hxxps://github[.]com/4C3C/SynapseXRemake

Analysis

max time kernel
107s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2024 16:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/4C3C/SynapseXRemake

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5448	Synapse X Remake.exe
4916	Synapse X Remake.exe

Loads dropped DLL 8 IoCs

pid	Process
5448	Synapse X Remake.exe
5448	Synapse X Remake.exe
5448	Synapse X Remake.exe
5448	Synapse X Remake.exe
4916	Synapse X Remake.exe
4916	Synapse X Remake.exe
4916	Synapse X Remake.exe
4916	Synapse X Remake.exe

Probable phishing domain 1 TTPs 2 IoCs

Phishing

T1566

description	flow	ioc
HTTP URL	87	https://replit.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8d18a0d12d24419a
HTTP URL	107	https://replit.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8d18a1f4fe9b48b1

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synapse X Remake.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synapse X Remake.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
212	msedge.exe
212	msedge.exe
4548	msedge.exe
4548	msedge.exe
3716	identity_helper.exe
3716	identity_helper.exe
3724	msedge.exe
3724	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5200	OpenWith.exe
5124	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	2564	7zG.exe
Token: 35	2564	7zG.exe
Token: SeSecurityPrivilege	2564	7zG.exe
Token: SeSecurityPrivilege	2564	7zG.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
2564	7zG.exe
4548	msedge.exe
4548	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe

Suspicious use of SetWindowsHookEx 36 IoCs

pid	Process
5448	Synapse X Remake.exe
5448	Synapse X Remake.exe
5200	OpenWith.exe
5200	OpenWith.exe
5200	OpenWith.exe
5200	OpenWith.exe
5200	OpenWith.exe
5200	OpenWith.exe
5200	OpenWith.exe
5200	OpenWith.exe
5200	OpenWith.exe
5200	OpenWith.exe
5200	OpenWith.exe
5200	OpenWith.exe
5200	OpenWith.exe
5200	OpenWith.exe
5200	OpenWith.exe
5124	OpenWith.exe
5124	OpenWith.exe
5124	OpenWith.exe
5124	OpenWith.exe
5124	OpenWith.exe
5124	OpenWith.exe
5124	OpenWith.exe
5124	OpenWith.exe
5124	OpenWith.exe
5124	OpenWith.exe
5124	OpenWith.exe
5124	OpenWith.exe
5124	OpenWith.exe
5124	OpenWith.exe
5124	OpenWith.exe
5124	OpenWith.exe
5124	OpenWith.exe
4916	Synapse X Remake.exe
4916	Synapse X Remake.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 3312	4548	msedge.exe	84
PID 4548 wrote to memory of 3312	4548	msedge.exe	84
PID 4548 wrote to memory of 184	4548	msedge.exe	85
PID 4548 wrote to memory of 184	4548	msedge.exe	85
PID 4548 wrote to memory of 184	4548	msedge.exe	85
PID 4548 wrote to memory of 184	4548	msedge.exe	85
PID 4548 wrote to memory of 184	4548	msedge.exe	85
PID 4548 wrote to memory of 184	4548	msedge.exe	85
PID 4548 wrote to memory of 184	4548	msedge.exe	85
PID 4548 wrote to memory of 184	4548	msedge.exe	85
PID 4548 wrote to memory of 184	4548	msedge.exe	85
PID 4548 wrote to memory of 184	4548	msedge.exe	85
PID 4548 wrote to memory of 184	4548	msedge.exe	85
PID 4548 wrote to memory of 184	4548	msedge.exe	85
PID 4548 wrote to memory of 184	4548	msedge.exe	85
PID 4548 wrote to memory of 184	4548	msedge.exe	85
PID 4548 wrote to memory of 184	4548	msedge.exe	85
PID 4548 wrote to memory of 184	4548	msedge.exe	85
PID 4548 wrote to memory of 184	4548	msedge.exe	85
PID 4548 wrote to memory of 184	4548	msedge.exe	85
PID 4548 wrote to memory of 184	4548	msedge.exe	85
PID 4548 wrote to memory of 184	4548	msedge.exe	85
PID 4548 wrote to memory of 184	4548	msedge.exe	85
PID 4548 wrote to memory of 184	4548	msedge.exe	85
PID 4548 wrote to memory of 184	4548	msedge.exe	85
PID 4548 wrote to memory of 184	4548	msedge.exe	85
PID 4548 wrote to memory of 184	4548	msedge.exe	85
PID 4548 wrote to memory of 184	4548	msedge.exe	85
PID 4548 wrote to memory of 184	4548	msedge.exe	85
PID 4548 wrote to memory of 184	4548	msedge.exe	85
PID 4548 wrote to memory of 184	4548	msedge.exe	85
PID 4548 wrote to memory of 184	4548	msedge.exe	85
PID 4548 wrote to memory of 184	4548	msedge.exe	85
PID 4548 wrote to memory of 184	4548	msedge.exe	85
PID 4548 wrote to memory of 184	4548	msedge.exe	85
PID 4548 wrote to memory of 184	4548	msedge.exe	85
PID 4548 wrote to memory of 184	4548	msedge.exe	85
PID 4548 wrote to memory of 184	4548	msedge.exe	85
PID 4548 wrote to memory of 184	4548	msedge.exe	85
PID 4548 wrote to memory of 184	4548	msedge.exe	85
PID 4548 wrote to memory of 184	4548	msedge.exe	85
PID 4548 wrote to memory of 184	4548	msedge.exe	85
PID 4548 wrote to memory of 212	4548	msedge.exe	86
PID 4548 wrote to memory of 212	4548	msedge.exe	86
PID 4548 wrote to memory of 628	4548	msedge.exe	87
PID 4548 wrote to memory of 628	4548	msedge.exe	87
PID 4548 wrote to memory of 628	4548	msedge.exe	87
PID 4548 wrote to memory of 628	4548	msedge.exe	87
PID 4548 wrote to memory of 628	4548	msedge.exe	87
PID 4548 wrote to memory of 628	4548	msedge.exe	87
PID 4548 wrote to memory of 628	4548	msedge.exe	87
PID 4548 wrote to memory of 628	4548	msedge.exe	87
PID 4548 wrote to memory of 628	4548	msedge.exe	87
PID 4548 wrote to memory of 628	4548	msedge.exe	87
PID 4548 wrote to memory of 628	4548	msedge.exe	87
PID 4548 wrote to memory of 628	4548	msedge.exe	87
PID 4548 wrote to memory of 628	4548	msedge.exe	87
PID 4548 wrote to memory of 628	4548	msedge.exe	87
PID 4548 wrote to memory of 628	4548	msedge.exe	87
PID 4548 wrote to memory of 628	4548	msedge.exe	87
PID 4548 wrote to memory of 628	4548	msedge.exe	87
PID 4548 wrote to memory of 628	4548	msedge.exe	87
PID 4548 wrote to memory of 628	4548	msedge.exe	87
PID 4548 wrote to memory of 628	4548	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/4C3C/SynapseXRemake
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff93b0346f8,0x7ff93b034708,0x7ff93b034718
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,10085836453813657579,17572644150083189705,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,10085836453813657579,17572644150083189705,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,10085836453813657579,17572644150083189705,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10085836453813657579,17572644150083189705,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10085836453813657579,17572644150083189705,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,10085836453813657579,17572644150083189705,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4056 /prefetch:8
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,10085836453813657579,17572644150083189705,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4056 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10085836453813657579,17572644150083189705,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10085836453813657579,17572644150083189705,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10085836453813657579,17572644150083189705,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10085836453813657579,17572644150083189705,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2080,10085836453813657579,17572644150083189705,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10085836453813657579,17572644150083189705,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2080,10085836453813657579,17572644150083189705,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10085836453813657579,17572644150083189705,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10085836453813657579,17572644150083189705,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10085836453813657579,17572644150083189705,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6536 /prefetch:1
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10085836453813657579,17572644150083189705,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10085836453813657579,17572644150083189705,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10085836453813657579,17572644150083189705,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6580 /prefetch:1
  2⤵
  PID:3696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4316

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2520

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\SynapseXRemake-main\" -ad -an -ai#7zMap15836:100:7zEvent4220
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2564

C:\Users\Admin\Downloads\SynapseXRemake-main\SynapseXRemake-main\Synapse X Remake.exe
"C:\Users\Admin\Downloads\SynapseXRemake-main\SynapseXRemake-main\Synapse X Remake.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5448

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\93e2ed7da28245899c4ff24b09347e7c /t 5452 /p 5448
1⤵
PID:6016

C:\Users\Admin\Downloads\SynapseXRemake-main\SynapseXRemake-main\Synapse X Remake.exe
"C:\Users\Admin\Downloads\SynapseXRemake-main\SynapseXRemake-main\Synapse X Remake.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4916

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5200

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5124
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\SynapseXRemake-main\SynapseXRemake-main\README.md
  2⤵
  PID:4988

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\161a5c4110844fe0b3d7ac9ce713b0bc /t 708 /p 4916
1⤵
PID:4568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
1KB

MD5
67e486b2f148a3fca863728242b6273e

SHA1
452a84c183d7ea5b7c015b597e94af8eef66d44a

SHA256
facaf1c3a4bf232abce19a2d534e495b0d3adc7dbe3797d336249aa6f70adcfb

SHA512
d3a37da3bb10a9736dc03e8b2b49baceef5d73c026e2077b8ebc1b786f2c9b2f807e0aa13a5866cf3b3cafd2bc506242ef139c423eaffb050bbb87773e53881e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

Filesize
436B

MD5
971c514f84bba0785f80aa1c23edfd79

SHA1
732acea710a87530c6b08ecdf32a110d254a54c8

SHA256
f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895

SHA512
43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
174B

MD5
b61088c3266bc920272cfd46c24b5fdc

SHA1
42d209f3eba816b9a095cdffbd1642024a6e0535

SHA256
ad99f3be9b3812ad9051507cd4ba3d52320700f27e4316ef6ecfe674405a5994

SHA512
4a4547180d6dede0b677bd3b8da02ad1024519b5bd08b231a87707486ad81411addc11b0aa50528b87795a2e62454435acde0fa160186ae6904904410664d27d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

Filesize
170B

MD5
2fd3e13f0fbf8854dcb237c1865a7648

SHA1
a64c0389b0f5be9585413cdcc2ebe04bd79e343b

SHA256
08aa95b786490b761cbad863f198173e205436d81e4f7aa95f0c39b3b74b27d6

SHA512
a7c76616991cdbc805906fc36bcaac02fcb01d35693ea66179c1e7370fae673970c78b9053d277f842363f5cfcccd0370143ca55c275e22a4ab22378bdae6f3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
385a03cec5c3de41b6121046cb9d7312

SHA1
fc16f4baa5fd131f01d0c8a181ef9be0f434fb14

SHA256
2d51ddf776786fbc8f872c900a079a11e26cf0979fc35ca06dfba5d04335a276

SHA512
f5d0c7db23d2ceeaa2cd974b1dbde8ed2d6596b0c2c93b9fdfafe1bcdb29495fc29bf6eb09ec6480de53812cde16e924295091f37d6576e16aa4b034136a4bf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
672B

MD5
05736178ca06de192ea96f5fd08b0cf9

SHA1
1802c472675db209782f725ed80458a8b1ed2116

SHA256
ae4a00627ed5a9fb6f0fb8c6b5bf03074fa524cb57eb2c948037712f190154a6

SHA512
2d88e5eff92b29092eb60f558ccbdfe3f4aa9dab8692435b85fb0a84b7d5729ad25bd196fd18d8631e61e83131bfc38bc7628b793e0bec221c89fcadb9fcb9f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
90f9772214b139b8b9d40442fb4ac78f

SHA1
aa130f404ffbf6778ebc781935d76a4bb439dbca

SHA256
424da07c244f9cab2b50fa5a4f6da76f3634b31a8f92c7bdd8b8c05b1d509e2f

SHA512
bff386556d720f4dee19317899c62f60aa62b257f17679992953a01f55ea3a1c818bea7bb0a9321ae6a3fd295e309614e419fa5accbea0f93c04c94e77a48c2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a61a1daeef527400e8b3c47dd291b259

SHA1
0819355c432af0212a3492a36ee3dc0ca58ecda4

SHA256
5d413fbcd617152d7be63e47d657d588fe4abd8d50611e29704c398bbe189a58

SHA512
1316df98a1c84d0ef897d492224bc554258611cbe32fab09b9fc5b801568a3885d1e07ff4ab83f00fce1e87a914f7a47230657b36a137f01f340008f6c0c49f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
beaf447b36d4645be5c8d5eecdc9e1e0

SHA1
d3b27d921dccd3952db9795d21d3f8b4cb8d8e8b

SHA256
5cb13f631e0754a5d358e3804986bd24b046782e6d05b00bbce10357120644aa

SHA512
f3f2a48433096d8a97c723db3610a4a2b6ff08338c8a61c4015d219480ee192a4a74ad6f22eb01c987b8ffbf79cca9329cea59644bad38e868fe723a5a6d1ab3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0b62022c7e87ff50e09037e2118b92d8

SHA1
c33c2a2f858aab19cdc4e2402851f2a42255206e

SHA256
0f573333981d5b870b480eaa935b78a0fe6f93c09d882020ffa35b2dcfe568af

SHA512
8b8aa8c6e493c9f6f841cd06394315ddd89a7ab3b2cddb3207211be81b4422c145b19d0510624fba8844191c060542cd11a5876efe9fd6704b13c778ef62219e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2dd0f43fbe319010047fb8944b3b11c3

SHA1
b7399aac858ee750eea98d1c43bae3d0508573f3

SHA256
325cec19642f043aa6304fa2f9345f54c7c5829d0231151f0640acf8c6f2a6e2

SHA512
b548a6fc04d7a46f09943f037ff8624c0069df6d0ce13b47806ca07b603fc92a1d08c6909e036a185b267f206557870cc8d41373333c3fe9dbe1b03fdc1e2d33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6b337566bb3c1adfef18e41801b30a12

SHA1
737a9323fa192549f8b514fd29aa3aed558954d7

SHA256
1b1a5122293bdad8915af2e3903801535faf77551536f61cd0830e2383266bd9

SHA512
5b7a8f514ba2dd46fd69d9454f7125cfaad68cbf3cc62c38c3a63164997adb86ef5f0f65a04e3c4a3f3ef6dc96de54179cc958cdb7615fffefe0654ce0ce5faa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e82f01ba07427397dd3a21f72dd94ab5

SHA1
094a0180ad11373c4aa53b35c39d7a5239300975

SHA256
f764374e592960beec1c799a05850c5592e4e3c7f34ed9e6a7d27fa2ed49e2a6

SHA512
edc1cbcf6a4e79ad86849fc1a026080afec2bc6d39d5fb4a8e08f9b2b067332b2fd00ad86965a2ac8ef63e896702a42e8bab2acfc1a79f20755c7c4191678e01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
bc7116afbe3c03ebe6a2490331d4dd28

SHA1
7cc01b1fd6635706491992bfed2ba12993f7a969

SHA256
9bb752d6356a8e5d690ea5f825dbdb9c25cfcd55b094dffc6e1d217cd7c59649

SHA512
65f9c342fd9c4291098a10cfd3f25ad140a081654cfac97719107dfb4f7ee3bd1d5704529898264c8f9c72a1d3e0ae129cf0ddc561ad96a5138ab8f5a1e45399

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c7a5.TMP

Filesize
1KB

MD5
12a4127ac8b64743c282fac79e5c5812

SHA1
128cc5efb08babeb7bb374c2090edce3fe9a5c28

SHA256
e5b539f46c4db3b4013df45234dd04fe1d054fb53043f0b19df2d631101093e9

SHA512
80ecf04e2231dc1adeed1b5c25aef74b4e35b22900f92b7b49811b3b10f65bbc90376cec1e09adc46f59c24b4bb12eb67ad91039946529a2384cb3d62646b708

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\000004.dbtmp

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
48cb4408acc13a15ec42fd116099f915

SHA1
53b3426c74fba2d8f6a615df1e2845e01c027aff

SHA256
185b3263ccfa1de34d41628ed69e1d2da291aa370a85c40749beb709c8f97b02

SHA512
ef34b56593d9d7af1381b54d357367420bc99830d2fc0b822cbf9ddf88a407be2bac259478f74e0031e61a9cc5f72431299741ea713357da13d08e6e49db4b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3c7ad73b51a5f805a2351da1fd245996

SHA1
53b750d896225b9c731f915c486c5ccfe8c86fdb

SHA256
16fb7134c172809bca5f4a49af82b68443c5885b85c380da5eadf7d2ee68a17b

SHA512
7e335fdc2148eea0ee74a11da7def3f381f50a078ae35e81321f52d665bc1f6914ccf8e2f7600714fa1fbebbc30294a2ce5134a7ceb5e17347c20c31763c0ece

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
65549875b7d4208fcc6fe72f875b8649

SHA1
0bd78fc33d1bf1f270f70becbadcdcad44b73b7d

SHA256
5240842c511329823d62ebee3adff0c09b3ade8cb0f195d9f26ca2645d491aa5

SHA512
3f381541740938354b8edf72f1b8940a6217c71b032dfaa190b855b18404c0f28287851532e22fc0de6d511beb809fb52c59d941435dfc31e5315f5f7be090f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PGH3GSHW\news[1].htm

Filesize
98B

MD5
eb440bbc34a33c1f26a954fee00d4fa1

SHA1
f87d6e8f90e59eee9ff4a19ac53b1e1a2ce13739

SHA256
fa9ace00ed83faad302df50d1895bede77f5ace60b8353d7390695c05f0d1890

SHA512
c2a9245b550a68e11ada6d112ef6a403b951d6f2eea953d957a5e4417e89ef7e899cd2def882369f96c2f6cf68ac0d111e840105e2beb4c8e8b1700a90120733

Download Submit
C:\Users\Admin\Downloads\SynapseXRemake-main.zip

Filesize
2.8MB

MD5
eeaa838e912c9fc0a29dd72421340ce4

SHA1
32ff0dd551954817076bdf8ffa264914a871a470

SHA256
4fab79bfcebd45ebe8b2547284196459e8ca229952c1db96a7654c0f8316ca59

SHA512
46685aeeaf523a86c7ea46d009538bf71764b156ba51ecf6198ba1b5b0e3a4377f27ed279e1b0650b11cd65c60af3e43956cdf7651b368b8c9e02ec3dc25230d

Download Submit
C:\Users\Admin\Downloads\SynapseXRemake-main\SynapseXRemake-main\Bunifu_UI_v1.52.dll

Filesize
220KB

MD5
3764580d568e4fc506048e04db90562c

SHA1
e8d2771a4891ad7b751c4ac153f599d7d58ebd31

SHA256
27c8cea7e793ace737415881a5c16b4e2d98ce46609d272e82c6c905ad2d9f36

SHA512
fdc11be9388034404c9c71a60374486ff15d552bd8e9f7f74ca345e7d40df20dcb992e6d4e7b509e31e53c910e33ed8e275467da92c30193d6fab16934491763

Download Submit
C:\Users\Admin\Downloads\SynapseXRemake-main\SynapseXRemake-main\README.md

Filesize
102B

MD5
68123683722c20fed71fd8f89e772fb2

SHA1
043876c0ec6e2db3b11882eff65330262327cb11

SHA256
f291d01226cffd2d44f478d67daad1042f1d5f2c77c4d2676e064cc7d62a1b99

SHA512
78183ef7f01e206e5ba1bc84cba0fae191508301c721b58b740a0dda6d1edf6f2f32110ac2ede3d1b222262c096f35842c22024cf016a7cf5ce660c4af997258

Download Submit
C:\Users\Admin\Downloads\SynapseXRemake-main\SynapseXRemake-main\Siticone.UI.dll

Filesize
1.3MB

MD5
750c58af2e56b6addecffcf152520ab8

SHA1
14995e7f1d12498606d9d209d78d55fe6fd87802

SHA256
27c56a28cbde094157206da1bfcd7a395111ab97b8a5ff600b11c2175dcefb26

SHA512
2179790e23f61b3dfea828457f8609279c70b1e071cddc73b1dbda02caa664e0aae2553fc24a4956f9e89c477d66b1a704bde26fa23bc6db26c19e18db00abb5

Download Submit
C:\Users\Admin\Downloads\SynapseXRemake-main\SynapseXRemake-main\Synapse X Remake.exe

Filesize
84KB

MD5
94a63c8ffccb44fc39c7732c24e23950

SHA1
c3233bb8c4b786f2cc7bb021d0bad8096624dd21

SHA256
cda4bb27e91894a804bf11b6f7a8f8142094f6405efd24ace511f8da4da9ddd3

SHA512
3d9ec51934961097fbf85ada589adca34d57ae4227c0085149b41b86b191a4d1ac762d5aa1e9d2b77a375a203e7f648e1413bb0321f79320b4e95feb1638540b

Download Submit
memory/4916-505-0x0000000006660000-0x0000000006674000-memory.dmp

Filesize
80KB

Download
memory/5448-393-0x0000000005A10000-0x0000000005A26000-memory.dmp

Filesize
88KB

Download
memory/5448-397-0x0000000009170000-0x00000000092BE000-memory.dmp

Filesize
1.3MB

Download
memory/5448-386-0x0000000005A70000-0x0000000006014000-memory.dmp

Filesize
5.6MB

Download
memory/5448-392-0x0000000005640000-0x000000000567E000-memory.dmp

Filesize
248KB

Download
memory/5448-385-0x0000000000B60000-0x0000000000B7C000-memory.dmp

Filesize
112KB

Download
memory/5448-398-0x0000000007440000-0x0000000007454000-memory.dmp

Filesize
80KB

Download
memory/5448-388-0x0000000005550000-0x000000000555A000-memory.dmp

Filesize
40KB

Download
memory/5448-387-0x0000000005560000-0x00000000055F2000-memory.dmp

Filesize
584KB

Download