Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
18-11-2024 08:47
Behavioral task
behavioral1
Sample
MunzyTempSpoofer.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
MunzyTempSpoofer.exe
Resource
win10v2004-20241007-en
General
-
Target
MunzyTempSpoofer.exe
-
Size
1.1MB
-
MD5
9ecc5c00e6ef385d71f87f66da559241
-
SHA1
f0f1bec3a9ae9214bb2daa3574f6dd064f6c2451
-
SHA256
f5855524bf79d214423b91be83872ebf9674fe277175b6ab28b6c48be3d07f3e
-
SHA512
b8cd2b51a42d30257b9bbf3cec0326ed933d1f0a1a824159551b92d244d6d3790bbb1b0e465bfa6a7251c7e95a7eedbb2eddc2d4635a89a248a95088b3865dc1
-
SSDEEP
24576:onsJ39LyjbJkQFMhmC+6GD9tMhriNgMJ+/n:onsHyjtk2MYC5GDkhriin
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Executes dropped EXE 3 IoCs
pid Process 2212 ._cache_MunzyTempSpoofer.exe 2960 Synaptics.exe 3032 ._cache_Synaptics.exe -
Loads dropped DLL 5 IoCs
pid Process 1688 MunzyTempSpoofer.exe 1688 MunzyTempSpoofer.exe 1688 MunzyTempSpoofer.exe 2960 Synaptics.exe 2960 Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" MunzyTempSpoofer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MunzyTempSpoofer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 ._cache_Synaptics.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 ._cache_Synaptics.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2536 EXCEL.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2212 ._cache_MunzyTempSpoofer.exe Token: SeDebugPrivilege 3032 ._cache_Synaptics.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2536 EXCEL.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1688 wrote to memory of 2212 1688 MunzyTempSpoofer.exe 30 PID 1688 wrote to memory of 2212 1688 MunzyTempSpoofer.exe 30 PID 1688 wrote to memory of 2212 1688 MunzyTempSpoofer.exe 30 PID 1688 wrote to memory of 2212 1688 MunzyTempSpoofer.exe 30 PID 1688 wrote to memory of 2960 1688 MunzyTempSpoofer.exe 31 PID 1688 wrote to memory of 2960 1688 MunzyTempSpoofer.exe 31 PID 1688 wrote to memory of 2960 1688 MunzyTempSpoofer.exe 31 PID 1688 wrote to memory of 2960 1688 MunzyTempSpoofer.exe 31 PID 2960 wrote to memory of 3032 2960 Synaptics.exe 32 PID 2960 wrote to memory of 3032 2960 Synaptics.exe 32 PID 2960 wrote to memory of 3032 2960 Synaptics.exe 32 PID 2960 wrote to memory of 3032 2960 Synaptics.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\MunzyTempSpoofer.exe"C:\Users\Admin\AppData\Local\Temp\MunzyTempSpoofer.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\._cache_MunzyTempSpoofer.exe"C:\Users\Admin\AppData\Local\Temp\._cache_MunzyTempSpoofer.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2212
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:3032
-
-
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2536
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD59ecc5c00e6ef385d71f87f66da559241
SHA1f0f1bec3a9ae9214bb2daa3574f6dd064f6c2451
SHA256f5855524bf79d214423b91be83872ebf9674fe277175b6ab28b6c48be3d07f3e
SHA512b8cd2b51a42d30257b9bbf3cec0326ed933d1f0a1a824159551b92d244d6d3790bbb1b0e465bfa6a7251c7e95a7eedbb2eddc2d4635a89a248a95088b3865dc1
-
Filesize
24KB
MD5fb9df76285e907abb073de727915a56d
SHA1202160a7758e4a560185879c22cad221645cbf53
SHA2561fa0eebd074eaaec4642d7140bd8f6509edb8514dff446abd7b3e4e8abb90dd1
SHA5122176bcaf82b7ce4708df8734d1872b092abf1920cb46b5b7922bb687d56f133f485dcd9d80cd899ba07927ba3447a7c9a0c4ad7627ce3978d6cedbe28edfb9ce
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
404KB
MD55943152febf4a8f81d10761dae44b013
SHA1ed988f1166c47c098d45d78df08e94357dfd589e
SHA25604772a59466564dabfcc0213fa6c86088f20f3ffa39c7f06c1f24d132ce19b78
SHA512ac818af07ebaa435dd9aeba9941de83e6c5472aca750a0ce67f1375b9e74146927c07a56737f49ec33b1b587e7cac78f44374d51fbff36cd86f19c797355d0d6