Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    116s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/10/2024, 02:28

General

  • Target

    SynapseBootstrapper.exe

  • Size

    29KB

  • MD5

    9b90d82224f704904dc773c83ee85604

  • SHA1

    301cea637d7f62d4aded3d361c1e5051e6785d2d

  • SHA256

    e8c928c8491ec766564880453d051b89c0733989e098f0d099c9c8d65b53988f

  • SHA512

    581677a374db76e84a894269e24e24cb4eac44f76cd5a119f0cefc5ea86d927d018c0cc053cb61ea58cf1286d94ed66efdb759b39dac67ccea217db600d865d5

  • SSDEEP

    384:7UnTov63w/iTh/hPTsxcASRF+pYtN8LOhV5uRw/2dKXQ+ZhnaFax4KH5ccHAF7Cs:+ASPNURCNXLnnaDKZ3H87Cd

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 35 IoCs
  • Suspicious use of SendNotifyMessage 34 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SynapseBootstrapper.exe
    "C:\Users\Admin\AppData\Local\Temp\SynapseBootstrapper.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2296
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -command "Expand-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\SynXRemake.zip' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp'"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4956
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -command "Expand-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\SynXRemake.zip' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp'"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1088
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\SynXRemake\SynapseXRemake.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3860
      • C:\Users\Admin\AppData\Local\Temp\SynXRemake\SynapseXRemake.exe
        C:\Users\Admin\AppData\Local\Temp\SynXRemake\SynapseXRemake.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:4100
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3104

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\SynXRemake.zip

    Filesize

    45.1MB

    MD5

    0f183dd9931c721817c424648668d158

    SHA1

    9134cf00628e80bfd9c390c9eed478f5876a1b06

    SHA256

    baa7f98a8de66cb5b0e4a4667d0ebae97f4e8c62cf44cd8a57f6d902d5073450

    SHA512

    703e3bb7705ca5177b068aaa54dae0a9632fc913a0bda51ab31adc0cb90f538a41f4dad97f86d1e7df998b78b6d658ff2632f3fcd9e2741a62bfbe642eb76738

  • C:\Users\Admin\AppData\Local\Temp\SynXRemake\Ace\ace\mode-csound_score.js

    Filesize

    14KB

    MD5

    67d3027a53dc9dea93e8badadac2c08c

    SHA1

    e7b8064b0c9aafbcfc27b39ed66f96eeae054e63

    SHA256

    dfd544612c4b4c146234c397c610062ef0a64d84ca61bb146a3d74017b93bb40

    SHA512

    091fab4c78f777f27afe3f10c7ff4777babbdcaef75ed99cb12b7dfd831f7ee9837d418f9932eccac3691abd508a8bf64753f1ac7e4bdda85b9792876400c7ea

  • C:\Users\Admin\AppData\Local\Temp\SynXRemake\Ace\ace\mode-django.js

    Filesize

    101KB

    MD5

    f35de187177b0165615f713868e14448

    SHA1

    918a10274d31f09a0fc96b1b5d0dd35d6c0f136a

    SHA256

    624dcb5438d0d5bf3c630e938da5f0bd2d8bd904fe4316afea82ce8b7f25d56d

    SHA512

    fec3ec6a120729367801800ed585971ece19c032ff03bad38074d2ff0f4310ea872a48dadd80c9d9be7fcde07fbacf8b67ccc4052dddabcb4f38a1398fbb84a5

  • C:\Users\Admin\AppData\Local\Temp\SynXRemake\Ace\ace\mode-ftl.js

    Filesize

    50KB

    MD5

    71451c50ed393d0071d352ddb2e56330

    SHA1

    cbfc8767bb4baceab37805257997c84f4264bbea

    SHA256

    2437cbce03f95681d4d31f50d2c5079ed35289bba9f13b1f62da20c73c3f06e2

    SHA512

    219f6d3deee708706ac4e8fdf4f7161a3cf4b6b719763680783e385d9525c0553fe4bba46157a5610e434c8fb40d88e46e54688705925710c4be782f80986fb4

  • C:\Users\Admin\AppData\Local\Temp\SynXRemake\Ace\ace\mode-glsl.js

    Filesize

    21KB

    MD5

    8ca9be0b4f85aa607d8af3c05c15b20d

    SHA1

    11f4bcb7b70f1a5bc6eda16825a8c40d81f4b616

    SHA256

    69343926d5bf317dff9a42193db72989f8464518508a83f642f027745b44e217

    SHA512

    c279c05f3d04ab75275b4fd61999d4d8b005e956b5d0a1447d00030f15b061621c680cf7ec462cda3c0b669e1b957e9edd2aca64debf6258c8e123ed3f0c9712

  • C:\Users\Admin\AppData\Local\Temp\SynXRemake\Ace\ace\mode-sh.js

    Filesize

    14KB

    MD5

    37f7cf0e0a639840d67e81e0a3d257dc

    SHA1

    4e59399b4b5dd9275ba58fc5c7640822af8891c2

    SHA256

    61f9a37f096997d0f8a4de024358c443943e8eecb2a8d023dba992212e3d1534

    SHA512

    f4940712bd359338eef2498b5658938a1e3cdbc967e1b17bdd13b6136e6661785abad4537daa2136274b8628cc622035e7447c0fa986f0db77f58f7d1ea56588

  • C:\Users\Admin\AppData\Local\Temp\SynXRemake\Ace\ace\worker-css.js

    Filesize

    269KB

    MD5

    efb7f98bfc7e9c92c7a5eacd72ece9e6

    SHA1

    0b6c2de65deb556163893762146c88e7451a3945

    SHA256

    53468a5a21fda1bdc6838d73255f0f0b3d7030c745077d09d4cdc41b20796f5a

    SHA512

    2ca94b561e2d13ea7f91ea3087c2c4a19ae3862b48ebfcd934f9f3c95eae3e49f8d6cdd69d8254a88985e3c57ffc3935581ad615dc8fb473720cc64dce9e50cf

  • C:\Users\Admin\AppData\Local\Temp\SynXRemake\ForlornApi.dll

    Filesize

    9KB

    MD5

    6c4df636535b1920bb44fb6e527b8d6d

    SHA1

    dc1d4cb9ce78e5454dc7f29ea568dcaa3163594d

    SHA256

    82505afab89b7629ce1436d81f3110389d54afdb3db448954fdefe26582b7ec1

    SHA512

    4f120a80d9a7233a74761958daa76d6dba6fc46aca3b872fa2fc0bb7475aaca7e973e6c3dcd24bcfcfae44c0aebec35de6c9c75fa19f09b22296c692a072887c

  • C:\Users\Admin\AppData\Local\Temp\SynXRemake\Microsoft.Web.WebView2.Core.dll

    Filesize

    575KB

    MD5

    ae3a2648bf76a4dfc83d5e0dcb68f3d4

    SHA1

    9c33e130e4f071f700321312317d0d66b2b3d8a4

    SHA256

    8ce541fab9d6334a97b6981e2ff1a72aa7979df913e93cb5be1536de0667cc5d

    SHA512

    8bb3dbb95386ccc5450fe0fd0853382092af8660009112646dca13f934e766b503fa7d9c1c91322326e0c9bae0df9643cbb2f101f256615a3b66e89d93e92aa5

  • C:\Users\Admin\AppData\Local\Temp\SynXRemake\Microsoft.Web.WebView2.Wpf.dll

    Filesize

    80KB

    MD5

    4349017614d4ae7f3b179b3c712e2c63

    SHA1

    45b9e20379951b8c42ce466ccc1d1e9f52739893

    SHA256

    9a76259ad28264645e36852861ffef803b72ea51f538d3ed678f0586389958f6

    SHA512

    83efe2ebd75fe6cbaea92ce728daab7c0f31b4b7eb5ee8e199aaa35df0d9957fade45684e5ccffa740d12d4fe5e330dbabc542266dfb0d8a3f8173a9e7713112

  • C:\Users\Admin\AppData\Local\Temp\SynXRemake\SynapseXRemake.exe

    Filesize

    1.4MB

    MD5

    a9c04f5705d63cd57a28cbb2b34103a7

    SHA1

    3dedce434535d9f2f6a37ee0195489f82c65c111

    SHA256

    327ea0c4e22c70993c0f600ff1a6b10c2fb2b7c2d30194f160cc04ce67c83383

    SHA512

    1d8048633d504bd5a2ab6d9ef5b1c02502e9697ded4f027a95247767ab4d828bc903ba912221f2acae24fad134b3454abc711cb37caaee0967556f3145e6b3f4

  • C:\Users\Admin\AppData\Local\Temp\SynXRemake\SynapseXRemake.exe.WebView2\EBWebView\Default\Extension State\CURRENT

    Filesize

    16B

    MD5

    46295cac801e5d4857d09837238a6394

    SHA1

    44e0fa1b517dbf802b18faf0785eeea6ac51594b

    SHA256

    0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

    SHA512

    8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

  • C:\Users\Admin\AppData\Local\Temp\SynXRemake\SynapseXRemake.exe.WebView2\EBWebView\Default\Extension State\MANIFEST-000001

    Filesize

    41B

    MD5

    5af87dfd673ba2115e2fcf5cfdb727ab

    SHA1

    d5b5bbf396dc291274584ef71f444f420b6056f1

    SHA256

    f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

    SHA512

    de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

  • C:\Users\Admin\AppData\Local\Temp\SynXRemake\SynapseXRemake.exe.WebView2\EBWebView\Default\GPUCache\data_3

    Filesize

    8KB

    MD5

    41876349cb12d6db992f1309f22df3f0

    SHA1

    5cf26b3420fc0302cd0a71e8d029739b8765be27

    SHA256

    e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

    SHA512

    e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

  • C:\Users\Admin\AppData\Local\Temp\SynXRemake\SynapseXRemake.exe.WebView2\EBWebView\Default\Shared Dictionary\cache\index

    Filesize

    24B

    MD5

    54cb446f628b2ea4a5bce5769910512e

    SHA1

    c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

    SHA256

    fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

    SHA512

    8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

  • C:\Users\Admin\AppData\Local\Temp\SynXRemake\SynapseXRemake.exe.WebView2\EBWebView\GraphiteDawnCache\data_0

    Filesize

    8KB

    MD5

    cf89d16bb9107c631daabf0c0ee58efb

    SHA1

    3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

    SHA256

    d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

    SHA512

    8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

  • C:\Users\Admin\AppData\Local\Temp\SynXRemake\SynapseXRemake.exe.WebView2\EBWebView\GraphiteDawnCache\data_1

    Filesize

    264KB

    MD5

    7c78ae927bac28b5ffa1f32240f1f237

    SHA1

    ce2d08aaacfbb519659afec58c9c06f8f291ed86

    SHA256

    ee7d281a0645ebc25aa8c2a3634f6165b099a8379cd32024e6a4318ab8c494c6

    SHA512

    bb905ff697551383fd1c8264f1b96cc653d05b9038574aeb626311117e2e2300d1c24736de66570d4cfa19473a452aecc9d59ab112c92d8ad184cf5c42329d19

  • C:\Users\Admin\AppData\Local\Temp\SynXRemake\SynapseXRemake.exe.WebView2\EBWebView\GraphiteDawnCache\data_2

    Filesize

    8KB

    MD5

    0962291d6d367570bee5454721c17e11

    SHA1

    59d10a893ef321a706a9255176761366115bedcb

    SHA256

    ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

    SHA512

    f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

  • C:\Users\Admin\AppData\Local\Temp\SynXRemake\SynapseXRemake.exe.config

    Filesize

    1KB

    MD5

    a08a28787cfaa30a9e6bc765cef2521d

    SHA1

    5376179bcb216dbb944421c295e4859fb4ad5844

    SHA256

    84d79735ed7e032b957dec6c47093961ebc294ecf158ddb4b40f1d8683d3ce4b

    SHA512

    6aaf1d7de6a560c6004086fb59bcb37a27bbe496823b3f488922faba3123cd066ec706e590f6b0f859bc3a476c077d320286d015e7ee39fc50f67d76d76f3cb1

  • C:\Users\Admin\AppData\Local\Temp\SynXRemake\bin\ForlornInject.dll

    Filesize

    923KB

    MD5

    f581c757f08283531fef757dd01a5882

    SHA1

    f3c1467f700252af8f100dbdf7dd7cdecf7e0c97

    SHA256

    aab18f35cfac4c70dd8e91f58e1610edf61bc057e83106afe3397b6103757f49

    SHA512

    f1cc3ff4c43916d1197b3a852949b8f6eef3dfa14b52aad5850fa0bd01d7c804f65c6002c88ac0c984074ad8b2a0c4c1a9b37b66e4085736c7a76a050c0857cb

  • C:\Users\Admin\AppData\Local\Temp\SynXRemake\bin\Version.txt

    Filesize

    5B

    MD5

    34e90de1478e8a54af7fd56d4a3a7102

    SHA1

    595d550379b2cb8bccb9659627308ff4e751d23f

    SHA256

    edc8e395a5182e3b231816e191b303407d511f70c1d9cb6d532927cc559c507c

    SHA512

    6f5d498adde960674138f8245346c23b7f7f0228ef1d4802f0dca54f570edb4260a3d5681e076d48a1e9a43ab8be1c504865ee381b99ce6caa03cb93bac1bc07

  • C:\Users\Admin\AppData\Local\Temp\SynXRemake\runtimes\win-x64\native\WebView2Loader.dll

    Filesize

    161KB

    MD5

    3fac859547077abafe806ff1e4709f47

    SHA1

    0366df220c5d224ee64a42c929574407d2e6d2c9

    SHA256

    f4d811cda483adb33220c5a856c5ec8dca3a095fde54b44f08e1279a6a5efd33

    SHA512

    9b7b7aabf6bdc11dfd74430336e02d7d2b96b6bbf352f1e2d158a4900bead364900820af56cf9af25366ff5704e2ffcc2458d45dc3efe00ebd0843d127ab7435

  • C:\Users\Admin\AppData\Local\Temp\SynXRemake\workspace\.tests\isfile.txt

    Filesize

    7B

    MD5

    260ca9dd8a4577fc00b7bd5810298076

    SHA1

    53a5687cb26dc41f2ab4033e97e13adefd3740d6

    SHA256

    aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27

    SHA512

    51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7

  • C:\Users\Admin\AppData\Local\Temp\SynXRemake\workspace\OrionTest\6035872082.txt

    Filesize

    2B

    MD5

    d751713988987e9331980363e24189ce

    SHA1

    97d170e1550eee4afc0af065b78cda302a97674c

    SHA256

    4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

    SHA512

    b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5kzihcny.hmg.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/1088-1-0x00007FFFF3113000-0x00007FFFF3115000-memory.dmp

    Filesize

    8KB

  • memory/1088-591-0x00007FFFF3110000-0x00007FFFF3BD1000-memory.dmp

    Filesize

    10.8MB

  • memory/1088-13-0x00007FFFF3110000-0x00007FFFF3BD1000-memory.dmp

    Filesize

    10.8MB

  • memory/1088-1430-0x00007FFFF3110000-0x00007FFFF3BD1000-memory.dmp

    Filesize

    10.8MB

  • memory/1088-582-0x00007FFFF3113000-0x00007FFFF3115000-memory.dmp

    Filesize

    8KB

  • memory/1088-16-0x000001AB3F1E0000-0x000001AB3F1EA000-memory.dmp

    Filesize

    40KB

  • memory/1088-875-0x00007FFFF3110000-0x00007FFFF3BD1000-memory.dmp

    Filesize

    10.8MB

  • memory/1088-7-0x000001AB3F1B0000-0x000001AB3F1D2000-memory.dmp

    Filesize

    136KB

  • memory/1088-806-0x00007FFFF3110000-0x00007FFFF3BD1000-memory.dmp

    Filesize

    10.8MB

  • memory/1088-15-0x000001AB3F650000-0x000001AB3F662000-memory.dmp

    Filesize

    72KB

  • memory/1088-14-0x00007FFFF3110000-0x00007FFFF3BD1000-memory.dmp

    Filesize

    10.8MB

  • memory/1088-12-0x00007FFFF3110000-0x00007FFFF3BD1000-memory.dmp

    Filesize

    10.8MB

  • memory/3104-1456-0x000001B802E00000-0x000001B802E01000-memory.dmp

    Filesize

    4KB

  • memory/3104-1455-0x000001B802E00000-0x000001B802E01000-memory.dmp

    Filesize

    4KB

  • memory/3104-1461-0x000001B802E00000-0x000001B802E01000-memory.dmp

    Filesize

    4KB

  • memory/3104-1462-0x000001B802E00000-0x000001B802E01000-memory.dmp

    Filesize

    4KB

  • memory/3104-1463-0x000001B802E00000-0x000001B802E01000-memory.dmp

    Filesize

    4KB

  • memory/3104-1464-0x000001B802E00000-0x000001B802E01000-memory.dmp

    Filesize

    4KB

  • memory/3104-1465-0x000001B802E00000-0x000001B802E01000-memory.dmp

    Filesize

    4KB

  • memory/3104-1466-0x000001B802E00000-0x000001B802E01000-memory.dmp

    Filesize

    4KB

  • memory/3104-1467-0x000001B802E00000-0x000001B802E01000-memory.dmp

    Filesize

    4KB

  • memory/3104-1457-0x000001B802E00000-0x000001B802E01000-memory.dmp

    Filesize

    4KB

  • memory/4100-1440-0x0000012BF33E0000-0x0000012BF33F8000-memory.dmp

    Filesize

    96KB

  • memory/4100-1435-0x00007FFFF3110000-0x00007FFFF3BD1000-memory.dmp

    Filesize

    10.8MB

  • memory/4100-1454-0x00007FFFF3110000-0x00007FFFF3BD1000-memory.dmp

    Filesize

    10.8MB

  • memory/4100-1436-0x0000012BF08F0000-0x0000012BF0A5A000-memory.dmp

    Filesize

    1.4MB

  • memory/4100-1451-0x0000012BF3430000-0x0000012BF3436000-memory.dmp

    Filesize

    24KB

  • memory/4100-1437-0x0000012BF2EB0000-0x0000012BF2FF0000-memory.dmp

    Filesize

    1.2MB

  • memory/4100-1442-0x0000012BF3440000-0x0000012BF3478000-memory.dmp

    Filesize

    224KB

  • memory/4100-1445-0x0000012BF3520000-0x0000012BF35B4000-memory.dmp

    Filesize

    592KB

  • memory/4100-1441-0x0000012BF33C0000-0x0000012BF33C8000-memory.dmp

    Filesize

    32KB

  • memory/4100-1443-0x0000012BF33D0000-0x0000012BF33DE000-memory.dmp

    Filesize

    56KB