Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3SynapseZ C...er.exe
windows11-21h2-x64
10SynapseZ C...7c.bin
windows11-21h2-x64
3SynapseZ C...Ek.exe
windows11-21h2-x64
3SynapseZ C...re.dll
windows11-21h2-x64
3SynapseZ C...ss.exe
windows11-21h2-x64
3SynapseZ C...re.dll
windows11-21h2-x64
3SynapseZ C...pf.dll
windows11-21h2-x64
3SynapseZ C...rp.dll
windows11-21h2-x64
3SynapseZ C...r.html
windows11-21h2-x64
3SynapseZ C...tt.exe
windows11-21h2-x64
3SynapseZ C...or.dll
windows11-21h2-x64
9SynapseZ C...lf.dll
windows11-21h2-x64
3SynapseZ C...47.dll
windows11-21h2-x64
3SynapseZ C...GL.dll
windows11-21h2-x64
3SynapseZ C...v2.dll
windows11-21h2-x64
3SynapseZ C...mp.exe
windows11-21h2-x64
9Analysis
-
max time kernel
11s -
max time network
22s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
18/11/2024, 01:29
Static task
static1
Behavioral task
behavioral1
Sample
SynapseZ Cracked V5.2/Synapse X Launcher.exe
Resource
win11-20241023-en
Behavioral task
behavioral2
Sample
SynapseZ Cracked V5.2/auth/internal/3132e54eb7c.bin
Resource
win11-20241007-en
Behavioral task
behavioral3
Sample
SynapseZ Cracked V5.2/bin/359k6u5HUNL4tEk.exe
Resource
win11-20241007-en
Behavioral task
behavioral4
Sample
SynapseZ Cracked V5.2/bin/CefSharp.BrowserSubprocess.Core.dll
Resource
win11-20241007-en
Behavioral task
behavioral5
Sample
SynapseZ Cracked V5.2/bin/CefSharp.BrowserSubprocess.exe
Resource
win11-20241023-en
Behavioral task
behavioral6
Sample
SynapseZ Cracked V5.2/bin/CefSharp.Core.dll
Resource
win11-20241007-en
Behavioral task
behavioral7
Sample
SynapseZ Cracked V5.2/bin/CefSharp.Wpf.dll
Resource
win11-20241007-en
Behavioral task
behavioral8
Sample
SynapseZ Cracked V5.2/bin/CefSharp.dll
Resource
win11-20241007-en
Behavioral task
behavioral9
Sample
SynapseZ Cracked V5.2/bin/Editor.html
Resource
win11-20241007-en
Behavioral task
behavioral10
Sample
SynapseZ Cracked V5.2/bin/OoxIi8qtt.exe
Resource
win11-20241007-en
Behavioral task
behavioral11
Sample
SynapseZ Cracked V5.2/bin/SynapseInjector.dll
Resource
win11-20241007-en
Behavioral task
behavioral12
Sample
SynapseZ Cracked V5.2/bin/chrome_elf.dll
Resource
win11-20241007-en
Behavioral task
behavioral13
Sample
SynapseZ Cracked V5.2/bin/d3dcompiler_47.dll
Resource
win11-20241023-en
Behavioral task
behavioral14
Sample
SynapseZ Cracked V5.2/bin/libEGL.dll
Resource
win11-20241007-en
Behavioral task
behavioral15
Sample
SynapseZ Cracked V5.2/bin/libGLESv2.dll
Resource
win11-20241007-en
General
-
Target
SynapseZ Cracked V5.2/bin/Editor.html
-
Size
2KB
-
MD5
485f27d7faac7ec77e02be39737cc9a4
-
SHA1
55722137ae4b2636a31ff7f42537133e7d7b40f0
-
SHA256
cf65942ebe2cd8e704cf83dbac9fef38cd714219d0e068707b314d69fb1f3f74
-
SHA512
001343387aebf0039c6359e81b64bd9630353d997ee78669c9b535905c90663691d5ad965911ed3b5e0967e2ad32e9d270d7623a879bffdc77ab1d5f4c9fcf0d
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 236 msedge.exe 236 msedge.exe 412 msedge.exe 412 msedge.exe 940 msedge.exe 940 msedge.exe 2576 identity_helper.exe 2576 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 412 wrote to memory of 3128 412 msedge.exe 80 PID 412 wrote to memory of 3128 412 msedge.exe 80 PID 412 wrote to memory of 3136 412 msedge.exe 81 PID 412 wrote to memory of 3136 412 msedge.exe 81 PID 412 wrote to memory of 3136 412 msedge.exe 81 PID 412 wrote to memory of 3136 412 msedge.exe 81 PID 412 wrote to memory of 3136 412 msedge.exe 81 PID 412 wrote to memory of 3136 412 msedge.exe 81 PID 412 wrote to memory of 3136 412 msedge.exe 81 PID 412 wrote to memory of 3136 412 msedge.exe 81 PID 412 wrote to memory of 3136 412 msedge.exe 81 PID 412 wrote to memory of 3136 412 msedge.exe 81 PID 412 wrote to memory of 3136 412 msedge.exe 81 PID 412 wrote to memory of 3136 412 msedge.exe 81 PID 412 wrote to memory of 3136 412 msedge.exe 81 PID 412 wrote to memory of 3136 412 msedge.exe 81 PID 412 wrote to memory of 3136 412 msedge.exe 81 PID 412 wrote to memory of 3136 412 msedge.exe 81 PID 412 wrote to memory of 3136 412 msedge.exe 81 PID 412 wrote to memory of 3136 412 msedge.exe 81 PID 412 wrote to memory of 3136 412 msedge.exe 81 PID 412 wrote to memory of 3136 412 msedge.exe 81 PID 412 wrote to memory of 3136 412 msedge.exe 81 PID 412 wrote to memory of 3136 412 msedge.exe 81 PID 412 wrote to memory of 3136 412 msedge.exe 81 PID 412 wrote to memory of 3136 412 msedge.exe 81 PID 412 wrote to memory of 3136 412 msedge.exe 81 PID 412 wrote to memory of 3136 412 msedge.exe 81 PID 412 wrote to memory of 3136 412 msedge.exe 81 PID 412 wrote to memory of 3136 412 msedge.exe 81 PID 412 wrote to memory of 3136 412 msedge.exe 81 PID 412 wrote to memory of 3136 412 msedge.exe 81 PID 412 wrote to memory of 3136 412 msedge.exe 81 PID 412 wrote to memory of 3136 412 msedge.exe 81 PID 412 wrote to memory of 3136 412 msedge.exe 81 PID 412 wrote to memory of 3136 412 msedge.exe 81 PID 412 wrote to memory of 3136 412 msedge.exe 81 PID 412 wrote to memory of 3136 412 msedge.exe 81 PID 412 wrote to memory of 3136 412 msedge.exe 81 PID 412 wrote to memory of 3136 412 msedge.exe 81 PID 412 wrote to memory of 3136 412 msedge.exe 81 PID 412 wrote to memory of 3136 412 msedge.exe 81 PID 412 wrote to memory of 236 412 msedge.exe 82 PID 412 wrote to memory of 236 412 msedge.exe 82 PID 412 wrote to memory of 4540 412 msedge.exe 83 PID 412 wrote to memory of 4540 412 msedge.exe 83 PID 412 wrote to memory of 4540 412 msedge.exe 83 PID 412 wrote to memory of 4540 412 msedge.exe 83 PID 412 wrote to memory of 4540 412 msedge.exe 83 PID 412 wrote to memory of 4540 412 msedge.exe 83 PID 412 wrote to memory of 4540 412 msedge.exe 83 PID 412 wrote to memory of 4540 412 msedge.exe 83 PID 412 wrote to memory of 4540 412 msedge.exe 83 PID 412 wrote to memory of 4540 412 msedge.exe 83 PID 412 wrote to memory of 4540 412 msedge.exe 83 PID 412 wrote to memory of 4540 412 msedge.exe 83 PID 412 wrote to memory of 4540 412 msedge.exe 83 PID 412 wrote to memory of 4540 412 msedge.exe 83 PID 412 wrote to memory of 4540 412 msedge.exe 83 PID 412 wrote to memory of 4540 412 msedge.exe 83 PID 412 wrote to memory of 4540 412 msedge.exe 83 PID 412 wrote to memory of 4540 412 msedge.exe 83 PID 412 wrote to memory of 4540 412 msedge.exe 83 PID 412 wrote to memory of 4540 412 msedge.exe 83
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\SynapseZ Cracked V5.2\bin\Editor.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0xa8,0x104,0x108,0xe0,0x10c,0x7ff828dc3cb8,0x7ff828dc3cc8,0x7ff828dc3cd82⤵PID:3128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,5861965842486354907,18394824915483139773,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1896 /prefetch:22⤵PID:3136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,5861965842486354907,18394824915483139773,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,5861965842486354907,18394824915483139773,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2604 /prefetch:82⤵PID:4540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,5861965842486354907,18394824915483139773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:4496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,5861965842486354907,18394824915483139773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:12⤵PID:1556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,5861965842486354907,18394824915483139773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:12⤵PID:3348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,5861965842486354907,18394824915483139773,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:12⤵PID:3480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,5861965842486354907,18394824915483139773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:12⤵PID:1628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,5861965842486354907,18394824915483139773,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:12⤵PID:1720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,5861965842486354907,18394824915483139773,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,5861965842486354907,18394824915483139773,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2576
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4736
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3972
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5c0a1774f8079fe496e694f35dfdcf8bc
SHA1da3b4b9fca9a3f81b6be5b0cd6dd700603d448d3
SHA256c041da0b90a5343ede7364ccf0428852103832c4efa8065a0cd1e8ce1ff181cb
SHA51260d9e87f8383fe3afa2c8935f0e5a842624bb24b03b2d8057e0da342b08df18cf70bf55e41fa3ae54f73bc40a274cf6393d79ae01f6a1784273a25fa2761728b
-
Filesize
152B
MD5e11c77d0fa99af6b1b282a22dcb1cf4a
SHA12593a41a6a63143d837700d01aa27b1817d17a4d
SHA256d96f9bfcc81ba66db49a3385266a631899a919ed802835e6fb6b9f7759476ea0
SHA512c8f69f503ab070a758e8e3ae57945c0172ead1894fdbfa2d853e5bb976ed3817ecc8f188eefd5092481effd4ef650788c8ff9a8d9a5ee4526f090952d7c859f3
-
Filesize
5KB
MD5182d4d510673e67eb7951d9944050fde
SHA135264f059837026803112a02f4f7efd3fdb01e86
SHA25650f14a45491bd55ca00089f89662a90536c357012ee21ca755b0f57acbc3a574
SHA512ca642e9b8ff053a85d6f9858992fcdcd95eff601ca500fc587eaf31bb62ea98da7e310e8016cfbdefd5c378528af7e44e0836dd0ab47d01e4df99d0570514b55
-
Filesize
5KB
MD539fa073451ba200e9801f16c437b1d8e
SHA11dd9bc77b4923402b86555fe4a76dd682b4a2553
SHA256b5153a7bead979c63402c07caa515dd50fca84bcae4f12e3de6b072ba5a529d0
SHA5126baf83988720052a993092e726f159205b82f12c1af21dfee8234d4a8c3eb15052b5728b9d212b3df24d4d374ba2f545dcf667cbfdb67cbc9ce3c363802fc859
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
10KB
MD58d093e3c78515081d63082346a0f2870
SHA15b491627a0fb335697a88fddd847cd7fbfafd493
SHA256b13bbe863384d6d4f67f496e9c6ddb43e9295214e39d0ca641944b9ce9557314
SHA512b4a1e3669549cf4c7d4a3bc8c432215d8b1788ce9b04faf4b5ab1cb7526621f5eddf608ab0f88f7b7c70c38a81b608c58452232542882cf78986caa8e64236a7