Analysis
- max time kernel
141s - max time network
151s - platform
windows7_x64 - resource
win7-20240708-en - submitted
16/08/2024, 15:13
Behavioral task
behavioral1
Sample
cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe
Resource
win7-20240708-en
windows7-x64
16 signatures
150 seconds
General
- Target cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe
- Size 1.2MB
- Sample240816-slrmta1frd
- SHA256 cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f
- MD5 7d02f09110ad1df45ef14e7a05571d47
- SHA1 07b378f5b8fc29af81e6eae984d4fd515a8a5ffb
- SHA512 388fe85b90b5641d8d1ac5219fc046a571dce944308ac24dd8f1580e121845d8145de42d35152124ade532ac86795e5bc7532272783b940a62058e78d0b60213
- SSDEEP 24576:rnsJ39LyjbJkQFMhmC+6GD9JA+vSoqYAQmZoftn8:rnsHyjtk2MYC5GDfBqoqYFm09
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
xred
C2
-
xred.mooo.com
Attributes
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
- Detect Neshta payload 39 IoCs
resource yara_rule behavioral1/files/0x0009000000016dd3-4.dat family_neshta behavioral1/files/0x0006000000018718-17.dat family_neshta behavioral1/memory/2364-40-0x0000000000400000-0x0000000000531000-memory.dmp family_neshta behavioral1/files/0x0007000000018728-57.dat family_neshta behavioral1/files/0x0001000000010316-61.dat family_neshta behavioral1/memory/2636-69-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x0001000000010314-60.dat family_neshta behavioral1/files/0x0021000000010625-59.dat family_neshta behavioral1/files/0x000700000001066d-58.dat family_neshta behavioral1/files/0x000100000000f77b-103.dat family_neshta behavioral1/files/0x000100000000f708-124.dat family_neshta behavioral1/files/0x0001000000010b95-144.dat family_neshta behavioral1/files/0x00010000000118e5-155.dat family_neshta behavioral1/files/0x0003000000012199-179.dat family_neshta behavioral1/files/0x0001000000011449-188.dat family_neshta behavioral1/files/0x00010000000115fa-193.dat family_neshta behavioral1/files/0x0001000000011608-197.dat family_neshta behavioral1/files/0x0001000000011874-201.dat family_neshta behavioral1/files/0x0001000000010f4d-208.dat family_neshta behavioral1/files/0x000100000001107f-217.dat family_neshta behavioral1/files/0x0002000000011080-220.dat family_neshta behavioral1/files/0x0001000000011a17-222.dat family_neshta behavioral1/files/0x0001000000011b5c-229.dat family_neshta behavioral1/files/0x0001000000011274-228.dat family_neshta behavioral1/files/0x0001000000011b21-227.dat family_neshta behavioral1/files/0x0001000000011288-230.dat family_neshta behavioral1/files/0x0003000000005abc-238.dat family_neshta behavioral1/files/0x000300000000e6f7-240.dat family_neshta behavioral1/files/0x000d0000000056d7-244.dat family_neshta behavioral1/files/0x0004000000005a4a-248.dat family_neshta behavioral1/files/0x0004000000005726-252.dat family_neshta behavioral1/files/0x00050000000055df-251.dat family_neshta behavioral1/memory/2352-257-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2868-256-0x0000000000400000-0x0000000000531000-memory.dmp family_neshta behavioral1/memory/2460-255-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2460-260-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2352-259-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2868-261-0x0000000000400000-0x0000000000531000-memory.dmp family_neshta behavioral1/memory/2868-293-0x0000000000400000-0x0000000000531000-memory.dmp family_neshta - Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
- Neshta family
- Xred family
- Executes dropped EXE 6 IoCs
pid Process 2460 ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe 2676 ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe 2868 Synaptics.exe 2352 ._cache_Synaptics.exe 2636 svchost.com 3036 _CACHE~2.EXE - Loads dropped DLL 18 IoCs
pid Process 2364 cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe 2364 cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe 2460 ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe 2364 cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe 2364 cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe 2868 Synaptics.exe 2868 Synaptics.exe 2868 Synaptics.exe 2636 svchost.com 2352 ._cache_Synaptics.exe 2460 ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe 2352 ._cache_Synaptics.exe 2352 ._cache_Synaptics.exe 2460 ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe 2352 ._cache_Synaptics.exe 2352 ._cache_Synaptics.exe 2460 ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe 2352 ._cache_Synaptics.exe - Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\????? = "C:\\ProgramData\\Synaptics\\Synaptics.exe" cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE ._cache_Synaptics.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe ._cache_Synaptics.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE ._cache_Synaptics.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE ._cache_Synaptics.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE ._cache_Synaptics.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe ._cache_Synaptics.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE ._cache_Synaptics.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe ._cache_Synaptics.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe ._cache_Synaptics.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe ._cache_Synaptics.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE ._cache_Synaptics.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE ._cache_Synaptics.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE ._cache_Synaptics.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe ._cache_Synaptics.exe File opened for modification C:\PROGRA~3\SYNAPT~1\SYNAPT~1.EXE ._cache_Synaptics.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE ._cache_Synaptics.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE ._cache_Synaptics.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe ._cache_Synaptics.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe ._cache_Synaptics.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE ._cache_Synaptics.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE ._cache_Synaptics.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE ._cache_Synaptics.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE ._cache_Synaptics.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe ._cache_Synaptics.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe ._cache_Synaptics.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE ._cache_Synaptics.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE ._cache_Synaptics.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe ._cache_Synaptics.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe ._cache_Synaptics.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe File opened for modification C:\Windows\svchost.com ._cache_Synaptics.exe File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language _CACHE~2.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE - Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE - Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2576 EXCEL.EXE - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2576 EXCEL.EXE - Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2364 wrote to memory of 2460 2364 cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe 31 PID 2364 wrote to memory of 2460 2364 cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe 31 PID 2364 wrote to memory of 2460 2364 cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe 31 PID 2364 wrote to memory of 2460 2364 cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe 31 PID 2460 wrote to memory of 2676 2460 ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe 32 PID 2460 wrote to memory of 2676 2460 ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe 32 PID 2460 wrote to memory of 2676 2460 ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe 32 PID 2460 wrote to memory of 2676 2460 ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe 32 PID 2364 wrote to memory of 2868 2364 cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe 33 PID 2364 wrote to memory of 2868 2364 cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe 33 PID 2364 wrote to memory of 2868 2364 cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe 33 PID 2364 wrote to memory of 2868 2364 cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe 33 PID 2868 wrote to memory of 2352 2868 Synaptics.exe 34 PID 2868 wrote to memory of 2352 2868 Synaptics.exe 34 PID 2868 wrote to memory of 2352 2868 Synaptics.exe 34 PID 2868 wrote to memory of 2352 2868 Synaptics.exe 34 PID 2352 wrote to memory of 2636 2352 ._cache_Synaptics.exe 36 PID 2352 wrote to memory of 2636 2352 ._cache_Synaptics.exe 36 PID 2352 wrote to memory of 2636 2352 ._cache_Synaptics.exe 36 PID 2352 wrote to memory of 2636 2352 ._cache_Synaptics.exe 36 PID 2636 wrote to memory of 3036 2636 svchost.com 37 PID 2636 wrote to memory of 3036 2636 svchost.com 37 PID 2636 wrote to memory of 3036 2636 svchost.com 37 PID 2636 wrote to memory of 3036 2636 svchost.com 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe"C:\Users\Admin\AppData\Local\Temp\cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe"C:\Users\Admin\AppData\Local\Temp\._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2676
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3036
-
-
-
-
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2576
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE
- Size 859KB
- SHA256 ead58c483cb20bcd57464f8a4929079539d634f469b213054bf737d227c026dc
- MD5 02ee6a3424782531461fb2f10713d3c1
- SHA1 b581a2c365d93ebb629e8363fd9f69afc673123f
- SHA512 6c9272cb1b6bde3ee887e1463ab30ea76568cb1a285d11393337b78c4ad1c3b7e6ce47646a92ab6d70bff4b02ab9d699b84af9437b720e52dcd35579fe2693ec
- SSDEEP 24576:XWq1lx7SqE0xJ2pm8FiWCm3LHgZpJEHp37d:XWq171dxJ6mAQm3LHkJEJLd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe
- Size 547KB
- SHA256 593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d
- MD5 cf6c595d3e5e9667667af096762fd9c4
- SHA1 9bb44da8d7f6457099cb56e4f7d1026963dce7ce
- SHA512 ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80
- SSDEEP 12288:4wXwNSO5X3IA1iBihI7XHgZQKhJgeCmvz016:4ew0O1IA1UiuLHgZpJEGgg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MSOCache\ALLUSE~1\{9A861~1\ose.exe
- Size 186KB
- SHA256 2a0aa0763fdef9c38c5dd4d50703f0c7e27f4903c139804ec75e55f8388139ae
- MD5 58b58875a50a0d8b5e7be7d6ac685164
- SHA1 1e0b89c1b2585c76e758e9141b846ed4477b0662
- SHA512 d67214077162a105d01b11a8e207fab08b45b08fbfba0615a2ea146e1dd99eea35e4f02958a1754d3192292c00caf777f186f0a362e4b8b0da51fabbdb76375b
- SSDEEP 3072:sr85Ca4Kw6JrokFyF5Zat/Vq09oe4QgNOd3z7:k9X6rokFyENNjOc7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MSOCache\ALLUSE~1\{9A861~1\setup.exe
- Size 1.1MB
- SHA256 e17cd94c08fc0e001a49f43a0801cea4625fb9aee211b6dfebebec446c21f460
- MD5 566ed4f62fdc96f175afedd811fa0370
- SHA1 d4b47adc40e0d5a9391d3f6f2942d1889dd2a451
- SHA512 cdf8f508d396a1a0d2e0fc25f2ae46398b25039a0dafa0919737cc44e3e926ebae4c3aa26f1a3441511430f1a36241f8e61c515a5d9bd98ad4740d4d0f7b8db7
- SSDEEP 12288:buphfCWQIbDUhUOvF7CehnLQie+I7XHgZQKhJgeCmyDLFSLfmLU7ksep:befCnE7Oduehsi0LHgZpJEdDZSx7ksep
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe
- Size 422KB
- SHA256 a89419fc4ba9bf5f7ac6b348428ee57403fec3b5964f9e49b6eea49d779f4071
- MD5 8bb6d1d1f40099aa6a629fbb036a8cb3
- SHA1 8b388ca335032e3b04b0a7d1351ce25c61b4ba52
- SHA512 3015b210c79a4c61143fa56d62caabc5aebfe8d95b20753aa7f52ed0bcd4faf801134e5ee614c3714d95da666e0548f88db4d3df96d6d7e0e124c5a5add23a81
- SSDEEP 1536:JxqjQ+P04wsmJCDP9aJfXgY1zUTyr5hVaSal6WZPFoacFYwo+e9nyLUYZQgO59OQ:sr85CT+XgTTSjMS3u45knkZlO5xr85C
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe
- Size 414KB
- SHA256 5ab884509927dedddbd6e65e539436638be2d2267d7593de60ec1b4686df3e80
- MD5 e44497b628f663fd0ae07c9b4390452d
- SHA1 d850535c67bed4d6bb158b9a3eb595be912f9c62
- SHA512 5028f949b3e75534481c059f115efefc87331becc70221408de2408e7148db91b9357fb5b44a43c5cf76d1a389c011082cff28b5f0aea5b0822ae55e98be7105
- SSDEEP 6144:k9qIFQSDdABbSbIrx1L1l3ERDCH9L5d5ezL79:H+0BbSox1QDCH9E
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE
- Size 588KB
- SHA256 ca5263f340cc735ba279532bbd9fe505fcf05d81b52614e05aff31c14d18f831
- MD5 c275134502929608464f4400dd4971ab
- SHA1 107b91a5249425c83700d64aff4b57652039699d
- SHA512 913cadcb575519f924333c80588781caecd6cd5f176dc22ac7391f154ffc3b3f7302d010433c22c96fde3591cac79df3252798e52abf5706517493ef87a7ef7d
- SSDEEP 12288:4wXwNSO5X3IA1iBihI7XHgZQKhJgeCmvz01:4ew0O1IA1UiuLHgZpJEGg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe
- Size 246KB
- SHA256 2b63642dda15e68100fa82e82d35b1527a27372a82bac940279250694b923ae1
- MD5 ccc63893fce0c93881bb86bb1db8fd4f
- SHA1 cf6b2f4151a24efb0e999bf140bc8c591852476f
- SHA512 993a684fb50aed14c5c41c7227de3cacf17ee221ecae584001e0536e0422798fbc329e03eee3b1b48cced32e3d7c7e073280bc216d90f360e49f5e4f87763c63
- SSDEEP 3072:sr85CBs5NWruhTyL5rfnf5sJqdk1NW8955mcKxVSr85C:k9PruhmL5KJqeWsWNxs9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRA~2\Google\Update\DISABL~1.EXE
- Size 248KB
- SHA256 b3c0c2c2eba96fb385979636c2593d7322ef3d72a6d67cad4bb9ef64f7eb4699
- MD5 6a57dc8a285dc9738c88e78fba506d22
- SHA1 6c7fbb72d162b60ae27df884aa379c9e41ecbf9d
- SHA512 4d559ded8758ce92b4f2bb7ad819873aa6fcb4f351e1aec820d49ba87cb840a593f9c6dca6f5244bbe4748b9f1c623e981ba0e77ad57e1364a1876f6fc3a88f1
- SSDEEP 3072:sr85C8aKavT/DvbEvK9aobNI2B+DlIH3angqtirxzGlB89Vo6FoCG55lO/X9umgP:k98aK2h9H/B+3Ch8tiP49
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE
- Size 228KB
- SHA256 c70151fc7fb7d461ba596455bfc7e79e199a3c0ac766c5d67f9347b39e20b7b9
- MD5 b19c2fa49e278935e6a3087fdd0da46e
- SHA1 04a5de16b6840a8fe68753028bd2ff20381ed720
- SHA512 0399a45ee6a87d5899020d4106bc6ff521285b34c61afcd4929b6274166f7585c01749a1ee1814e82c90a5d8deb1dfa28bde6b105029f74d33f7a3e848d0dc39
- SSDEEP 3072:sr85CWJCtnsk7IIesI0xv9wsOJ6iiEQd8695tdYA7fiLrQoAurtzKBr85C:k9WJCp8sIc3OJX2vZYK9uJKd9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE
- Size 605KB
- SHA256 3fb179a3ae88a3d14db48de29d4b9d43243b80b2118b578b8117ad776ce47f12
- MD5 8acc19705a625e2d4fa8b65214d7070a
- SHA1 ad16e49369c76c6826a18d136bf9618e8e99ec12
- SHA512 92e22275194b5a73d825e1e7ad5a5cb5649d3679f545f88328aa72e39c161c4d797b7b3462e590edf546ddbd53c1508a49056f50fa63b113134e1bdc7d977dec
- SSDEEP 12288:zSXACora0qwP6WutfTsbI7XHgZQKhJgeCmVuSv9:2XACofqT9TssLHgZpJEEuSv9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE
- Size 1.7MB
- SHA256 da5cc08eb0aa368f19ce481b3f9236203a6f40303d77ad30b94912dba22ca08d
- MD5 338f328b613632e6df24a00a49864835
- SHA1 249a3f7c546aa66d98c4fbda2001bc649bc80013
- SHA512 f59dc126be5bf72f802e6681f5af30ce947d7ad6e6b506612c8d6b49e2a5e2d597838311c474fd59e0b976453cf389cecb5443971019b307f2b52a1564ae69a8
- SSDEEP 24576:o71UQW/4N7AR5PFEjmKG0gFRKa8Wr0oVf3Zh:oOBdzsNeQAZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE
- Size 109KB
- SHA256 380154eab37e79ed26a7142b773b8a8df6627c64c99a434d5a849b18d34805ba
- MD5 44623cc33b1bd689381de8fe6bcd90d1
- SHA1 187d4f8795c6f87dd402802723e4611bf1d8089e
- SHA512 19002885176caceb235da69ee5af07a92b18dac0fb8bb177f2c1e7413f6606b1666e0ea20f5b95b4fa3d82a3793b1dbe4a430f6f84a991686b024c4e11606082
- SSDEEP 3072:sr85CKdogcgVZlhOP4l9ovN7hYFjZUAFxO9:k9KdJcehOPQcibUoG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE
- Size 144KB
- SHA256 b35e60f1551870c1281d673380fe3101cd91b1f0b4d3c14c2383060f5e120373
- MD5 a2dddf04b395f8a08f12001318cc72a4
- SHA1 1bd72e6e9230d94f07297c6fcde3d7f752563198
- SHA512 2159df98d90467720b738be68bee5aba38980d2449c18d2ea4b7b9bae7d222b4a85845d0f9597017d0ee417964190bc3d95cb4809e33aac16b6cfa6ec200dce3
- SSDEEP 3072:sr85CxKdtsLB5V4pOr+j3z1SE7c95uQ6g3/uKUu8QZyF+B:k9x3L54pO6jDf7M4QR3vUvQGo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE
- Size 2.1MB
- SHA256 8f9fb3c2ce132a64e157738feaf82bb512ec03d03fa2da95c26470defeef513d
- MD5 6b63036a88f260b7a08da9814cf17ce0
- SHA1 cac1bd549343a1c3fcefacc2d588155a00c4467b
- SHA512 383b8676a85e0f2447536bd15019c23bed15a51d633dafe5ac7bcbea75d8064ef9fd938461eab25df7f3eae3de18b87640e8cc12e95f7b58de1209937d8da284
- SSDEEP 49152:LhgAgyZURQJcW/tH+40IVdNRQKKL9d+Lq89TqhWzUL:LhgAgyZURQJcW/tH+40IVdQKKL9d+Lq/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE
- Size 3.7MB
- SHA256 39a089d363b15c37cca9f747a17e89ad1dbe0bc86ff23466526beaa5e36d6d4b
- MD5 525f8201ec895d5d6bb2a7d344efa683
- SHA1 a87dae5b06e86025abc91245809bcb81eb9aacf9
- SHA512 f0a2070f11eb3f0bdf996ada42becc7710aab76e84268e5cdbbd9ecbf13ef5fb85b52b6227711137a9c511f8d731b018530cbf1935f8fcfd61ff2ef6c1348d63
- SSDEEP 98304:5hgAs+MmJcW/tH+405o3KKA9d+LH89TXKKtyZURQecW/tzVdhB4L6X7vW/L/SURL:5hgf+MvW/te40W3KKi+Lc9TXKKwURQnd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE
- Size 549KB
- SHA256 5811b7b694d99c703b4c4bc72d6b7d846d05b2b0f45a7e3e4279cdb6fd81265f
- MD5 61631e66dbe2694a93e5dc936dd273be
- SHA1 b1838b8ca92fa5ca89e1108ceb2630a6ecd2b8c2
- SHA512 323463c267ccdb701d5967198f4f72158056f5a6e889c47bf19d1a670233ab071a5fe8c108430beb67753b77af1c59028007101a8e1266618fe91fa0127b4dcf
- SSDEEP 6144:k9XKPGiE881sbXw1AFhzyMTtDyPhPNli1OQr4Kdyj7XKUTa8m23d7KJqKWMJcjoP:ux886wuFhSZfitI7XHgZQKhJgeCmWy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE
- Size 606KB
- SHA256 2a189b995a7283b503bb5864dd9ca57976b3812a6a34aaf89a7551336c43bc24
- MD5 9b1c9f74ac985eab6f8e5b27441a757b
- SHA1 9a2cf7d2518c5f5db405e5bd8d37bf62dcaf34f5
- SHA512 d72e83aeaf1d34627a6c6aa469821af8a8d464a72c764fbb064484adea509a8c1d3628e2166859286e84daae8ebdf4f800693ce203984a8c313b1f2263e101c4
- SSDEEP 12288:oDMmDcwyetl72rtwOXQI7XHgZQKhJgeCm04T:oDMmDnD72rtwOXHLHgZpJEP4T
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE
- Size 1.4MB
- SHA256 07dd9364be7babc5f9a08f0ccd828a9a55137845df1782b147f12943f234ea4e
- MD5 5ae9c0c497949584ffa06f028a6605ab
- SHA1 eb24dbd3c8952ee20411691326d650f98d24e992
- SHA512 2e99bb500c281c367cc54fa283905b2537905ea4fe8986f676adbb1aaf58460dd2db082bb46a3dbe9dc836fbae3ee8832990839432dd99c74de58cc9b9295788
- SSDEEP 24576:4LZmQR3caJZLZmvNzc0TDZodoSRsfHMbvmQakM:0ZmQyaJ1ZmFcqi+SRAG+F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE
- Size 1.8MB
- SHA256 bb1814297615d6b22fa20ee4f8613c8bc9fa67d93cb7fe032f46f377569e2f46
- MD5 fc87e701e7aab07cd97897512ab33660
- SHA1 65dcd8e5715f2e4973fb6b271ffcb4af9cefae53
- SHA512 b03e3b3f7b0f11b85757d8bf5678542f4281407e95cf8e074da4ddc421c217fcfaf23cc927ccd0bbca2891a424b2d3565072aba6406dc46c2fa1fdba7a249eec
- SSDEEP 24576:NUZmYH9NDu3RsXHMblnUc0TD3mcr286R39FJgMihUQLWY:KZmYH9N63RUGlnUcqWcy86jFJgbhUQV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE
- Size 1.5MB
- SHA256 ad3a9f7beaaea0bc49a7ccba83198cfb2882d462441203684076695b0ef6c514
- MD5 93766da984541820057ae0ab3d578928
- SHA1 ea19a657c6b1b5eb5accc09c45dcf04f063151c3
- SHA512 e14c86e13ab79fa9b9eb1a05d69764d522c4acfab7742c200080b215bb3bc31ec7f3dd2abf44cbc996d2e58a0ca1990b18ab055b232b243fe61b5fb018a9b719
- SSDEEP 24576:lhebUD+zf9/ktq18GlyOPyOCBhyOJG+vfvzHmJvzHmBG+WYryOwL9VaBxE/KtH2n:lheQD+zBktqWGljPjwjJGsDGlGBG1Yrw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE
- Size 674KB
- SHA256 c48abbc29405559e68cc9f8fc6d218aa317a9d0023839c7846ca509c1f563fea
- MD5 97510a7d9bf0811a6ea89fad85a9f3f3
- SHA1 2ac0c49b66a92789be65580a38ae9798237711db
- SHA512 2a93e2a3bd187fdde160f87ef777ccd1d1c398d547b7c869e6b64469b9418ad04d887cdfe94af7407476377bf2d009f576de3935c025b7aefbab26fbcd8f90fb
- SSDEEP 12288:kskY7gjcjhVIEhqgM7bWvcsi6aVOfIyWL2JGP9/ztLlAZHYdnMwJ:ksZgjS1hqgSC/izGfU2JGlbhlAZ4RMK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE
- Size 674KB
- SHA256 ccf37e88447a7afdb0ba4351b8c5606dbb05b984fb133194d71bcc00d7be4e36
- MD5 9c10a5ec52c145d340df7eafdb69c478
- SHA1 57f3d99e41d123ad5f185fc21454367a7285db42
- SHA512 2704cfd1a708bfca6db7c52467d3abf0b09313db0cdd1ea8e5d48504c8240c4bf24e677f17c5df9e3ac1f6a678e0328e73e951dc4481f35027cb03b2966dc38f
- SSDEEP 12288:kskY7gjcjhVIEhqgM7bWvcsi6aVtrIyzU40vy3W/ceKSHMsiFyY6XN94nMwJ:ksZgjS1hqgSC/izJfojymk4HM5yJoMK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE
- Size 485KB
- SHA256 8d0045c74270281c705009d49441167c8a51ac70b720f84ff941b39fad220919
- MD5 87f15006aea3b4433e226882a56f188d
- SHA1 e3ad6beb8229af62b0824151dbf546c0506d4f65
- SHA512 b01a8af6dc836044d2adc6828654fa7a187c3f7ffe2a4db4c73021be6d121f9c1c47b1643513c3f25c0e1b5123b8ce2dc78b2ca8ce638a09c2171f158762c7c1
- SSDEEP 12288:/0IursYCYQeSnyZJiqlEbXSb9NtCGOF2O27MVz+ZH:8MYenGJiKEbXWtfOkU+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE
- Size 495KB
- SHA256 d882f673ddf40a7ea6d89ce25e4ee55d94a5ef0b5403aa8d86656fd960d0e4ac
- MD5 07e194ce831b1846111eb6c8b176c86e
- SHA1 b9c83ec3b0949cb661878fb1a8b43a073e15baf1
- SHA512 55f9b6d3199aa60d836b6792ae55731236fb2a99c79ce8522e07e579c64eabb88fa413c02632deb87a361dd8490361aa1424beed2e01ba28be220f8c676a1bb5
- SSDEEP 6144:k98Mq5S+Ud8AK+ehB9XgdmAeUBZ2x52OoElZTxPhhQgO1OiP6dQguVftf4qIuRes:tU8AMXE9B7PElZlP41f60OqIO7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Synaptics\Synaptics.exe
- Size 1.2MB
- SHA256 cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f
- MD5 7d02f09110ad1df45ef14e7a05571d47
- SHA1 07b378f5b8fc29af81e6eae984d4fd515a8a5ffb
- SHA512 388fe85b90b5641d8d1ac5219fc046a571dce944308ac24dd8f1580e121845d8145de42d35152124ade532ac86795e5bc7532272783b940a62058e78d0b60213
- SSDEEP 24576:rnsJ39LyjbJkQFMhmC+6GD9JA+vSoqYAQmZoftn8:rnsHyjtk2MYC5GDfBqoqYFm09
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\ALLUSE~1\PACKAG~1\{33D1F~1\VCREDI~1.EXE
- Size 485KB
- SHA256 8c35dcc975a5c7c687686a3970306452476d17a89787bc5bd3bf21b9de0d36a5
- MD5 86749cd13537a694795be5d87ef7106d
- SHA1 538030845680a8be8219618daee29e368dc1e06c
- SHA512 7b6ae20515fb6b13701df422cbb0844d26c8a98087b2758427781f0bf11eb9ec5da029096e42960bf99ddd3d4f817db6e29ac172039110df6ea92547d331db4c
- SSDEEP 12288:/0IursYCYQeSnyZJiqlEbXSb9NtoqOFBqkYHkZH:8MYenGJiKEbXWtpOLl5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\ALLUSE~1\PACKAG~1\{61087~1\VCREDI~1.EXE
- Size 536KB
- SHA256 7c4fd44a9cda339ac3e7fa93b0b2a24b1e0ac16996dbb19cfdcd6323170b1fd3
- MD5 349c6f2f4e32553e8fea4d29772e40e6
- SHA1 e2f7856aa519006f8cbc9943cc3fb34c4461932d
- SHA512 0b9f9aafb1a682f9e5a5dccae0dc19e3cf21c5d2aa4df3e22311f5744255f668e9a1e11ee21f2656d9f45236c484e0b7b460a57db1c34f2d344bd4cbece42588
- SSDEEP 6144:k98Mq5S+Ud8AK+ehB9XgdmAeUBZ2x52OoElZTxPhhQgO1Oi9+8Vl9fAx/WfoMnqb:tU8AMXE9B7PElZlP41N+4PUWfouqIO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\AvraVkhc.xlsm
- Size 17KB
- SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
- MD5 e566fc53051035e1e6fd0ed1823de0f9
- SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
- SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
- SSDEEP 384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\AvraVkhc.xlsm
- Size 22KB
- SHA256 fbcba9c88e444da4e1f4d6f7614caeafb9dd0212fabadc5cb05e89125491938f
- MD5 9336aaca2ab6da754371175f42f8312d
- SHA1 170bcb52d39695d24f5a8b2e6924627f89e6b306
- SHA512 debea2f04eda1e130adf7d477e05a54eed2149427240dee6130af6ff876110d9804884a6e59fdbefdf4efae8aec469afee8220959e341e2924154ded78741119
- SSDEEP 384:50abGBP+UC4E1FVm3Bvr0Uxgsmvbfbyt9xvVmfVy41o5hNIRLMPl:uaCBP+gEzVm3nXybf+tLgf0PAF8l
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\AvraVkhc.xlsm
- Size 25KB
- SHA256 5d4366a701fc851d41226b0758eb04f81130f24d22db963a42b52639f5c19205
- MD5 7b091c505e26e02891d1db7a60adee07
- SHA1 2600a498cf7e355f13442697b8d434500be5b9ba
- SHA512 60ebe8b515fd5de34d9687fbda49dfe367a30b9a8eff3948d54e480ef3f7e53b6cec5d30c5e088d84a06c74b14d58f1b9e46568046be4548b6d5f30cde076073
- SSDEEP 384:50aEBP+UQqCccE1FV8yvzFIJePGZi0NAlNPJNMlvmZ5+oQtU8zDURv9vuE:uaEBP+oAEzVXiePB1WeZ5+tUnRF7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\svchost.com
- Size 40KB
- SHA256 980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2
- MD5 36fd5e09c417c767a952b4609d73a54b
- SHA1 299399c5a2403080a5bf67fb46faec210025b36d
- SHA512 1813a6a5b47a9b2cd3958cf4556714ae240f2aa19d0a241b596830f0f2b89a33ec864d00ce6a791d323a58dfbff42a0fded65eefbf980c92685e25c0ec415d92
- SSDEEP 768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJ:JxqjQ+P04wsmJC
- MD5 SHA1 SHA512 SSDEEP
- Path \PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
- Size 252KB
- SHA256 8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
- MD5 9e2b9928c89a9d0da1d3e8f4bd96afa7
- SHA1 ec66cda99f44b62470c6930e5afda061579cde35
- SHA512 2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156
- SSDEEP 6144:gMTi0+lfh+L5qe9T5q4GAFzWTBPMmC1UC6fOaU:gMTi0uhMqe9ts2zWTpMmCG7W
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe
- Size 450KB
- SHA256 4f603bf5e6a8d1fa2b0df6cc37fd13e55bd13029f46709c70369d669f2604324
- MD5 be8371a4c3fb5afb6bd91a44e3a54739
- SHA1 5b60f0e56b16bad98c37851d98e7623e43ca7b5e
- SHA512 cfced0b29d017f929456da4b7061a84aea657838f43dd801fdc9a4c8b30c3b9a974780ea03b4de3537e8987bcac0efc87f795420f5bc6ada4425d29b5f6742be
- SSDEEP 12288:KEjxLDavg3JmwxY1kzE+QIrZoftjNBBIHs:KA+vSoqYAQmZoftn8s
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\3582-490\._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe
- Size 410KB
- SHA256 8abd2e44b28a87912dd7e5f2df8e306aa44b690807edc2c136a6818115252252
- MD5 a6d666dec7754bb7de0dc848f17ea7de
- SHA1 884156c2d0aab42ccdcf9bb62b9f6b607f115838
- SHA512 f7863009ebdf92db41081dd5e9b454669f8ffd11c7eb230229f4d27153bfdb154609b04229bb9a033ffe65541fc778ed629016ccf30df728ae075ab2a08fc98f
- SSDEEP 12288:VHsEjxLDavg3JmwxY1kzE+QIrZoftjNBBC:hsA+vSoqYAQmZoftnU
- MD5 SHA1 SHA512 SSDEEP