Analysis
- max time kernel
204s - max time network
201s - platform
windows11-21h2_x64 - resource
win11-20241007-en - resource tags
- submitted
02/11/2024, 01:20
General
- Target seenapse v3 not mine.zip
- Size 69.2MB
- Sample241102-bqdhbawkax
- SHA256 72e8bda5d26312b48f6c58d7d4277d3b10cd47d7edcd53c939acd8920a6e2ca2
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
- Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 15 IoCs
- Checks whether UAC is enabled 1 TTPs 3 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\seenapse v3 not mine.zip"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\Synapse Bootstrapper.exe"C:\Users\Admin\Desktop\Synapse Bootstrapper.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\Synapse Bootstrapper.exe"C:\Users\Admin\Desktop\Synapse Bootstrapper.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\Synapse Bootstrapper.exe"C:\Users\Admin\Desktop\Synapse Bootstrapper.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
SearchHoverUnifiedTileModelCache.dat
SearchHoverUnifiedTileModelCache.dat
D3DCompiler_47_cor3.dll
PresentationNative_cor3.dll
libsx_bootstrap.dll
vcruntime140_cor3.dll
wpfgfx_cor3.dll
context.bin
context.bin
memory/1216-494-0x00007FF984CE0000-0x00007FF985D18000-memory.dmp
memory/1216-484-0x00007FF984CE0000-0x00007FF985D18000-memory.dmp
memory/2860-98-0x00000264D54E0000-0x00000264D54F9000-memory.dmp
memory/2860-126-0x00000264F73C0000-0x00000264F73EA000-memory.dmp
memory/2860-117-0x00000264F74C0000-0x00000264F75B4000-memory.dmp
memory/2860-110-0x00000264F7390000-0x00000264F73A2000-memory.dmp
memory/2860-107-0x00000264F7370000-0x00000264F7388000-memory.dmp
memory/2860-104-0x00000264F7480000-0x00000264F74C0000-memory.dmp
memory/2860-101-0x00000264F72B0000-0x00000264F72C6000-memory.dmp
memory/2860-59-0x0000000180000000-0x0000000180A23000-memory.dmp
memory/2860-95-0x00000264D53E0000-0x00000264D53E7000-memory.dmp
memory/2860-92-0x00000264F7290000-0x00000264F72A3000-memory.dmp
memory/2860-89-0x00000264D5420000-0x00000264D5425000-memory.dmp
memory/2860-86-0x00000264D5410000-0x00000264D541D000-memory.dmp
memory/2860-83-0x00000264F73F0000-0x00000264F746F000-memory.dmp
memory/2860-120-0x00000264F73B0000-0x00000264F73B8000-memory.dmp
memory/2860-123-0x00000264F7BA0000-0x00000264F7BE7000-memory.dmp
memory/2860-80-0x00000264FA160000-0x00000264FA9A3000-memory.dmp
memory/2860-197-0x00007FF984350000-0x00007FF985388000-memory.dmp
memory/2860-68-0x00000264F75C0000-0x00000264F77E8000-memory.dmp
memory/2860-208-0x00007FF984350000-0x00007FF985388000-memory.dmp
memory/2860-64-0x00007FF72600E000-0x00007FF72600F000-memory.dmp
memory/2860-77-0x00000264F7330000-0x00000264F736E000-memory.dmp
memory/2860-61-0x00000264D5440000-0x00000264D54CA000-memory.dmp
memory/2860-66-0x00000264F91D0000-0x00000264FA158000-memory.dmp
memory/2860-71-0x00000264F77F0000-0x00000264F794E000-memory.dmp
memory/2860-74-0x00000264F72E0000-0x00000264F7324000-memory.dmp
memory/4584-355-0x00007FF984CE0000-0x00007FF985D18000-memory.dmp
memory/4584-351-0x00007FF984CE0000-0x00007FF985D18000-memory.dmp
memory/4584-341-0x00007FF984CE0000-0x00007FF985D18000-memory.dmp