xred | 09dcbc7aa3dd1e632ff4f3d4b50c200532f60867992a04d6985ec15fb78be003

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-11-2024 04:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

InternetExplorer.exe
Size

855KB
MD5

c0fc5c9a5e085d4ceba2e938561f2cd7
SHA1

6e5d22ac8bc8db7822d1f7626a00f5525e4e74ef
SHA256

35607928da6aded83ef5a7261408406e3d80bb0a11ee5cfb29e24e91007d5f27
SHA512

30acb5d2fa54d7fcbf8a3253caf34a8e4d632c41cef73756128e506eeac3e8b66acc1c7cb93ccae355b215bf61b7473191624df11ca2ef1a9f67059d8b53c320
SSDEEP

12288:BMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9wvz8czTHkj:BnsJ39LyjbJkQFMhmC+6GD9o8czTHU

Score

10^/10

xred backdoor discovery persistence

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred
Executes dropped EXE 3 IoCs

Processes:

._cache_InternetExplorer.exeSynaptics.exe._cache_Synaptics.exe

pid process

560 ._cache_InternetExplorer.exe
2132 Synaptics.exe
2708 ._cache_Synaptics.exe
Loads dropped DLL 5 IoCs

Processes:

InternetExplorer.exeSynaptics.exe

pid process

576 InternetExplorer.exe
576 InternetExplorer.exe
576 InternetExplorer.exe
2132 Synaptics.exe
2132 Synaptics.exe

pid	process
560	._cache_InternetExplorer.exe
2132	Synaptics.exe
2708	._cache_Synaptics.exe

pid	process
576	InternetExplorer.exe
576	InternetExplorer.exe
576	InternetExplorer.exe
2132	Synaptics.exe
2132	Synaptics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

InternetExplorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	InternetExplorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

InternetExplorer.exeSynaptics.exeIEXPLORE.EXEEXCEL.EXEIEXPLORE.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InternetExplorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 58 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DC236FC1-9BF7-11EF-8C8D-7E918DD97D05} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DC0E0361-9BF7-11EF-8C8D-7E918DD97D05} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c400000000020000000000106600000001000020000000df3cafe24b357e26ecb4f9e7c2186b5bc9270914e3891578976bce109f2a72e1000000000e80000000020000200000004891d7eea09ed4412aaca134fac94908b91a984d4ac758c0328f91a52cd75cad900000007e4bbe05fd7df98f37461068fac5d129bfbc35bd296b0a855dd1e016e1bef51cff7391f9c05cae67a7cca20d831900cdf999ed7c04828a543ece18d0027cd1f282eecadb064845a668f26836ce177fccc1a88bf75a2a1e33c3a90e78df0cf74121e615d5715928233d1711c3d8e82b6288da836db935f92bd6cc26042dc2b46727cf853edce91ed8e03e064f7b5f3da940000000762287c95aedceb7cbe125a57f3e6a82851a4143d0cb5cf7ce3e2600479e587f2117a8e35107c627e8e53172d58002ff9e4ce24025431fda713c19984ce81a20	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 007f16b30430db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "437029299"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c400000000020000000000106600000001000020000000882144f93419e1a821897722509c903057e5f42c78592f544318f0188143c57b000000000e8000000002000020000000754be6c7e588d287a2440438016ce04271ccd73876128cde67a2aa41f67fb30d20000000acd832ed42e0183a03e103a76f76eefab9052a85e9f5f9ce87f7a923b39ad9b440000000517ed38f7565ae23af06e3ca46fe1014ce1af77d798c28a2ae92b26d46e75c24545ab91d4b8cfc08027962618bcf78de808d6bc182baf4205fd2a392ab426938	iexplore.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

2548 EXCEL.EXE
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exeiexplore.exe

pid process

2212 iexplore.exe
3060 iexplore.exe

pid	process
2548	EXCEL.EXE

Suspicious use of SetWindowsHookEx 11 IoCs

Processes:

iexplore.exeIEXPLORE.EXEEXCEL.EXEiexplore.exeIEXPLORE.EXE

pid	process
2212	iexplore.exe
2212	iexplore.exe
2156	IEXPLORE.EXE
2156	IEXPLORE.EXE
2548	EXCEL.EXE
3060	iexplore.exe
3060	iexplore.exe
532	IEXPLORE.EXE
532	IEXPLORE.EXE
532	IEXPLORE.EXE
532	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

InternetExplorer.exeiexplore.exeSynaptics.exeiexplore.exe

description	pid	process	target process
PID 576 wrote to memory of 560	576	InternetExplorer.exe	._cache_InternetExplorer.exe
PID 576 wrote to memory of 560	576	InternetExplorer.exe	._cache_InternetExplorer.exe
PID 576 wrote to memory of 560	576	InternetExplorer.exe	._cache_InternetExplorer.exe
PID 576 wrote to memory of 560	576	InternetExplorer.exe	._cache_InternetExplorer.exe
PID 576 wrote to memory of 2132	576	InternetExplorer.exe	Synaptics.exe
PID 576 wrote to memory of 2132	576	InternetExplorer.exe	Synaptics.exe
PID 576 wrote to memory of 2132	576	InternetExplorer.exe	Synaptics.exe
PID 576 wrote to memory of 2132	576	InternetExplorer.exe	Synaptics.exe
PID 2212 wrote to memory of 2156	2212	iexplore.exe	IEXPLORE.EXE
PID 2212 wrote to memory of 2156	2212	iexplore.exe	IEXPLORE.EXE
PID 2212 wrote to memory of 2156	2212	iexplore.exe	IEXPLORE.EXE
PID 2212 wrote to memory of 2156	2212	iexplore.exe	IEXPLORE.EXE
PID 2132 wrote to memory of 2708	2132	Synaptics.exe	._cache_Synaptics.exe
PID 2132 wrote to memory of 2708	2132	Synaptics.exe	._cache_Synaptics.exe
PID 2132 wrote to memory of 2708	2132	Synaptics.exe	._cache_Synaptics.exe
PID 2132 wrote to memory of 2708	2132	Synaptics.exe	._cache_Synaptics.exe
PID 3060 wrote to memory of 532	3060	iexplore.exe	IEXPLORE.EXE
PID 3060 wrote to memory of 532	3060	iexplore.exe	IEXPLORE.EXE
PID 3060 wrote to memory of 532	3060	iexplore.exe	IEXPLORE.EXE
PID 3060 wrote to memory of 532	3060	iexplore.exe	IEXPLORE.EXE

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

Processes:

._cache_Synaptics.exe._cache_InternetExplorer.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} = "0"	._cache_Synaptics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	._cache_InternetExplorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} = "0"	._cache_InternetExplorer.exe

C:\Users\Admin\AppData\Local\Temp\InternetExplorer.exe
"C:\Users\Admin\AppData\Local\Temp\InternetExplorer.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:576
- C:\Users\Admin\AppData\Local\Temp\._cache_InternetExplorer.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_InternetExplorer.exe"
  2⤵
  - Executes dropped EXE
  - System policy modification
  PID:560
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - System policy modification
    PID:2708

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?LinkId=69157# -embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2212 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2156

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2548

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" InjUpdate/# -embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3060 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
855KB

MD5
c0fc5c9a5e085d4ceba2e938561f2cd7

SHA1
6e5d22ac8bc8db7822d1f7626a00f5525e4e74ef

SHA256
35607928da6aded83ef5a7261408406e3d80bb0a11ee5cfb29e24e91007d5f27

SHA512
30acb5d2fa54d7fcbf8a3253caf34a8e4d632c41cef73756128e506eeac3e8b66acc1c7cb93ccae355b215bf61b7473191624df11ca2ef1a9f67059d8b53c320

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08bad3242962080fa88f8282dd29ed98

SHA1
e93b5b0e72b4f611700b9661f50c435536618165

SHA256
15dc040b8ccc9e2e81e3f5673e08b00ca49aa137d8789f72a593fd339aa43cbb

SHA512
d82fd57541ec0e0e5f4299da98c2ebb1b30d16cd8b59ed818046351ab36e073c66464c991fb2c49a3884c4ad31363c3b8310f40ad700bf2808acea5e52550a6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb2cc4a7701efd228d8617aff364bb64

SHA1
ae5318d039b03213dad61491f5cd7e4fe9977e80

SHA256
f8a4e395dad12faf169e57fa114a047f656574f1e5fa3fc870a9a2cfcf9e59e6

SHA512
266746b7da8b1c51ae779f8c6726bb49cee3803c098b319e9f43a88dd566b3766ab2db556b7de7320d926560c99e83b2187c37a37e5905a7c00da3da8510ecbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
653170791c6b16f303834ab50463d73a

SHA1
d25f271cae0766b082d8eecb768c456473c73793

SHA256
04ac3b403d0aeb7152440f03017bbdbc402131f2ceba24950c314a9cfed6a4b9

SHA512
15d237867ab211a5fbf8d411b66b848370a2abcaff8d50853de7b87cdeef64b9c3f3252f396717068c3aabf2846a6f884666e1408fffc44b4a9cb7ab4becf8d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4f1c579618b3d358e47cd378c4a2332

SHA1
6a4253450ef4b17d07d49b42c3bf335d21f8e2df

SHA256
3e2e61074429fbb13fa8bf26816972edec1e8dd517464bd20caefee0e7f0b891

SHA512
ec9b5944f4080fe4e99bac6c0555901df58d8de3c534ee12c3f82e391c811e8d3a71535e8ad7492ce299ba77b5b38cce119219a72474d2a99ed7034d2a64132b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9bcdb1d70c6b9e5538b4699ce200c8ca

SHA1
c0acac8ee2e05aa48610e31299323337d6963572

SHA256
20b3f25ba210af4af8420cacf887595db616e2cc717ebe6f0081e064b4c9a6df

SHA512
a53e38a025af85ecd5da44b5c9c00e64060634798638ed84d3dcb1c6f84b220274b29de3f0a8b8058f58e9f5c2abce062940021e9279dd3281bfacd74263d6fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dcc946cb4fc575fb68721fbf4cd035a0

SHA1
359352a0a3216a605ab55649cf65c1ba871e2009

SHA256
a41c29f1797cb8f1208f7f41e4a68f4b737926351bcb499ca875aceb53e69b1a

SHA512
b05401c115390e9c1a6789d6c6abc53e00607f906b2dd7fbdbd405dd623a623dcc4df37fc6d267ac4bcd24733109cb5e27851180cd3f82ba3490dd7a6d4a8a0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c16a86ee2a99614bac6e61197359434

SHA1
e5b522b4f12d0096d25d9dfb98a2527c31dff9e3

SHA256
a11caac8b24fe3c99c6bcb9853162ff19b1ccab2b64fe98377433ae468b476f9

SHA512
d50c788fd055f8caa850c2c92538f945b8b5c1e84daf6b81ecdc3724fc9a5baa92ba78f1fcbc54dacafaab1203aaf9d5fb70a8bbdfa25a5abcfceb10008060fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af2c4bbe6d1cf1d7f62141b82f69db62

SHA1
3a3ba852daec9e7ac8fb6d2818723bb9e8e45a41

SHA256
30a2de2eb1adaa01cc3011cb62a31ccecdabd05026ec3fe7b484b509a65dda65

SHA512
3bcef1362b6ee3d695f4005b4b04c992db38ab17a396f666da683b0565ec8a4905ce8ca99d457b3d0b156a8d25804c3df2466dc12fa6135994833a0b39bb449c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee365efb94c40a036c6ecb4451c15d65

SHA1
ff47b23b8a004553c48e26adfacce0540a341df1

SHA256
607baeb422df5e1a2737fd32b6bf03bf896ed677facead2b463474b346745115

SHA512
4cac6519a1dcf05f21e075e222cb48ac1edc9a1b33fa9154eb1b761cb0874063a2a48e06764dabb09aa0bc98e32d75d90aec6e55e6707a2b504adbdda984d5c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed3f0ae473257ccfc703a1569b49559a

SHA1
0d6a5f969e2a4bee14d75444e3d2ea3f6d231157

SHA256
331ed300f625ccfe55dbaa54b1afcab11a77e3b0ed677318c61b68ecdb961d57

SHA512
5b5a86d6586a966effe1a358de5739fed64753d5c52b0d1ea1b435ce511759e1bad70265637e2c697428daa1c8bb7a0f0da2e9db77fa446c5631616825e0d452

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9205992f73ac7551dfc1c731b63d9fe

SHA1
ff246adbfaf92ef3942430be5a7f9e01678f11c9

SHA256
c0bdc5be0d9e130b053d6544175a81b0cc23b76eb8fdec2a48194d1827ac0e53

SHA512
42d3cf1ceea5feea9a24dc0812b58608da3798a59c4d0d061fd43c9a6829d0b21d0dc8a593d1dccc4d6a4566ebb1fd2fd6118107f3c3244ff1a9a7328bc86b2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f48adcb7bddfe05487b989399ba7d089

SHA1
f10a7688e785b461699b4ecbac49bb2ff54234f2

SHA256
544044ae59d73bba0175fdeb797e26558ce4389128f58e3faf234c1218c7da87

SHA512
389d69ec340698414844cc2fda1913fc25df24372f3c52c2876f949ec33dc72d61281e67dd0fedf1c26b8bdb23e7950a4eefe376ff00160450d9eeaa28061114

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6b106f180e7bc4d8ebdca3e408d9a3c

SHA1
51a2373ebdf09130f34cb22506ba3bd302945417

SHA256
8a00e2192508286592897cfcd3f4a33ea8fa5e223ac3e952a8e8a8cd18943b62

SHA512
acc2af1de39ae991d83a3c8642ab011db17d4be969044faea11eb42308c5f293288338d7dc4254f50135fc55129313072a7ad08e007b032baa2bff553d6a4187

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b7b6aff9a886841edfce4ac8087d6e0d

SHA1
dbcce14e9db4fe9991fb760040619a8261eca41e

SHA256
c81fe2667f7415c0c670eb2a90932329248461f1e7584cbea00f479d054ec54f

SHA512
ed7f388d387647c871e6751544ee4ec55868bc7da4f2f4a55809f5e5fa1c59c720050d792f70b0e617d8b353546e6492a7c9aff456d4bae2c26320b098e72e18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
55e6119d04a39c7700673222c6e8f0fb

SHA1
d22fc02d44d553b27928c4923eb2ec37e476d752

SHA256
44681c72a44ef20a507eeed45396fa29b1f26ecdc8fd378afffaf6d08d8f70b2

SHA512
3d52e358c16123780e94f2f62bc9c156d28287c1ed1ba43c203b3439f704e3b7f5ac6a6d31353adac5913cf88987b713d8fc1c4c3ecd5a1fd0d23f90131ebdf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c809e59dd189ed476a95790eb295256f

SHA1
f5b39f948c4516b35c50323f7818befc05c60eb5

SHA256
834c0a043ade734819b7f1fd3bbfa877eec6205c752aa322d40d819e32d9fb3d

SHA512
05254aef6840a25dfbecc81c1f0b1c30de6af16ddbc7482d888e7d1e40fe521ba943c836cd59026b4117986fc70c258c8f8013041c0de4e983135239b85cba99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5bbffc00852c1ff53292255466d6aace

SHA1
c0aeae62aa45ec6731ba7ad473675d3a0dce28c8

SHA256
c7233eb6f45f9d0d4eb9ba346ac1b825b92ef2807816db29fb6bb61dd9376f2a

SHA512
9453e4af3b9002d27e7e3f799f90f7b8252b14632c364a00da31439ce6028893d519afe1f213b51e7d2fa55faf236db72bd40faf143fd50cf859fff86fbb40ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8864857b7ebadc483a74e98bf7492e0

SHA1
1d1168b6e6aaf3e818f5efba49b6556e6b80eedc

SHA256
149b071d56d573a0562a49ea133f5796be429304fa218b224ae9eba7da74e1f1

SHA512
c4a190c712a90da820a8ca40461c25e1edd593e4fe58a6a25315f5c21ab382f7cf5f400205229117484540e2a4b6313c773be77bac4d9826b600bd48f33dffa4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8060d50adf0d6687843e03ba795e7350

SHA1
d7c0684b78be4a813988184d43020367dd22f892

SHA256
135ca6a3d1ede15ff38996e17fee5d3a8a7c1e4ae61978b4ff457edd700493af

SHA512
de31e91a45b11cbd576cce5ed4faadfcc6ece9fed7b822f91a022949f8e17da0fb1814b01b14e660ee5f0274eda19140261b044e0f5e40efdb4f8fff2119009f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e8989b7f5fa90666c4e12d335cf4a98f

SHA1
b124d01a4cab64d4f624f4d6b4d0c7f988b329b7

SHA256
a9e7489146a120f072c39d3d2afe9516aec9b99f77ccc7161add10618ae91b0c

SHA512
7b3ffabc8c6b80d69f371fec28a1d37d29db2cad737278c02ed0d4a0e0571ffead1421c802671a0f23bfad95a07727fe580b3b6e9f05152c4a095930119c887d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a7d54a480b6d4c4a058b85cfef0178ab

SHA1
b88d4ac9a90610ed1b51ccc556b37e18a5eebaaf

SHA256
60a73c9405e89b421c78a44f6e95252b051343aaef81ab34c60261def9c0506a

SHA512
f28ed764ab057f11d510c6d0200bc6f941de29b88b07f1ac2807ceba2521310361c711f5e8f86ac5cc0b02218e8ead6170244df5158ef36d49e3b18e1a77436c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
676a39f2f3a4170aa9048e8135f770e5

SHA1
d8624f40fdd0400e360af9ad249d72e9f94fe9c0

SHA256
2985c0c69546a4c6c0b35a9c927a21a875f80db7cbf3ed5c6502f588cb958982

SHA512
82e85411f12dbe21c36679c7951c21b2d12368fe8d2745d3e390994b90fd8214bee02ac0aedef15efc468210a72fab925a79d506b1c44e1919404af8f7031a9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb57af41b0b468c4b68f5618b13af037

SHA1
324b8865a4f3ca8794a8ee81001067d34b37bfcf

SHA256
4e36fe14284311c23791c42087ceaa2f22637a2e6fe74613fef086129e112e7a

SHA512
6e9d2a5f02003c551e645b604a777dfca347ef2b98e4c1a47b7c6f2c65120de8cc8fe54cc7ae1877c548cb86ca3452e3103d698338b437eda06aa55c8f3a8dfb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{DC0E0361-9BF7-11EF-8C8D-7E918DD97D05}.dat

Filesize
5KB

MD5
e67c8137f22b23975e3a7600f244f8c1

SHA1
bbcee0ca48511ba6584439dd469bb82854024a84

SHA256
315650bb93800f00128ec28d539220a8f8c6c1b2dc7cb5f85f09809640cf9d07

SHA512
7eb67060d3c9d1c11426907ddd2df9c0216eaf83d7fca04ad495158ec3c36f1ba5d1f6f86f5e021cf7bf77d5887658904695609922071470cd471248df93f553

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_InternetExplorer.exe

Filesize
102KB

MD5
5844f433866e0eb7d1142a6fe03d67a2

SHA1
b98c822ead7d8228de59af904dfc5e9e9d48b7e5

SHA256
f0a192490cf0da43cf8c8ec39e7ad95e86a7ba9e7c8493d401727f62fd53f665

SHA512
35f083bd789e440619f371ad720aeb1c149c90ba6a4601e04482f41c490b1bdf0cfa43d2110e6c2ee195d4721717cf8d07829e658145fc31fdf383b051b28c27

Download Submit
C:\Users\Admin\AppData\Local\Temp\6LWdz8MS.xlsm

Filesize
23KB

MD5
570bf81e5f5bc63a19e08a9fb00ec38a

SHA1
2e0e74fc30b7e277173ef10ef96accce797e7a43

SHA256
5df19b150c1b4c7c7c07aa21b2da34d0f4a62340662c8ea486bededa54dfeffe

SHA512
ac51732fec13eb67b15b6e0e1d0f7991e45bf8ff46cd6e4ef28ef571fbce7f48ceaf3ce6eb18084106c52b98f1106d478d2809971521ffe34259cd9e04c5b369

Download Submit
C:\Users\Admin\AppData\Local\Temp\6LWdz8MS.xlsm

Filesize
32KB

MD5
38472534e64c11771a25ad7c56ef8122

SHA1
61f844ed72b3781f451ddb351a981840e484885d

SHA256
311c95d214144acca2cce2cc584541bbfeda4a9f1216ca94a12b7becc9fc5dfe

SHA512
f3c2d4473a1511f35e0e840e8d22dfb09b5cdbb165b2dfa1b3c07edd2083e4dac836755cb5ec476bb08108df592b5bc4f858dc4ae2d34c5e211d0491ff6107b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\6LWdz8MS.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF53A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF5AC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
memory/560-29-0x0000000000300000-0x0000000000310000-memory.dmp

Filesize
64KB

Download
memory/560-26-0x0000000000E90000-0x0000000000EAE000-memory.dmp

Filesize
120KB

Download
memory/576-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/576-25-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/2132-966-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/2132-554-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/2132-1430-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/2548-39-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2708-37-0x00000000003D0000-0x00000000003EE000-memory.dmp

Filesize
120KB

Download