Analysis
- max time kernel
130s - max time network
130s - platform
windows11-21h2_x64 - resource
win11-20241007-en - resource tags
- submitted
02/11/2024, 01:20
General
- Target Synapse Bootstrapper.exe
- Size 74.6MB
- Sample241102-bqdhbawkax
- SHA256 8a9b4b1135066c43c14f36cb807899548c555a3dda54165c738ccea3e8396859
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
- Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Loads dropped DLL 24 IoCs
- Checks whether UAC is enabled 1 TTPs 5 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Synapse Bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\Synapse Bootstrapper.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\Synapse Bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\Synapse Bootstrapper.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Synapse Bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\Synapse Bootstrapper.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\Synapse Bootstrapper.exe"C:\Users\Admin\Desktop\Synapse Bootstrapper.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\Synapse Bootstrapper.exe"C:\Users\Admin\Desktop\Synapse Bootstrapper.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
D3DCompiler_47_cor3.dll
PresentationNative_cor3.dll
libsx_bootstrap.dll
vcruntime140_cor3.dll
wpfgfx_cor3.dll
context.bin
memory/572-711-0x00007FFC28300000-0x00007FFC29338000-memory.dmp
memory/572-708-0x00007FFC28300000-0x00007FFC29338000-memory.dmp
memory/896-300-0x00007FFC273B0000-0x00007FFC283E8000-memory.dmp
memory/896-290-0x00007FFC273B0000-0x00007FFC283E8000-memory.dmp
memory/3508-31-0x000001A9CA560000-0x000001A9CA5DF000-memory.dmp
memory/3508-141-0x00007FFC28710000-0x00007FFC29748000-memory.dmp
memory/3508-58-0x000001A9CA750000-0x000001A9CA762000-memory.dmp
memory/3508-49-0x000001A9CA4E0000-0x000001A9CA4F6000-memory.dmp
memory/3508-70-0x000001A9CAC40000-0x000001A9CAC87000-memory.dmp
memory/3508-67-0x000001A9CA770000-0x000001A9CA778000-memory.dmp
memory/3508-64-0x000001A9CAD70000-0x000001A9CAE64000-memory.dmp
memory/3508-46-0x000001A9CA360000-0x000001A9CA379000-memory.dmp
memory/3508-43-0x000001A9A9D30000-0x000001A9A9D37000-memory.dmp
memory/3508-40-0x000001A9CA3E0000-0x000001A9CA3F3000-memory.dmp
memory/3508-37-0x000001A9CA340000-0x000001A9CA345000-memory.dmp
memory/3508-34-0x000001A9CA330000-0x000001A9CA33D000-memory.dmp
memory/3508-8-0x0000000180000000-0x0000000180A23000-memory.dmp
memory/3508-73-0x000001A9CA780000-0x000001A9CA7AA000-memory.dmp
memory/3508-56-0x000001A9CA540000-0x000001A9CA558000-memory.dmp
memory/3508-28-0x000001A9CD1E0000-0x000001A9CDA23000-memory.dmp
memory/3508-22-0x000001A9CA490000-0x000001A9CA4D4000-memory.dmp
memory/3508-52-0x000001A9CA500000-0x000001A9CA540000-memory.dmp
memory/3508-148-0x00007FF6DBE30000-0x00007FF6DC777000-memory.dmp
memory/3508-150-0x00007FF6DC3CE000-0x00007FF6DC3CF000-memory.dmp
memory/3508-151-0x00007FFC28710000-0x00007FFC29748000-memory.dmp
memory/3508-152-0x00007FF6DBE30000-0x00007FF6DC777000-memory.dmp
memory/3508-25-0x000001A9CA390000-0x000001A9CA3CE000-memory.dmp
memory/3508-157-0x00007FFC28710000-0x00007FFC29748000-memory.dmp
memory/3508-158-0x00007FF6DBE30000-0x00007FF6DC777000-memory.dmp
memory/3508-19-0x000001A9CA5F0000-0x000001A9CA74E000-memory.dmp
memory/3508-16-0x000001A9CA7C0000-0x000001A9CA9E8000-memory.dmp
memory/3508-9-0x000001A9CA400000-0x000001A9CA48A000-memory.dmp
memory/3508-10-0x00007FF6DC3CE000-0x00007FF6DC3CF000-memory.dmp
memory/3508-13-0x000001A9CC250000-0x000001A9CD1D8000-memory.dmp
memory/4068-439-0x00007FFC287B0000-0x00007FFC297E8000-memory.dmp
memory/4068-436-0x00007FFC287B0000-0x00007FFC297E8000-memory.dmp
memory/4068-434-0x00007FFC287B0000-0x00007FFC297E8000-memory.dmp
memory/5100-567-0x00007FFC27FF0000-0x00007FFC29028000-memory.dmp
memory/5100-576-0x00007FFC27FF0000-0x00007FFC29028000-memory.dmp
memory/5100-580-0x00007FFC27FF0000-0x00007FFC29028000-memory.dmp