xred | 710b936106397a34d7f1000e74f032687067b21893d76ccfd3ea4bf5d9111d91

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-11-2024 09:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

710b936106397a34d7f1000e74f032687067b21893d76ccfd3ea4bf5d9111d91N.exe
Size

2.4MB
MD5

bfe942ca711739d291ad987cc724a3a0
SHA1

317df04b21c29b20c45c4a007ca33cf3d6357392
SHA256

710b936106397a34d7f1000e74f032687067b21893d76ccfd3ea4bf5d9111d91
SHA512

836bd519511e760a8496787f02dfe26aeb3b45c1603cbbaa2c7adcb5dccb7fc794a87033634f8870fe686e864b6fca42bc920ebc934e78f0f4c7b7d4c10d84e8
SSDEEP

49152:snsHyjtk2MYC5GDvxdth7VaHBIW2Y4XxChF6Hq2BIetbWx:snsmtk2a8F6fT4XAhIH+eVWx

Score

10^/10

xred backdoor discovery persistence

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Executes dropped EXE 11 IoCs

pid	Process
3064	._cache_710b936106397a34d7f1000e74f032687067b21893d76ccfd3ea4bf5d9111d91N.exe
2084	Synaptics.exe
1672	Setup.exe
2972	IKernel.exe
2316	._cache_Synaptics.exe
2324	Setup.exe
844	IKernel.exe
1516	IKernel.exe
1352	IKernel.exe
2900	iKernel.exe
2672	iKernel.exe

Loads dropped DLL 64 IoCs

pid	Process
2840	710b936106397a34d7f1000e74f032687067b21893d76ccfd3ea4bf5d9111d91N.exe
3064	._cache_710b936106397a34d7f1000e74f032687067b21893d76ccfd3ea4bf5d9111d91N.exe
3064	._cache_710b936106397a34d7f1000e74f032687067b21893d76ccfd3ea4bf5d9111d91N.exe
3064	._cache_710b936106397a34d7f1000e74f032687067b21893d76ccfd3ea4bf5d9111d91N.exe
3064	._cache_710b936106397a34d7f1000e74f032687067b21893d76ccfd3ea4bf5d9111d91N.exe
2840	710b936106397a34d7f1000e74f032687067b21893d76ccfd3ea4bf5d9111d91N.exe
2840	710b936106397a34d7f1000e74f032687067b21893d76ccfd3ea4bf5d9111d91N.exe
1672	Setup.exe
1672	Setup.exe
1672	Setup.exe
1672	Setup.exe
2972	IKernel.exe
2972	IKernel.exe
2972	IKernel.exe
2084	Synaptics.exe
2084	Synaptics.exe
2316	._cache_Synaptics.exe
2316	._cache_Synaptics.exe
2316	._cache_Synaptics.exe
2316	._cache_Synaptics.exe
2324	Setup.exe
2324	Setup.exe
2324	Setup.exe
2324	Setup.exe
2324	Setup.exe
2324	Setup.exe
844	IKernel.exe
844	IKernel.exe
844	IKernel.exe
1516	IKernel.exe
1516	IKernel.exe
1516	IKernel.exe
1352	IKernel.exe
1352	IKernel.exe
1352	IKernel.exe
1516	IKernel.exe
1352	IKernel.exe
1352	IKernel.exe
1352	IKernel.exe
1352	IKernel.exe
1352	IKernel.exe
1352	IKernel.exe
1516	IKernel.exe
1516	IKernel.exe
1352	IKernel.exe
1516	IKernel.exe
1516	IKernel.exe
1516	IKernel.exe
1516	IKernel.exe
2900	iKernel.exe
2900	iKernel.exe
2900	iKernel.exe
1516	IKernel.exe
1516	IKernel.exe
1516	IKernel.exe
1516	IKernel.exe
2672	iKernel.exe
2672	iKernel.exe
2672	iKernel.exe
1352	IKernel.exe
2324	Setup.exe
1352	IKernel.exe
1352	IKernel.exe
1352	IKernel.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	710b936106397a34d7f1000e74f032687067b21893d76ccfd3ea4bf5d9111d91N.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\setup.ini	IKernel.exe
File opened for modification	C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\objectps.dll	IKernel.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\iuse7169.rra	IKernel.exe
File created	C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\layo9f8a.rra	IKernel.exe
File opened for modification	C:\PROGRA~2\COMMON~1\INSTAL~1\Engine\6\INTEL3~1\corecomp.ini	IKernel.exe
File opened for modification	C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\setup.inx	IKernel.exe
File opened for modification	C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\layout.bin	IKernel.exe
File opened for modification	C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\data1.hdr	IKernel.exe
File created	C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\Setu9f99.rra	IKernel.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\temp.000	Setup.exe
File opened for modification	C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\ctor.dll	IKernel.exe
File opened for modification	C:\PROGRA~2\COMMON~1\INSTAL~1\Engine\6\INTEL3~1\corecomp.ini	IKernel.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\ctor710b.rra	IKernel.exe
File opened for modification	C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\Setup.ini	IKernel.exe
File opened for modification	C:\Program Files (x86)\InstallShield Installation Information	IKernel.exe
File opened for modification	C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\Setup.exe	IKernel.exe
File opened for modification	C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\iuser.dll	IKernel.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\IScript\iscr7197.rra	IKernel.exe
File created	C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\data9f8a.rra	IKernel.exe
File opened for modification	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\corecomp.ini	IKernel.exe
File created	C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\Setu9fa9.rra	IKernel.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\core710b.rra	IKernel.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\obje7159.rra	IKernel.exe
File opened for modification	C:\Program Files (x86)\Common Files\InstallShield\IScript\iscript.dll	IKernel.exe
File created	C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\data9f99.rra	IKernel.exe
File opened for modification	C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\data1.cab	IKernel.exe
File created	C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\setu9fb9.rra	IKernel.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IKernel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IKernel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	710b936106397a34d7f1000e74f032687067b21893d76ccfd3ea4bf5d9111d91N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_710b936106397a34d7f1000e74f032687067b21893d76ccfd3ea4bf5d9111d91N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IKernel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iKernel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IKernel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iKernel.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AA7E2068-CB55-11D2-8094-00104B1F9838}\ProxyStubClsid32	IKernel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AA7E2061-CB55-11D2-8094-00104B1F9838}	IKernel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D4FF39BB-1A05-11D3-8896-00C04F72F303}	IKernel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3D8B6332-D8B1-11D2-80C5-00104B1F6CEA}\TypeLib\Version = "1.0"	IKernel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{112EB4F0-5A48-11D3-A90A-00105A088FAC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	IKernel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C3C1B12-E59D-11D2-B40B-00A024B9DDDD}\ProxyStubClsid32	IKernel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{44D61997-B7D4-11D2-80BA-00104B1F6CEA}\TypeLib	IKernel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AF57A6F0-4101-11D3-88F6-00C04F72F303}\TypeLib	IKernel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Setup.LogServices.1	IKernel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6494206F-23EA-11D3-88B0-00C04F72F303}	IKernel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DED5FEEC-225A-11D3-88AA-00C04F72F303}\TypeLib\ = "{91814EB1-B5F0-11D2-80B9-00104B1F6CEA}"	iKernel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C3C1B11-E59D-11D2-B40B-00A024B9DDDD}\TypeLib\Version = "1.0"	IKernel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C3C1B13-E59D-11D2-B40B-00A024B9DDDD}\ = "ISetupFeatureLogs"	IKernel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AA7E2069-CB55-11D2-8094-00104B1F9838}	IKernel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8415DE38-1C1D-11D3-889D-00C04F72F303}\TypeLib\Version = "1.0"	IKernel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E1B9357F-24B9-11D3-88B2-00C04F72F303}	IKernel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7BB118F1-6D5B-470E-82D0-AFB042724560}\TypeLib\Version = "1.0"	IKernel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{65D37452-0EBB-11D3-887B-00C04F72F303}\TypeLib	IKernel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{65D37452-0EBB-11D3-887B-00C04F72F303}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	IKernel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Setup.User\CLSID\ = "{C9CD1A93-D7B4-11D2-80C5-00104B1F6CEA}"	IKernel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CC096170-E2CB-11D2-80C8-00104B1F6CEA}\TypeLib\Version = "1.0"	IKernel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AA7E2061-CB55-11D2-8094-00104B1F9838}\ProxyStubClsid32	IKernel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9CFCFE67-0BB8-43E0-8425-378D0A02ACE4}\TypeLib	IKernel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FEBEC920-1849-11D3-A8FE-00105A088FAC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	IKernel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{65D37452-0EBB-11D3-887B-00C04F72F303}\ = "ISetupRegistry"	IKernel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F4817E4B-04B6-11D3-8862-00C04F72F303}\NumMethods	IKernel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CC096170-E2CB-11D2-80C8-00104B1F6CEA}\TypeLib\ = "{91814EB1-B5F0-11D2-80B9-00104B1F6CEA}"	IKernel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91814EBF-B5F0-11D2-80B9-00104B1F6CEA}\TypeLib\Version = "1.0"	IKernel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3EE77D8B-40C1-4A2A-9B77-421907F02058}\TypeLib\Version = "1.0"	IKernel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8C3C1B10-E59D-11D2-B40B-00A024B9DDDD}\TypeLib\ = "{27D2CF3C-D5B0-11D2-8094-00104B1F9838}"	IKernel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{112EB4F0-5A48-11D3-A90A-00105A088FAC}\ = "ISetupWindowBillBoards"	IKernel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BE6115A1-7DE5-48DC-AD2A-25060E00FCE2}\ = "ISetupTransferEvents2"	IKernel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{83755DD1-086B-11D3-8868-00C04F72F303}\TypeLib	IKernel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AA7E2066-CB55-11D2-8094-00104B1F9838}\TypeLib\ = "{27D2CF3C-D5B0-11D2-8094-00104B1F9838}"	IKernel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FEBEC920-1849-11D3-A8FE-00105A088FAC}	IKernel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C3C1B11-E59D-11D2-B40B-00A024B9DDDD}\ = "ISetupFeatureLog"	IKernel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AA7E2065-CB55-11D2-8094-00104B1F9838}\ProxyStubClsid32	IKernel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91814EC1-B5F0-11D2-80B9-00104B1F6CEA}\TypeLib\Version = "1.0"	IKernel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4FF39B9-1A05-11D3-8896-00C04F72F303}\TypeLib\Version = "1.0"	IKernel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Setup.Kernel.1	IKernel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3EDC2C10-66FE-11D3-A90F-00105A088FAC}\ProxyStubClsid32	IKernel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C9CD1A93-D7B4-11D2-80C5-00104B1F6CEA}\InprocServer32	IKernel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AA7E2066-CB55-11D2-8094-00104B1F9838}\ProxyStubClsid32	IKernel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{54DADAB3-28A6-11D3-88BA-00C04F72F303}\TypeLib\ = "{91814EB1-B5F0-11D2-80B9-00104B1F6CEA}"	IKernel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8C3C1B16-E59D-11D2-B40B-00A024B9DDDD}\TypeLib\ = "{27D2CF3C-D5B0-11D2-8094-00104B1F9838}"	IKernel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F4817E4B-04B6-11D3-8862-00C04F72F303}\NumMethods\ = "6"	IKernel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8c3c1b17-e59d-11d2-b40b-00a024b9dddd}\ = "SetupLogServices Class"	iKernel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C3C1B10-E59D-11D2-B40B-00A024B9DDDD}\TypeLib	IKernel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{761C8359-55AF-4E7B-9C83-C1A927E0F617}\TypeLib	IKernel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8c3c1b17-e59d-11d2-b40b-00a024b9dddd}\ = "SetupLogServices Class"	IKernel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6494206F-23EA-11D3-88B0-00C04F72F303}\ = "ISetupPropertyBag"	IKernel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AA7E2087-CB55-11D2-8094-00104B1F9838}\VersionIndependentProgID\ = "Setup.ScriptObjectWrapper"	IKernel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Setup.User\CLSID\ = "{C9CD1A93-D7B4-11D2-80C5-00104B1F6CEA}"	IKernel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Setup.Kernel\CLSID	iKernel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C3C1B12-E59D-11D2-B40B-00A024B9DDDD}\TypeLib\ = "{91814EB1-B5F0-11D2-80B9-00104B1F6CEA}"	iKernel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AA7E2062-CB55-11D2-8094-00104B1F9838}\TypeLib\ = "{91814EB1-B5F0-11D2-80B9-00104B1F6CEA}"	iKernel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AF57A6F1-4101-11D3-88F6-00C04F72F303}	IKernel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1F9922A2-F026-11D2-8822-00C04F72F303}\ProxyStubClsid32	IKernel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{251753FA-FB3B-11D2-8842-00C04F72F303}	IKernel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AA7E2086-CB55-11D2-8094-00104B1F9838}	IKernel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{682C25C5-D7D9-11D2-80C5-00104B1F6CEA}\1.0\0	IKernel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2583251F-0A04-11D3-886B-00C04F72F303}\TypeLib\ = "{91814EB1-B5F0-11D2-80B9-00104B1F6CEA}"	IKernel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3EE77D8B-40C1-4A2A-9B77-421907F02058}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	IKernel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{22D84EC7-E201-4432-B3ED-A9DCA3604594}\ProgID\ = "Setup.LogServices.1"	IKernel.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2988	EXCEL.EXE

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeBackupPrivilege	2748	vssvc.exe
Token: SeRestorePrivilege	2748	vssvc.exe
Token: SeAuditPrivilege	2748	vssvc.exe
Token: SeRestorePrivilege	792	DrvInst.exe
Token: SeRestorePrivilege	792	DrvInst.exe
Token: SeRestorePrivilege	792	DrvInst.exe
Token: SeRestorePrivilege	792	DrvInst.exe
Token: SeRestorePrivilege	792	DrvInst.exe
Token: SeRestorePrivilege	792	DrvInst.exe
Token: SeRestorePrivilege	792	DrvInst.exe
Token: SeLoadDriverPrivilege	792	DrvInst.exe
Token: SeLoadDriverPrivilege	792	DrvInst.exe
Token: SeLoadDriverPrivilege	792	DrvInst.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2988	EXCEL.EXE

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 3064	2840	710b936106397a34d7f1000e74f032687067b21893d76ccfd3ea4bf5d9111d91N.exe	30
PID 2840 wrote to memory of 3064	2840	710b936106397a34d7f1000e74f032687067b21893d76ccfd3ea4bf5d9111d91N.exe	30
PID 2840 wrote to memory of 3064	2840	710b936106397a34d7f1000e74f032687067b21893d76ccfd3ea4bf5d9111d91N.exe	30
PID 2840 wrote to memory of 3064	2840	710b936106397a34d7f1000e74f032687067b21893d76ccfd3ea4bf5d9111d91N.exe	30
PID 2840 wrote to memory of 3064	2840	710b936106397a34d7f1000e74f032687067b21893d76ccfd3ea4bf5d9111d91N.exe	30
PID 2840 wrote to memory of 3064	2840	710b936106397a34d7f1000e74f032687067b21893d76ccfd3ea4bf5d9111d91N.exe	30
PID 2840 wrote to memory of 3064	2840	710b936106397a34d7f1000e74f032687067b21893d76ccfd3ea4bf5d9111d91N.exe	30
PID 2840 wrote to memory of 2084	2840	710b936106397a34d7f1000e74f032687067b21893d76ccfd3ea4bf5d9111d91N.exe	32
PID 2840 wrote to memory of 2084	2840	710b936106397a34d7f1000e74f032687067b21893d76ccfd3ea4bf5d9111d91N.exe	32
PID 2840 wrote to memory of 2084	2840	710b936106397a34d7f1000e74f032687067b21893d76ccfd3ea4bf5d9111d91N.exe	32
PID 2840 wrote to memory of 2084	2840	710b936106397a34d7f1000e74f032687067b21893d76ccfd3ea4bf5d9111d91N.exe	32
PID 3064 wrote to memory of 1672	3064	._cache_710b936106397a34d7f1000e74f032687067b21893d76ccfd3ea4bf5d9111d91N.exe	31
PID 3064 wrote to memory of 1672	3064	._cache_710b936106397a34d7f1000e74f032687067b21893d76ccfd3ea4bf5d9111d91N.exe	31
PID 3064 wrote to memory of 1672	3064	._cache_710b936106397a34d7f1000e74f032687067b21893d76ccfd3ea4bf5d9111d91N.exe	31
PID 3064 wrote to memory of 1672	3064	._cache_710b936106397a34d7f1000e74f032687067b21893d76ccfd3ea4bf5d9111d91N.exe	31
PID 3064 wrote to memory of 1672	3064	._cache_710b936106397a34d7f1000e74f032687067b21893d76ccfd3ea4bf5d9111d91N.exe	31
PID 3064 wrote to memory of 1672	3064	._cache_710b936106397a34d7f1000e74f032687067b21893d76ccfd3ea4bf5d9111d91N.exe	31
PID 3064 wrote to memory of 1672	3064	._cache_710b936106397a34d7f1000e74f032687067b21893d76ccfd3ea4bf5d9111d91N.exe	31
PID 1672 wrote to memory of 2972	1672	Setup.exe	33
PID 1672 wrote to memory of 2972	1672	Setup.exe	33
PID 1672 wrote to memory of 2972	1672	Setup.exe	33
PID 1672 wrote to memory of 2972	1672	Setup.exe	33
PID 1672 wrote to memory of 2972	1672	Setup.exe	33
PID 1672 wrote to memory of 2972	1672	Setup.exe	33
PID 1672 wrote to memory of 2972	1672	Setup.exe	33
PID 2084 wrote to memory of 2316	2084	Synaptics.exe	34
PID 2084 wrote to memory of 2316	2084	Synaptics.exe	34
PID 2084 wrote to memory of 2316	2084	Synaptics.exe	34
PID 2084 wrote to memory of 2316	2084	Synaptics.exe	34
PID 2084 wrote to memory of 2316	2084	Synaptics.exe	34
PID 2084 wrote to memory of 2316	2084	Synaptics.exe	34
PID 2084 wrote to memory of 2316	2084	Synaptics.exe	34
PID 2316 wrote to memory of 2324	2316	._cache_Synaptics.exe	35
PID 2316 wrote to memory of 2324	2316	._cache_Synaptics.exe	35
PID 2316 wrote to memory of 2324	2316	._cache_Synaptics.exe	35
PID 2316 wrote to memory of 2324	2316	._cache_Synaptics.exe	35
PID 2316 wrote to memory of 2324	2316	._cache_Synaptics.exe	35
PID 2316 wrote to memory of 2324	2316	._cache_Synaptics.exe	35
PID 2316 wrote to memory of 2324	2316	._cache_Synaptics.exe	35
PID 2324 wrote to memory of 844	2324	Setup.exe	36
PID 2324 wrote to memory of 844	2324	Setup.exe	36
PID 2324 wrote to memory of 844	2324	Setup.exe	36
PID 2324 wrote to memory of 844	2324	Setup.exe	36
PID 2324 wrote to memory of 844	2324	Setup.exe	36
PID 2324 wrote to memory of 844	2324	Setup.exe	36
PID 2324 wrote to memory of 844	2324	Setup.exe	36
PID 1352 wrote to memory of 2900	1352	IKernel.exe	39
PID 1352 wrote to memory of 2900	1352	IKernel.exe	39
PID 1352 wrote to memory of 2900	1352	IKernel.exe	39
PID 1352 wrote to memory of 2900	1352	IKernel.exe	39
PID 1352 wrote to memory of 2900	1352	IKernel.exe	39
PID 1352 wrote to memory of 2900	1352	IKernel.exe	39
PID 1352 wrote to memory of 2900	1352	IKernel.exe	39
PID 1516 wrote to memory of 2672	1516	IKernel.exe	40
PID 1516 wrote to memory of 2672	1516	IKernel.exe	40
PID 1516 wrote to memory of 2672	1516	IKernel.exe	40
PID 1516 wrote to memory of 2672	1516	IKernel.exe	40
PID 1516 wrote to memory of 2672	1516	IKernel.exe	40
PID 1516 wrote to memory of 2672	1516	IKernel.exe	40
PID 1516 wrote to memory of 2672	1516	IKernel.exe	40

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\710b936106397a34d7f1000e74f032687067b21893d76ccfd3ea4bf5d9111d91N.exe
"C:\Users\Admin\AppData\Local\Temp\710b936106397a34d7f1000e74f032687067b21893d76ccfd3ea4bf5d9111d91N.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Users\Admin\AppData\Local\Temp\._cache_710b936106397a34d7f1000e74f032687067b21893d76ccfd3ea4bf5d9111d91N.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_710b936106397a34d7f1000e74f032687067b21893d76ccfd3ea4bf5d9111d91N.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3064
- - C:\Users\Admin\AppData\Local\Temp\pft6931.tmp\Disk1\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\pft6931.tmp\Disk1\Setup.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1672
  - - C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
      "C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe" -RegServer
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:2972
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2316
  - - C:\Users\Admin\AppData\Local\Temp\pft6DF1.tmp\Disk1\Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\pft6DF1.tmp\Disk1\Setup.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2324
    - - C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
        
        "C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe" -RegServer
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:844

C:\PROGRA~2\COMMON~1\INSTAL~1\Engine\6\INTEL3~1\IKernel.exe
C:\PROGRA~2\COMMON~1\INSTAL~1\Engine\6\INTEL3~1\IKernel.exe -Embedding
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\iKernel.exe
  "C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\iKernel.exe" /REGSERVER
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2672

C:\PROGRA~2\COMMON~1\INSTAL~1\Engine\6\INTEL3~1\IKernel.exe
C:\PROGRA~2\COMMON~1\INSTAL~1\Engine\6\INTEL3~1\IKernel.exe -Embedding
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\iKernel.exe
  "C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\iKernel.exe" /REGSERVER
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:2900

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2748

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "000000000000058C" "00000000000005D8"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:792

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~2\COMMON~1\INSTAL~1\Engine\6\INTEL3~1\corecomp.ini

Filesize
27KB

MD5
62d5f9827d867eb3e4ab9e6b338348a1

SHA1
828e72f9c845b1c0865badaef40d63fb36447293

SHA256
5214789c08ee573e904990dcd29e9e03aaf5cf12e86fae368005fd8f4e371bd5

SHA512
b38bb74dc2e528c2a58a7d14a07bd1ecaaf55168b53afc8f4718f3bf5d6f8c8b922b98551a355ebb1009f23cff02fd8596413468993a43756c4de7dfed573732

Download Submit
C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe

Filesize
600KB

MD5
b3fd01873bd5fd163ab465779271c58f

SHA1
e1ff9981a09ab025d69ac891bfc931a776294d4d

SHA256
985eb55ecb750da812876b8569d5f1999a30a24bcc54f9bab4d3fc44dfedb931

SHA512
6674ab1d65da9892b7dd2fd37f300e087f58239262d44505b53379c676fd16da5443d2292aeaae01d3e6c40960b12f9cac651418c827d2a33c29a6cdf874be43

Download Submit
C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\iuser.dll

Filesize
172KB

MD5
377765fd4de3912c0f814ee9f182feda

SHA1
a0ab6a28f4ba057d5eae5c223420eb599cd4d3b1

SHA256
8efcbd8752d8bbfd7ee559502d1aa28134c9bf391bf7fc5ce6fdfd4473599afb

SHA512
31befb11715f78043b7684287b4086ce003cb66f97c6eff8c2b438eae29045d8856172c6b898be9f08c139edc4647c2bce000da497aed208b7a5a69d4d90c710

Download Submit
C:\Program Files (x86)\Common Files\InstallShield\IScript\iscript.dll

Filesize
220KB

MD5
b2f7e6dc7e4aae3147fbfc74a2ddb365

SHA1
716301112706e93f85977d79f0e8f18f17fb32a7

SHA256
4f77a9018b6b0d41151366e9acab3397416d114fc895703deb82b20f40116ad1

SHA512
e6ae396bd9b4f069b5fafe135c0f83718cc236d1cf9007db7305bd5442c86483c0f1e0fad9cd6d547e8715278e23e6fafa973c63ebbe998a31a2153dbbbe7f83

Download Submit
C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\ctor.dll

Filesize
76KB

MD5
003a6c011aac993bcde8c860988ce49b

SHA1
6d39d650dfa5ded45c4e0cb17b986893061104a7

SHA256
590be865ddf8c8d0431d8f92aa3948cc3c1685fd0649d607776b81cd1e267d0a

SHA512
032aba4403eb45646aa1413fdc6c5d08baab4d0306d20b4209e70c84e47f6b72e68457bbc4331a5f1a5fa44aa776a89eb9fd29d0d956fa2fe11364c26ab09ee7

Download Submit
C:\ProgramData\Synaptics\Synaptics.exe

Filesize
2.4MB

MD5
bfe942ca711739d291ad987cc724a3a0

SHA1
317df04b21c29b20c45c4a007ca33cf3d6357392

SHA256
710b936106397a34d7f1000e74f032687067b21893d76ccfd3ea4bf5d9111d91

SHA512
836bd519511e760a8496787f02dfe26aeb3b45c1603cbbaa2c7adcb5dccb7fc794a87033634f8870fe686e864b6fca42bc920ebc934e78f0f4c7b7d4c10d84e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\pft6931.tmp\Disk1\IKernel.ex_

Filesize
338KB

MD5
93b63f516482715a784bbec3a0bf5f3a

SHA1
2478feca446576c33e96e708256d4c6c33e3fa68

SHA256
fbf95719b956b548b947436e29feb18bb884e01f75ae31b05c030ebd76605249

SHA512
2c8f29dda748e21231ab8c30c7a57735104b786120bb392eb1c20a320f2dddde392d136fd0c70853bb9af851bbe47df2955d8f9d5973b64870ac90bd12d2dd70

Download Submit
C:\Users\Admin\AppData\Local\Temp\pft6931.tmp\Disk1\setup.ini

Filesize
172B

MD5
f538540e2cfc9a49e1d1a19d7db8234f

SHA1
4ccc89fe6709a2b58d675e70e1150af32a399d4d

SHA256
2f6f2a479b5a083238d960bb24c5f9f9bd551777e9f66205defeeac6db51eb81

SHA512
d469cba1840803096590d7d44c998459623fc1176f10e14884ac62abc2daa18924c2b174c432bbfdda571c10affe84c6cd54668cce58d8f927e5a31225d88044

Download Submit
C:\Users\Admin\AppData\Local\Temp\pft6931.tmp\pftw1.pkg

Filesize
1.3MB

MD5
fc1dc50af3c04a4504005db443b047be

SHA1
df5b171c45b10d3ca7c9a30285f6bb3b5b9f8ea5

SHA256
96a8733706b182b10c60c509c0cca9e1da329385b78a7fe5bbe1655168c966f7

SHA512
f418e0d9fcd7935fd43f9928d86d16266ae896ddd72cc5e3a8235bc4ee365253b6fe4bfec31c217414b60a72a9ef1b4e790c4bbd78d29678a01304be23a090cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\pft6DF1.tmp\Disk1\data1.cab

Filesize
586KB

MD5
7a6a7bed57891197746b6f32344c75f5

SHA1
83a0d2d72052f86cc6fce776490189317684764e

SHA256
52e8bfd8231b9fc5fa91541a7b73e9a378bff912d73f260f9697395e13934fb3

SHA512
6396266d4f8e1b986d0f3d6814999caa38832116e84a752ee29a853d7753d162e1586970cc87f138820a2a3644899864f1cd1835be6d9a759842087f20b0a8b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\pft6DF1.tmp\Disk1\data1.hdr

Filesize
14KB

MD5
b2caa6c179bd67968e7828e9005a07f7

SHA1
6dc8d77254cb32b73047ca6310e2bb7c3953bdd7

SHA256
d2f967c808f13b3d64d99f2109a735dd759a5814f8a1fa72aa1751035904499b

SHA512
07a7c517e379ab5821867fadaa5e2c75245745d2c8b029849de0b468a9f5a0f3777ea02e2999f3d8ccc7ae969d020efba3e800ba01e30fb584de153c77f44a0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\pft6DF1.tmp\Disk1\data2.cab

Filesize
380KB

MD5
3f665a0e2eb71ca283522916c3519dd6

SHA1
c0bfef9824b40c1e29adc0c81f8c15d1d0ec984b

SHA256
1c479ea42ad6188db660d39726c7a8b7072ad6ae4805475c96ec6dc39ec92655

SHA512
7ce361dc93f9e852e4df2158a8cab2436a5ffdd0f936dbcbb869cafe43b3ce54a042737ef84a1fddaca4c40bf1dc870eaf72144733cd6049886e710356a6b7a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\pft6DF1.tmp\Disk1\layout.bin

Filesize
417B

MD5
879bd0a51200b47312d8c4b78f740858

SHA1
acdaec259f2b4587dadf0d7d0f1b90442224c017

SHA256
b2c060f31e0db36f18874ec85c55f1e0966c1dbaf2a132398d0f8bfa7a0a84a8

SHA512
6df263d03f5796b522425514eacebf7110f6e73ae4cbd004c7757e6ce1e1e755ae79071366ed64f153b77556a4a239fab4222edfd7bf6e9061989a2e1247f1e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\pft6DF1.tmp\Disk1\setup.inx

Filesize
134KB

MD5
65c7eed62975bee4c118e332110daabf

SHA1
89dbf17bdb0992026d6a9b98c39cdc7c30351d73

SHA256
1f5689560acf38d2a08eb546bedb8854337fd5961a44e28cc937db57c70c28e5

SHA512
09cc634b42c9bdd21323d69d387fc5b67862fc2e2e83d7a37051d2aeb08b7b6fc17ae2cc15b5217e0af3f729e210731ed6733ce5fd1123057fcfd2ad32156640

Download Submit
C:\Users\Admin\AppData\Local\Temp\plf68E1.tmp

Filesize
5KB

MD5
9efcc61a0baa38a6d7c67a05a97c7b87

SHA1
72b713a72ef7e972dfd5be5f79da8e9aacedb296

SHA256
7ccb3a50ca08c66a220e4da614cbaba1d05157359edd174223c788b86d929edf

SHA512
ac57100b76826af9f7650417dd765c23b522e31a1f3b44bfe9e70ed520bf6c6eb1978118a8147c99487b05a7a4c4afc964f457b79f921ff8236e4d60561b1238

Download Submit
C:\Users\Admin\AppData\Local\Temp\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\isrt7224.rra

Filesize
324KB

MD5
61c056d2df7ab769d6fd801869b828a9

SHA1
4213d0395692fa4181483ffb04eef4bda22cceee

SHA256
148d8f53bba9a8d5558b192fb4919a5b0d9cb7fd9f8e481660f8667de4e89b66

SHA512
a2da2558c44e80973badc2e5f283cec254a12dfbcc66c352c8f394e03b1e50f98551303eab6f7995ac4afd5a503bd29b690d778b0526233efc781695ed9e9172

Download Submit
C:\Users\Admin\AppData\Local\Temp\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\value.shl

Filesize
1KB

MD5
0c620d9cfc847b371fc8977640acc456

SHA1
a32b945b0b00893df823d4d3f84ba600984ec938

SHA256
b90db587b775b5bcdd23bd03cae1cea5919ec4e63cdd5754de7b8e4d1b2c4918

SHA512
6ce79d61f663708ebf5b2de5d450fde5d8b36d5a1854116219e60b69593a9aa05a8434c3ce754feb0ab6d05ff79d3a72d106a264eea1142044c297a323d89c6e

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_710b936106397a34d7f1000e74f032687067b21893d76ccfd3ea4bf5d9111d91N.exe

Filesize
1.6MB

MD5
06c21d83808efc7c0348753acff24e1e

SHA1
a5fcbd6893610e89ed924f4d27d740ad6f462a2a

SHA256
c503d2caad26da47dc01712b5fbad62980f7150facf0511e21d452ac64d13b6e

SHA512
a939d05a45282233b41c98ac992b74542df2a4146155e2bdc86f3a934be67b92d8fd336d7265e54ec477691a94697d303643597f1d4a636207f1b80d798abc96

Download Submit
\Users\Admin\AppData\Local\Temp\pft6931.tmp\Disk1\Setup.exe

Filesize
164KB

MD5
fb6674a519505cc93e28cf600bbc23a3

SHA1
d5dbd3dabc4872710d5bdabfb3829f976efe92c6

SHA256
fe95a9fc8b2cdb5add76fbd326b1a11801eaa43c7d908f20cbdf413fd4d8dfde

SHA512
fd4e93d545a704bbc197bcbfd1731c24fffff7aa05db11ed4ad9bcac458253b8fb368d13e48df3d3d322044f4d4cc9e134c24cc7bee4079110f591623e988912

Download Submit
memory/1352-271-0x0000000000580000-0x0000000000593000-memory.dmp

Filesize
76KB

Download
memory/1352-272-0x0000000003460000-0x0000000003498000-memory.dmp

Filesize
224KB

Download
memory/1352-279-0x0000000002650000-0x000000000267C000-memory.dmp

Filesize
176KB

Download
memory/1352-275-0x00000000034A0000-0x00000000034F3000-memory.dmp

Filesize
332KB

Download
memory/2084-282-0x0000000000400000-0x0000000000662000-memory.dmp

Filesize
2.4MB

Download
memory/2084-356-0x0000000000400000-0x0000000000662000-memory.dmp

Filesize
2.4MB

Download
memory/2084-317-0x0000000000400000-0x0000000000662000-memory.dmp

Filesize
2.4MB

Download
memory/2084-312-0x0000000000400000-0x0000000000662000-memory.dmp

Filesize
2.4MB

Download
memory/2316-138-0x0000000000850000-0x00000000008A9000-memory.dmp

Filesize
356KB

Download
memory/2316-316-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2316-129-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2840-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2840-92-0x0000000000400000-0x0000000000662000-memory.dmp

Filesize
2.4MB

Download
memory/2840-5-0x00000000041E0000-0x0000000004239000-memory.dmp

Filesize
356KB

Download
memory/2988-283-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/3064-311-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3064-39-0x00000000002D0000-0x0000000000329000-memory.dmp

Filesize
356KB

Download
memory/3064-38-0x00000000002D0000-0x0000000000329000-memory.dmp

Filesize
356KB

Download
memory/3064-13-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads