Overview
overview
3Static
static
1synllc.git...ace.js
windows7-x64
3synllc.git...ace.js
windows10-2004-x64
3synllc.git...ook.js
windows7-x64
3synllc.git...ook.js
windows10-2004-x64
3synllc.git...min.js
windows7-x64
3synllc.git...min.js
windows10-2004-x64
3synllc.git...n.html
windows7-x64
3synllc.git...n.html
windows10-2004-x64
3synllc.git...g.html
windows7-x64
3synllc.git...g.html
windows10-2004-x64
3synllc.git...t.html
windows7-x64
3synllc.git...t.html
windows10-2004-x64
3synllc.git...y.html
windows7-x64
3synllc.git...y.html
windows10-2004-x64
3synllc.git...tor.js
windows7-x64
3synllc.git...tor.js
windows10-2004-x64
3synllc.git...min.js
windows7-x64
3synllc.git...min.js
windows10-2004-x64
3synllc.git...ght.js
windows7-x64
3synllc.git...ght.js
windows10-2004-x64
3synllc.git...x.html
windows7-x64
3synllc.git...x.html
windows10-2004-x64
3synllc.git...n.html
windows7-x64
3synllc.git...n.html
windows10-2004-x64
3synllc.git...n.html
windows7-x64
3synllc.git...n.html
windows10-2004-x64
3synllc.git...min.js
windows7-x64
3synllc.git...min.js
windows10-2004-x64
3synllc.git...ust.js
windows7-x64
3synllc.git...ust.js
windows10-2004-x64
3synllc.git...t.html
windows7-x64
3synllc.git...t.html
windows10-2004-x64
3Analysis
-
max time kernel
15s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07/11/2024, 22:38
Static task
static1
Behavioral task
behavioral1
Sample
synllc.github.io/synapse-x-documentation/ace.js
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
synllc.github.io/synapse-x-documentation/ace.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
synllc.github.io/synapse-x-documentation/book.js
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
synllc.github.io/synapse-x-documentation/book.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
synllc.github.io/synapse-x-documentation/clipboard.min.js
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
synllc.github.io/synapse-x-documentation/clipboard.min.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
synllc.github.io/synapse-x-documentation/development/dev_introduction.html
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
synllc.github.io/synapse-x-documentation/development/dev_introduction.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
synllc.github.io/synapse-x-documentation/development/supervisor_programming.html
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
synllc.github.io/synapse-x-documentation/development/supervisor_programming.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
synllc.github.io/synapse-x-documentation/development/syn_environment.html
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
synllc.github.io/synapse-x-documentation/development/syn_environment.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
synllc.github.io/synapse-x-documentation/development/syn_security.html
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
synllc.github.io/synapse-x-documentation/development/syn_security.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
synllc.github.io/synapse-x-documentation/editor.js
Resource
win7-20240729-en
Behavioral task
behavioral16
Sample
synllc.github.io/synapse-x-documentation/editor.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
synllc.github.io/synapse-x-documentation/elasticlunr.min.js
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
synllc.github.io/synapse-x-documentation/elasticlunr.min.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
synllc.github.io/synapse-x-documentation/highlight.js
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
synllc.github.io/synapse-x-documentation/highlight.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
synllc.github.io/synapse-x-documentation/index.html
Resource
win7-20241010-en
Behavioral task
behavioral22
Sample
synllc.github.io/synapse-x-documentation/index.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
synllc.github.io/synapse-x-documentation/install/installation.html
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
synllc.github.io/synapse-x-documentation/install/installation.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
synllc.github.io/synapse-x-documentation/introduction.html
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
synllc.github.io/synapse-x-documentation/introduction.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
synllc.github.io/synapse-x-documentation/mark.min.js
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
synllc.github.io/synapse-x-documentation/mark.min.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
synllc.github.io/synapse-x-documentation/mode-rust.js
Resource
win7-20241010-en
Behavioral task
behavioral30
Sample
synllc.github.io/synapse-x-documentation/mode-rust.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
synllc.github.io/synapse-x-documentation/print.html
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
synllc.github.io/synapse-x-documentation/print.html
Resource
win10v2004-20241007-en
General
-
Target
synllc.github.io/synapse-x-documentation/development/syn_environment.html
-
Size
32KB
-
MD5
f5bf1317b50b8c97d44358ca731520e3
-
SHA1
abd293c2eb956fb4877ae6e05aa84194591f3798
-
SHA256
a71648bb926ddb02833795fee02e8fc61017582d594beec8844ecf9a7f34a24d
-
SHA512
8ceb203da7e628f86ed3f359b1156ce850829ba1eeb65bce31e63c972051ee14ad5125f31f265fe31217637ed2a21fcc194d8b0ca6ed58460e1334bf02ffafb6
-
SSDEEP
384:CCJnxfrhusSDfJsM0Il6Pof/oaADEcvVOjdjkOApO/nf4DaAbFtf0fXUCqZXYjoR:/JJHRHTfnblR6EnLV
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{12D67731-9D59-11EF-8287-5EE01BAFE073} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2112 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2112 iexplore.exe 2112 iexplore.exe 2164 IEXPLORE.EXE 2164 IEXPLORE.EXE 2164 IEXPLORE.EXE 2164 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2112 wrote to memory of 2164 2112 iexplore.exe 31 PID 2112 wrote to memory of 2164 2112 iexplore.exe 31 PID 2112 wrote to memory of 2164 2112 iexplore.exe 31 PID 2112 wrote to memory of 2164 2112 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\synllc.github.io\synapse-x-documentation\development\syn_environment.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2112 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2164
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD538ba2bd9b348fb813885ae584c20e381
SHA1e5b07cd17d8f7fa59c279b893975b008b1e11f90
SHA256aa14de2f637f20a2443995f0aa311ec1e69331b65dac106fb7d2a583a263c5b0
SHA51218c6e7cd27a68a5c56ebe01303a6e22ef31f05ed408607ee6d0a25534dbbaba866a2de508772dc82348709e8759bdabfa30f710d34d6e992de4422247069ffc1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD520754972c1ecb5d821a362a0f99e7053
SHA1ce36b9bf3a23c1418f8082955a045147180b89c9
SHA256f344fa1692c585dae843bdcfc9d5a01cd199591e597a91297983f6c863c6e92b
SHA5124b0aa837723ade3cb6529291eaabdb070ac0071e4ca35a18468dfd0ea8d1395d4ded19938b1631e3d2acf06f21f4b3e150cd97e1001937b0d700d304c2c28608
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5609e19f6cf551ccda57aea6f1b0f10f6
SHA14ff04585209608e348c799645136cbf2afd8ea64
SHA25681bd724e1cd08ec28991f0bb19a6bea040b6fb044e81940df532f1bd72f2a126
SHA5127df86ea1b0a750e316434ea3af978cd373759ba484e3fe524ef0c81e60c90b0dcfbb51c1592e4a7a676b31dabf61341f4a29a9b45f33831a8c193dc2c5064769
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c6ea61ab59aa37253bc9c4acda68df59
SHA19ada390c49c50488e6d347761cb343c9fb853508
SHA2569858c6242576a8ee1d88e3a4171891641bf43c90ab58e3eda6f4510e077884cc
SHA512f1b3b6ce3db5df0b8019894481438c1b085f33c04cc0c1a85746fe82df527b55844e546f9f8a2ceb22e7245ed819b85734eeaf46f6d7e7e0d22b3024b17bfd0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ec21c8d90fc258049594075d1158fd6
SHA1f9c36cf33dafb9693b9071b5eedf354682cfb80a
SHA256b352352a33e2eda3b63263fe25945caef82661474f258eacc653e5877bc19a5b
SHA51252f8f320c5a691d8d4608c86d5ec79ecec18b98602a087ba3aec3b08bef903048ab155412c5e83c63105cacec5544b9ad7744482456a651206eda63d2a37372f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5255051a320514681447e5f5804eff8de
SHA1e5a0dc58e891074377118338cfa13f9364d4663e
SHA2561b85a989a9256ca6908e7ba32647cbf54cc04cd0662273ca8fbfbb1707862616
SHA5128d1415aa7f614227a97030762a9793e1b3667b328bb1cd617af4b01d831edd5892440fb6eb89e5d0bb17642a15ec9bc1678f999d7558b4dd640c7623306c6c04
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5748f46acd1a8f466bcba1b0642e099e4
SHA17ae9e2b9d4dfd17ec574887e1206c2bdac3a498f
SHA256bada7cd06b6ec3770ea6f6f9fe05354d526fd989db314622c9fd53cefc7f4efb
SHA512ab36cfc5c8bfd6464b7a293862a6c34c020ba7fec317e65bf2e0180c58eb9889e8a8884ca1d248e6736d0b62c59ea2866096df56796419c798cf632938af9a5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56a4ad73669a215a8b0f768036298b8a9
SHA126bb0c7c705781e26c728fd5742060b2c8954f2a
SHA256c4312ec81f5279ae43c40a0b3328304a3b97dace2b6083fa2d2ef28fa12ffff7
SHA512d4b3419251e99ea0b4d6b5d834a5d42889f7b416904aa40fbcabeabc653d3a108cc6bb7a4b4bba31aabab524d71636d29f39f884c6e98e0ac0a33902ead251ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5db8db3d91be04036f1bd8d6031d1abb0
SHA1516366fa5369dbccb678e37fba6e6888793bdb14
SHA256020e066921a6ae89461d37256cbc5af5689b4915bebf1a12dca202555f91438b
SHA512ef9f7db2e98b81286945974b3e667c1702557fe92b885983586a20bc459809638d29ae328fe2da7bf627fe4c8684cf208f6ead3948d726aa5cb3b9c294a9a152
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b