101999632a306944afd5d8f9910bce4589bb3175bb399917a8e42cc8764ac51dede7355e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5700912cdb7bcdab61406d04e21a4406

SHA1
32c21507f1b22562d45fc3e1806cc002408318a8

SHA256
8cd7b16a91c4b6d6aa199f9a302f588d421b23625434b0e2c3d3964d31ed8812

SHA512
475dd797e7f6b8b54442293547ab34fb074fd7754d956be74d4b76de1e560e318b04cb564059c37988ab40c7322949fc5385e847dd5827aee67594bc9cce5411

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2010279aa2fe37acc9dcbed1f95829b5

SHA1
76aa551c313768365950be7739a5f577ea06f4f6

SHA256
390213ed57d3495280c84257f4f2b1bc4b5a5c775e0abceed5d0c61c5b6c2f8c

SHA512
0e1d560a94334e2e37a07779115fa2c0e88178e829d9a6e227b524aad955305f9837b469b1d470ce50387f727db8574af5abe603be2d3cba03eaf3f8d29e4f45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fdf5d0b39811177d176ac00bde6cdf46

SHA1
0ffe829a8a618398046c3682936b7936f1c5a267

SHA256
3636bf542d2a8a5e97322d1101eb1276657808ddc15a0d7f65f48c415e422778

SHA512
57068071f50cd179f88e903c9c3575ab28e89e4f22a31ba4ad976820f9c62cca96e0e6ba0be78c2a8e65ee18b4a1f52e1f1bbb030d7b2580532955f84a76fee9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d93f40376e91695180b93aebd4053837

SHA1
1032bc102a502f21149ceda3db5240c42b160c78

SHA256
00d048285ead70878dd028bf308b2be0130a14dfd130025116bb5a271400aac4

SHA512
efe889b6fa3ec2b38f0d1d89967e2d71d882fe638f0cfebc0f4102e9e5156b46d79fedb941a376418bf24a6bb4977df4255ce4672eba10eb5bd61d0c5c6f8c46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1bf0a60de331e28595b9f0ff95505b13

SHA1
84c929651ee79a7758613cbfa8a77080091296dd

SHA256
dabe4870edb308848897860da40dbb64b85dc3fc3e1ab6a5b35a07d7ae99308b

SHA512
972b82225272788673fd12f6839295d5702460a6f36645a235ae69859fa67515f7cb683eb409601d1f77486b8df69faa7ea98e68b3702cd3211a045fa3b9965e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca928cbd708c1b6a2f8f8634ef9db398

SHA1
7e6821c065e7c332db12d3f5e2d878edd7d676ef

SHA256
cee4e3a228c55135f674d2a18863f3849e7b823450c64c9d49a884a545dae69e

SHA512
a0fa652bd38b945d8c8cc73b8b9aea0d7aa07014f3cb05d4228fbfe1f8451125d707e300177fd8fca06136314ceb093efc8425132c45e8e7fca17efc8170c4ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f31c8a0b904bff2727a19fb3100d5899

SHA1
e74f1880efd9171e14551c7265fd32ef8ff7951d

SHA256
2241ac3e4a8e4250fe6a6fee618b84c665b6e082927b8fd276239c0f1b3e80d8

SHA512
75bfe0cd7af1d5acf5e2cefcfb51dad0151162f1595551a635159ddb05ced121630ac65bbb20a124e9c8e077c50d3f053d6aa1ca5278b7731256e2d00a2a1d38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08e309883d0d63497f46dab16f0173c9

SHA1
7362e6d68888efc088be0fbdccb1818625cda563

SHA256
2735a4f9b8c537afd9196e3b3fa0f63cfe56f1adfea251481b69ce8bbaa0d994

SHA512
962edee29053e36a040be72e342f9072ec852bcd8d90638c694be1cabc4b868dda77cc242950e9ade80402e83123840f5a702c858b2f1d7d7f4b88746fc844fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
379515dd1de5d53f3c9feb839d3f1005

SHA1
8a176c56bf60035f975196f20a51655c3fde550a

SHA256
00faa16e469e4be17f4fa850ac299422830fea8dade190e2b4714b2abc28e3e0

SHA512
1a3c0065c426fa42f8c3f515cbb9e1ecdd41caa0e2634767baf9c5eb4ec566ca4158b496375b6b3f8663de274331a55414739528a053a33f0319619845821508

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB7BC.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBC91.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit