Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
31/08/2024, 19:30
General
-
Target
0xBenz Spoofer.exe
-
Size
12.2MB
-
MD5
0a90d26fed44e0adc47a981f1bbb4be9
-
SHA1
51d5d7e5286cf8ebbd0bf995902e9c07cf5b9bdc
-
SHA256
57595f8217e40c3b92cabb2acba08e241f80e432551f5a5f09cb965b9d1361e2
-
SHA512
26cdcf12fdcfc23175b9fad8af4ea5334cf44fcb101401ed911a148d9920743cf443aadd8550bd1c21e049fa8b633f7b631444bef69c6928a00d9864fb057a37
-
SSDEEP
393216:7bhpZbRK0u3ezsWHYM2G1WKWLRTqAPLKEem2:fh7w0u3eA020+Rl+
Score
10/10
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
-
Suspicious Office macro 2 IoCs
Office document equipped with macros.
-
Executes dropped EXE 64 IoCs
-
Loads dropped DLL 64 IoCs
-
Adds Run key to start application 2 TTPs 50 IoCs
-
Drops file in Program Files directory 26 IoCs
-
Drops file in Windows directory 7 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Enumerates system info in registry 2 TTPs 64 IoCs
-
Modifies system certificate store 2 TTPs 6 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0xBenz Spoofer.exe"C:\Users\Admin\AppData\Local\Temp\0xBenz Spoofer.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_0xBenz Spoofer.exe"C:\Users\Admin\AppData\Local\Temp\._cache_0xBenz Spoofer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_0xBenz Spoofer.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_0xBenz Spoofer.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\._cache_._cache_0xBenz Spoofer.exe"4⤵
- Executes dropped EXE
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate5⤵
- Executes dropped EXE
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate5⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate6⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate7⤵
- Executes dropped EXE
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate7⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate8⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate9⤵
- Executes dropped EXE
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate8⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate9⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate10⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate11⤵
- Executes dropped EXE
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate10⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate11⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate12⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate13⤵
- Executes dropped EXE
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate12⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate13⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate14⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate15⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate14⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate15⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate16⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate17⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate18⤵
- Executes dropped EXE
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate18⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate19⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate21⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate22⤵
- Executes dropped EXE
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate23⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate25⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate26⤵
- Executes dropped EXE
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate26⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate27⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate28⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate29⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate30⤵
- Executes dropped EXE
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate30⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate31⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies system certificate store
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate32⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate33⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate35⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate36⤵
- Executes dropped EXE
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate37⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate38⤵
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate38⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate39⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate40⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate40⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate41⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate42⤵
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate42⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate43⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate44⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate44⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate45⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate46⤵
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate46⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate47⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate48⤵
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate48⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate49⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate50⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate50⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate51⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate52⤵
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate52⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate53⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate54⤵
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate54⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate55⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate56⤵
- System Location Discovery: System Language Discovery
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate56⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate57⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate58⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate58⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate59⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate60⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate60⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate61⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate62⤵
- System Location Discovery: System Language Discovery
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate62⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate63⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate64⤵
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate64⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate65⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate66⤵
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate66⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate67⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate68⤵
- System Location Discovery: System Language Discovery
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate68⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate69⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate70⤵
- System Location Discovery: System Language Discovery
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate70⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate71⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate72⤵
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate72⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate73⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate74⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate74⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate75⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate76⤵
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate76⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate77⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate78⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate78⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate79⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate80⤵
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate80⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate81⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate82⤵
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate82⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate83⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate84⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate84⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate85⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate86⤵
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate86⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate87⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate88⤵
- System Location Discovery: System Language Discovery
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate88⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate89⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate90⤵
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate90⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate91⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate92⤵
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate92⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate93⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate94⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate94⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate95⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate96⤵
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate96⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate97⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate98⤵
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate98⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate99⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate100⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate100⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate101⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding1⤵
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\svchost.exeC:\Windows\svchost.exe1⤵
- Executes dropped EXE
- Drops file in Program Files directory
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12.2MB
MD50a90d26fed44e0adc47a981f1bbb4be9
SHA151d5d7e5286cf8ebbd0bf995902e9c07cf5b9bdc
SHA25657595f8217e40c3b92cabb2acba08e241f80e432551f5a5f09cb965b9d1361e2
SHA51226cdcf12fdcfc23175b9fad8af4ea5334cf44fcb101401ed911a148d9920743cf443aadd8550bd1c21e049fa8b633f7b631444bef69c6928a00d9864fb057a37
-
Filesize
342B
MD5c7e3b4d1f3b0a056b68346ac1d8937ce
SHA18321b04d5cbff2595f8254820646184a0fd20ca7
SHA256189ebb7868cdf2c61eab089f0ec4cfe96b136a397c1c94c4898459d928dbec0e
SHA512fb809ae5082e0dd9506c70ddb7f41e1db5c4bf078daee0d96dd5983747e9454bd26d12b51c977e43aeb313facdc99fb50f31e78b8e2505e38e59924cb18c0e05
-
Filesize
2.5MB
MD5031e75678a57af86dd67875425327c0e
SHA171b97ea5712912b52a79fce5d2c53650027107bc
SHA256477d36ae2c56c912813e69b4feb69026f40562a57b85c844b7393852ccedb81d
SHA5125a1517854857b770d94e25ba51ada692a22f3e6b713e98a81e5efb01808d1e52a3934c2243e8ba5b954207e16b44dacd27aeb8b097e84299ea6ad1468a9b37e6
-
Filesize
11.4MB
MD51b5d0bbd718b6391d1d7b4805e11069f
SHA1f9c925f20bb0ac4ef0c0b11cbd954f5a06e155de
SHA25653b609b79d22f11772f228292e34f0e820d00ddbff25e5361ccd58efb8df06fc
SHA5129a5f1fde7aaf35075a74b01b6aa174789eba4812d0e0df745e5741689a6180ed9bc77b5b9acc99aaa93548ae1a04464fb5886d25698704c754865e4676294b2b
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
25KB
MD5bf8480b6151aa8e04af2701c0aaff19d
SHA1d3bad66919edd87f34c23d7973875cf0a360f019
SHA256517ee9ef4d37af6eba86da497d9189b280d55c441b2c968a8a79258c9f237ea9
SHA5128ea8cffc4c19bfdc9e281a96dcd0b29b3aaa6cd6b9ec8cb29994e18f43a8ff362894733bba35704177d47ff3bbaed96e4ff2746c5b3b9c4bbdc1193cf48dcdcc
-
Filesize
26KB
MD57e0ef9bbc400b1b1dca91326e121f238
SHA13f6d1693aba8c57b3c7ea647dcac24e1458e7b36
SHA2562260bede758022a7e61ba2af4551c413f930fcd5d09bab146ab90a67f294e2e5
SHA512a9808455c90bad318ec45396648d2bfc7bb4fa114fef53c00d5687069891ff886fad6f76115b6ec1ca88738398c5f165b47f61d172b70689114b1f84316ff052
-
Filesize
28KB
MD50a32ea5e7aa6549db164a290268956ca
SHA1b2d9ad5effbfdb5989d0fe7ffccad4226e073e4d
SHA25697c38ffb9fef547599c7540f3e6f9c74494981a1bc1e255d7d898cb58f0a7cbd
SHA51246fc7d5285d047273683bd4266934779a3cd11254cc5dd4456746ae8b4b544067fd91f6c29cf00f283bae96f1ce9a36ac2cc1bde1e7dd21d5615f857416cf3dd
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
35KB
MD59e3c13b6556d5636b745d3e466d47467
SHA12ac1c19e268c49bc508f83fe3d20f495deb3e538
SHA25620af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8
SHA5125a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b
-
Filesize
4.0MB
-
Filesize
2.1MB
-
Filesize
2.4MB
-
Filesize
4KB
-
Filesize
12.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
19.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
160KB