Analysis
-
max time kernel
141s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
31/08/2024, 19:30
General
-
Target
0xBenz Spoofer.exe
-
Size
12.2MB
-
MD5
0a90d26fed44e0adc47a981f1bbb4be9
-
SHA1
51d5d7e5286cf8ebbd0bf995902e9c07cf5b9bdc
-
SHA256
57595f8217e40c3b92cabb2acba08e241f80e432551f5a5f09cb965b9d1361e2
-
SHA512
26cdcf12fdcfc23175b9fad8af4ea5334cf44fcb101401ed911a148d9920743cf443aadd8550bd1c21e049fa8b633f7b631444bef69c6928a00d9864fb057a37
-
SSDEEP
393216:7bhpZbRK0u3ezsWHYM2G1WKWLRTqAPLKEem2:fh7w0u3eA020+Rl+
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
-
Suspicious Office macro 2 IoCs
Office document equipped with macros.
-
Checks computer location settings 2 TTPs 51 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 64 IoCs
-
Loads dropped DLL 64 IoCs
-
Adds Run key to start application 2 TTPs 25 IoCs
-
Drops file in Program Files directory 38 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 12 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 64 IoCs
-
Modifies registry class 51 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 26 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0xBenz Spoofer.exe"C:\Users\Admin\AppData\Local\Temp\0xBenz Spoofer.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_0xBenz Spoofer.exe"C:\Users\Admin\AppData\Local\Temp\._cache_0xBenz Spoofer.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_0xBenz Spoofer.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_0xBenz Spoofer.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\._cache_._cache_0xBenz Spoofer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_0xBenz Spoofer.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_0xBenz Spoofer.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
-
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate5⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate6⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate7⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate8⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate9⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate10⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate11⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate12⤵
- Executes dropped EXE
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate13⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate15⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate16⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate17⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate18⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate19⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate20⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate21⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate22⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate23⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate24⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate25⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate26⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate27⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate28⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate29⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate30⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate31⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate32⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate33⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate34⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate35⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate36⤵
- Executes dropped EXE
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate36⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate37⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate38⤵
- Executes dropped EXE
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate38⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate39⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate40⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate41⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate42⤵
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate42⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate43⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate44⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate44⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate45⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate46⤵
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate46⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate47⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate48⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate48⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate49⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate50⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate50⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate51⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe" InjUpdate52⤵
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate52⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate53⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\svchost.exeC:\Windows\svchost.exe1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11.4MB
MD501028bb209d7f19090bc6b58dd9974b8
SHA1d68b0bb100210464959d80528c4686db215a6e27
SHA2567c433d6caea68c27cff2c6980231a32ff5889a8c1b2a7943b42c9bccca2fac54
SHA512f8d8ad8104236343e7a11c7e3d3baf25f3793dfbd73ad7aa3ffe4989c5e6e85f2ccc88b5a0bdbe6667e92977ef02328d96b098b45c79890701c87a25e2ec6971
-
Filesize
11.4MB
MD54297039d9032c746cd9c119418563729
SHA1703388c52a7d1cc92c1e5d3a0871dd27cfed3cb2
SHA2567fd1d00e4d80401e4dd9d5ebd573c17cc6413707b67d3df59ad081ce43486642
SHA512f6171e6d4c1cd1dbf13059b994728c3658f0d04d19c15a4021f15330b1ac98533f476b06172d34f83fe08fc3d1a757e30952b6f14a415305d71647b180d8bac0
-
Filesize
11.4MB
MD525bc6cdd9dd83c167e15c7bdee0501db
SHA19800e7a6a38ad3fe6aa9616e6105de9cecabe9ef
SHA25633538d3524bea989ae3d9a6bbd201ec1592b11cf3015c96854ae73e97f72a494
SHA51210f79f0499d4bc5cdd1643ac3f597228e2ba203721e6963c3de792085b43f906aeeaed5f454bcd90dd6c9de5e8848a86933eed7c4b65a46be15ca36c85cba68d
-
Filesize
11.4MB
MD53113b751dcf03608050ed0af52b4f6f7
SHA1be2f56a968c13d07a37f76a604623591008326f9
SHA256a1e032c8e65f8449128490dda69a45bcf28a94b2f40fa45d78a1802ae1f2a67f
SHA5120b6d9abcc9969172291b23d0f9ea5be17d20b0a079be863db40e21858e54b28cc568ba36b5f9ef278f4b5b0e68ed25d009841177b5a8fd34963186f25af34df1
-
Filesize
471B
MD540d3772d6d4e703d383161da620db712
SHA19b90eea9b44ad7de50c1202220a5d83b091fa5e4
SHA256dcae5c5c871c9b1ca73e42cef69f9c988245f8665f6cb5565d0b60f557c3dd5a
SHA5122c090d1441e9639b5447b9054281f21acab95b4a42a1e42282e441469abf88557b923bd32288f1914991d36683429d8aa8143f0f55b1aa9dac594c1909b2ed72
-
Filesize
412B
MD57cf9b7f3ee046fb9d6d2c517cdc562c6
SHA11f2f7f7869193bb0d5eedeebd2053fd7c598dfe9
SHA256250d984d8b31cf79a510e383e92533d9deac1e4d1a997cdde88d00f0fef4d275
SHA512dde85b93dec200ec2615c81701c770243abcfb69b1aa2b102dd6838c073df11c131289567b0d02e57e9ca13c3943f696e632057f21404bbc9e0721d298dd0d56
-
Filesize
1KB
MD57ebe314bf617dc3e48b995a6c352740c
SHA1538f643b7b30f9231a3035c448607f767527a870
SHA25648178f884b8a4dd96e330b210b0530667d9473a7629fc6b4ad12b614bf438ee8
SHA5120ba9d8f4244c15285e254d27b4bff7c49344ff845c48bc0bf0d8563072fab4d6f7a6abe6b6742e8375a08e9a3b3e5d5dc4937ab428dbe2dd8e62892fda04507e
-
Filesize
170KB
MD5d7d6ac35dd175a8bfd0c1fffa83e4e99
SHA17026d4a1237d63969edb48bad57a82df9c496121
SHA2568a5af4ac5ee9be9898bcf97eecfb19b737c2f4c69173af2237d0a1e8b625c071
SHA51216e60284aff70766191349e34568f7f559fb006762cff958998f4ab8d48978f1d8043d9aa37d7d0ce0cb9d82bcb149f70f8d74e0854d1a1c8f40fa607967a945
-
Filesize
10KB
MD5b28a78ac8fc79e12592dbcdff5b9bdbc
SHA1dc425e1f8b5ff420cb21e81daaf0710052fc6ae2
SHA256ae215cdba0ca3e64b1b2b574bed49427f5c86ef91cf7a2e8c9eba23918604d58
SHA512480e4bb6282ffefe59523c464fdec57227019f5f250df7e9d11af7ac91dfe0627e324cfcf1bf04b6f2a778e17f5620626040ed8c94dcd1069a4dc12c95a0b367
-
Filesize
13KB
MD5650977ed134d858a80e41f919e16107d
SHA1483ebe8f56cd480144ea8db5a2ed73f8a3dbf0b6
SHA256d97d56f5e1893881bd684e84e5c2fdc9e2f0751ed92755898e2f31f71765c52e
SHA51221ad8d90f28f72d6f4a4d7e27aef9ab1a05ce0c4237c6b6028dd0d7be7919ccece180b79d9eccc95042f3f57290571de2b9527d5477a5aa5a77a02bff149c73b
-
Filesize
15KB
MD5825775d9d25bf0b7315d87b8d1284a64
SHA18539d6c5e4062814da42eff5b72d2452005ac25c
SHA256bf44c30ccab21b902228e9293e5dd5a5b9a61617001952ec1c067903885e63ba
SHA512916e7d9848ea043d2cf224f09dcba98e90b4eae0f38f537a9b6821378490afd5765ba382339e989c89e01b0467aa207b1c3eaa581135acdc172ee32c02007fdd
-
Filesize
12KB
MD5dadf1224d67969a5e585e5e4d8b6e50a
SHA1faf7482c76c157c53d21a74ee3df6db607c48d81
SHA25607db335d0daaede68c2014d829a63362168148862c7295b1203a8a9e1ebeb565
SHA512716ceb4710e38b64ccfcca26b0ce4eee1c7075f70fbf8667a738032b2d940eabb6041751c4c733722a926a2d2133d1a9048c67b359d4f0b89217a0a66d4fb6b8
-
Filesize
16KB
MD59c2d8bf587e96745bef8ec162276a636
SHA115f4b795c5a85730f000a4089d70ad7f8423f521
SHA25608f60d1f6f8dec258dc18ba515851df38cbcdb62768f188445dd34bf8531e23d
SHA512588f58cec21b054338e647bb53d13fdf325a3ce91bad35ffeb85edb575f9fcf1763806c2152f96b14eb2a045ee593b6b4ea1381794fce883ea7f73c8a4a28f43
-
Filesize
20KB
MD5cea88667af1b77381ef1014c3fbe384d
SHA143a1eeb700e0ef0ddace178f9aa89ab0dd9d33db
SHA256f3654202234623202caf861729d4a2f193fcd4d6657aa040a0fa51a0a6a3e6b3
SHA512a6432f92f1fec14d807145c81c4992bc976ac92e5051747fc22e1df01643b0e54f389ebc00464d7bc01f79e6bcf49954571a821b04f600ea844045e74f05c415
-
Filesize
2KB
MD5a7f7f674a0be7c51ff3ac7b4ba44690f
SHA17279c6bdae279cbe49e5e7430f532f036ae987f2
SHA2568fab2e46ec39d29f15160db1b09f32d7c3caed024a890592e938b3c0978fb597
SHA51217d68eac42bc0bc2ba26de4efbce09747abaa6c4b972864b9e247bdfbf7bedd21df141008d3076c5cf2894842bedf0081100cb499d94d81100a9a38b946a522b
-
Filesize
2KB
MD5ef0d9f01743e8125d1e57d10a967057b
SHA1c743e3d06cc6401c679464548bc0f35829ad603b
SHA256eb1196b5086b5e2c1b17422403e6ed190a15b6295ca940bf8d8ab935fb93493f
SHA512acec7673976366d0cb7601f578ce488d30e4435bd5e24c9c09f3e86f39152327371d058bb5b9861fa2e14b179a44cae832f3ee1853a42ae87af45dd2984b5561
-
Filesize
2.4MB
MD555e1577f9970564ccfceae7625b263a4
SHA1e1e84fa4ee17cf4536008f6a50924710e98aaa4a
SHA256114e4109ee70cbf3b458040e8b3368f669d998422c36b2de6a8c0f1f9ea81579
SHA51223e30e7bce19f4590e77a47bce42ebf67fb9f669f8388e1d747887f7078fb1f94359dd428095122d33fee14fa1ab3dd887fa2b364f407ed1f902ffb0dbeab5e6
-
Filesize
2.4MB
MD538c264f6c8b93f43d2c119d51464ca63
SHA19e257ab80a8c31fdb6830d5b3db36035c5cdf411
SHA2561e769a3f416dc8c46ab3cfaecf5e68e40d2f0bb3271b10a7bc5a98dbd7e91110
SHA51211043196302dba954f41d79733a1a6bdfa22ecc6721b88cf47175a16f39cfd108deb9631a58ef90bcf0de3152bf68086ec03ae8f8771b36ec21e933505333856
-
Filesize
2.4MB
MD54121363a325f1bc674c58d6558e15e66
SHA1a3ebd6c4cb1af5a696b1bf2da307e39bbfc2e7b7
SHA25612ed31e6199305c4b5257dd3ddd0d6903e5db7beaf61ed815dfb9b1d07264e5f
SHA512bb8fe363eaf19ecb6515442e7403681326e611bcd60389fa3148d8e02c4369c2e2351193387af6af3ca1e881e00d39530fef656c412ed3fe3145ebc35d2cfeff
-
Filesize
11.4MB
MD51b5d0bbd718b6391d1d7b4805e11069f
SHA1f9c925f20bb0ac4ef0c0b11cbd954f5a06e155de
SHA25653b609b79d22f11772f228292e34f0e820d00ddbff25e5361ccd58efb8df06fc
SHA5129a5f1fde7aaf35075a74b01b6aa174789eba4812d0e0df745e5741689a6180ed9bc77b5b9acc99aaa93548ae1a04464fb5886d25698704c754865e4676294b2b
-
Filesize
23KB
MD553c2ca25ccb95335332142b1595eda4f
SHA12110d60f63b9ed5dfd68a592f84b66e4a95f2104
SHA2567ed6b0b6cda691e8e03081a1478a1bcfa62e6780bd5c558b9cca1e257b4d2507
SHA5126443c473563e67e9d4a23dafe42f5477e086683f13edc7ca494f3160b6022ba308f74759d729486fc6e2ee6b0f4921614da1643224525a0c10947b63f30ca2e7
-
Filesize
21KB
MD59b83c61b27610f7a2d2fc556319030d6
SHA1c51e81c0f8282b7a98283cdac6000d954f447dbd
SHA25694c1011d519081529e037353c099c47c5f2be046ae5f4fa86f9e6f2d3375658c
SHA512bd6f660fe4def94123e7d7feae33dec01bfa9078c9441f6c36abf2220756f3b06169acfe023c6f7245c72ee8998ff40e2846837edbc0701c1f3299cf3040a64b
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
165B
MD5ff09371174f7c701e75f357a187c06e8
SHA157f9a638fd652922d7eb23236c80055a91724503
SHA256e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8
SHA512e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882
-
Filesize
35KB
MD59e3c13b6556d5636b745d3e466d47467
SHA12ac1c19e268c49bc508f83fe3d20f495deb3e538
SHA25620af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8
SHA5125a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b
-
Filesize
4.0MB
-
Filesize
2.4MB
-
Filesize
2.1MB
-
Filesize
5.6MB
-
Filesize
40KB
-
Filesize
584KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
52KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
19.7MB
-
Filesize
4KB
-
Filesize
19.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
19.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
19.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
160KB
-
Filesize
12.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
19.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
160KB
-
Filesize
52KB
-
Filesize
12.2MB