Analysis
-
max time kernel
112s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 10:33
Behavioral task
behavioral1
Sample
3612583e276a5665ac5ea7113a96bb0d5df98ae86aa6ae969f836c889776d80d.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
3612583e276a5665ac5ea7113a96bb0d5df98ae86aa6ae969f836c889776d80d.exe
Resource
win10v2004-20241007-en
General
-
Target
3612583e276a5665ac5ea7113a96bb0d5df98ae86aa6ae969f836c889776d80d.exe
-
Size
771KB
-
MD5
2fa089ca87ac89f69b1bb79c60d17e21
-
SHA1
91b4543c4b83475f3059e935172adc1e5874fe7b
-
SHA256
3612583e276a5665ac5ea7113a96bb0d5df98ae86aa6ae969f836c889776d80d
-
SHA512
388494a345338e766547ef85212a0c368740bf5c940ecc96b997692d541abca1ff24f0cb271d377288400c54a6897f5a402b4fc60c73046038fc483e84ad00a4
-
SSDEEP
12288:GMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9f1KE+VIFJp:GnsJ39LyjbJkQFMhmC+6GD99KE+VIFD
Malware Config
Extracted
xred
xred.mooo.com
-
email
xredline1@gmail.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 3612583e276a5665ac5ea7113a96bb0d5df98ae86aa6ae969f836c889776d80d.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation Synaptics.exe -
Executes dropped EXE 3 IoCs
pid Process 648 ._cache_3612583e276a5665ac5ea7113a96bb0d5df98ae86aa6ae969f836c889776d80d.exe 1280 Synaptics.exe 2084 ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 3612583e276a5665ac5ea7113a96bb0d5df98ae86aa6ae969f836c889776d80d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3612583e276a5665ac5ea7113a96bb0d5df98ae86aa6ae969f836c889776d80d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 3612583e276a5665ac5ea7113a96bb0d5df98ae86aa6ae969f836c889776d80d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4784 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 4784 EXCEL.EXE 4784 EXCEL.EXE 4784 EXCEL.EXE 4784 EXCEL.EXE 4784 EXCEL.EXE 4784 EXCEL.EXE 4784 EXCEL.EXE 4784 EXCEL.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2180 wrote to memory of 648 2180 3612583e276a5665ac5ea7113a96bb0d5df98ae86aa6ae969f836c889776d80d.exe 82 PID 2180 wrote to memory of 648 2180 3612583e276a5665ac5ea7113a96bb0d5df98ae86aa6ae969f836c889776d80d.exe 82 PID 2180 wrote to memory of 648 2180 3612583e276a5665ac5ea7113a96bb0d5df98ae86aa6ae969f836c889776d80d.exe 82 PID 2180 wrote to memory of 1280 2180 3612583e276a5665ac5ea7113a96bb0d5df98ae86aa6ae969f836c889776d80d.exe 83 PID 2180 wrote to memory of 1280 2180 3612583e276a5665ac5ea7113a96bb0d5df98ae86aa6ae969f836c889776d80d.exe 83 PID 2180 wrote to memory of 1280 2180 3612583e276a5665ac5ea7113a96bb0d5df98ae86aa6ae969f836c889776d80d.exe 83 PID 1280 wrote to memory of 2084 1280 Synaptics.exe 84 PID 1280 wrote to memory of 2084 1280 Synaptics.exe 84 PID 1280 wrote to memory of 2084 1280 Synaptics.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\3612583e276a5665ac5ea7113a96bb0d5df98ae86aa6ae969f836c889776d80d.exe"C:\Users\Admin\AppData\Local\Temp\3612583e276a5665ac5ea7113a96bb0d5df98ae86aa6ae969f836c889776d80d.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\._cache_3612583e276a5665ac5ea7113a96bb0d5df98ae86aa6ae969f836c889776d80d.exe"C:\Users\Admin\AppData\Local\Temp\._cache_3612583e276a5665ac5ea7113a96bb0d5df98ae86aa6ae969f836c889776d80d.exe"2⤵
- Executes dropped EXE
PID:648
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
PID:2084
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4784
Network
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
Remote address:8.8.8.8:53Request228.249.119.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request76.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request240.76.109.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestxred.mooo.comIN AResponse
-
Remote address:8.8.8.8:53Requestfreedns.afraid.orgIN AResponsefreedns.afraid.orgIN A69.42.215.252
-
GEThttp://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978Synaptics.exeRemote address:69.42.215.252:80RequestGET /api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978 HTTP/1.1
User-Agent: MyApp
Host: freedns.afraid.org
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Date: Fri, 22 Nov 2024 10:33:58 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Cache: MISS
-
Remote address:8.8.8.8:53Request252.215.42.69.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request252.215.42.69.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request58.55.71.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request91.65.42.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request212.20.149.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request18.31.95.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request17.14.97.104.in-addr.arpaIN PTRResponse17.14.97.104.in-addr.arpaIN PTRa104-97-14-17deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestdocs.google.comIN AResponsedocs.google.comIN A142.250.187.206
-
Remote address:142.250.187.206:443RequestGET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1
User-Agent: Synaptics.exe
Host: docs.google.com
Cache-Control: no-cache
ResponseHTTP/1.1 303 See Other
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Fri, 22 Nov 2024 10:34:57 GMT
Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
Strict-Transport-Security: max-age=31536000
Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
Content-Security-Policy: script-src 'report-sample' 'nonce-V1qKN2gJRgkCq_5dvIIjXw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
Cross-Origin-Opener-Policy: same-origin
Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
Server: ESF
Content-Length: 0
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
-
Remote address:142.250.187.206:443RequestGET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1
User-Agent: Synaptics.exe
Host: docs.google.com
Cache-Control: no-cache
Cookie: NID=519=PglaWvIs51Yhn_3RhEhdfbGshYiZMDO9LQQJlU9RMIM78JkVpioFu30gKrZI1cu5h5R99tIDTewQ__RqLlgrvbfQfa8oL6hYK2bFj3fZt5HAqcQxwM_U08f6JgfUQXB-QCvXrdeBGhXaCDw0EnVPgFXTX-Cd6iAT7XrrPsNq6Fi9CcA
ResponseHTTP/1.1 303 See Other
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Fri, 22 Nov 2024 10:34:58 GMT
Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
Strict-Transport-Security: max-age=31536000
Content-Security-Policy: script-src 'report-sample' 'nonce-54lJ2ujPKPpyFyBLjYMd-g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
Cross-Origin-Opener-Policy: same-origin
Server: ESF
Content-Length: 0
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
-
Remote address:142.250.187.206:443RequestGET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1
User-Agent: Synaptics.exe
Host: docs.google.com
Cache-Control: no-cache
Cookie: NID=519=PglaWvIs51Yhn_3RhEhdfbGshYiZMDO9LQQJlU9RMIM78JkVpioFu30gKrZI1cu5h5R99tIDTewQ__RqLlgrvbfQfa8oL6hYK2bFj3fZt5HAqcQxwM_U08f6JgfUQXB-QCvXrdeBGhXaCDw0EnVPgFXTX-Cd6iAT7XrrPsNq6Fi9CcA
ResponseHTTP/1.1 303 See Other
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Fri, 22 Nov 2024 10:34:58 GMT
Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
Strict-Transport-Security: max-age=31536000
Content-Security-Policy: script-src 'report-sample' 'nonce-uupNfHQMoGEXO1EHxYIMLw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
Cross-Origin-Opener-Policy: same-origin
Server: ESF
Content-Length: 0
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
-
Remote address:8.8.8.8:53Requestc.pki.googIN AResponsec.pki.googIN CNAMEpki-goog.l.google.compki-goog.l.google.comIN A142.250.200.3
-
Remote address:142.250.200.3:80RequestGET /r/r1.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/10.0
Host: c.pki.goog
ResponseHTTP/1.1 200 OK
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
Content-Length: 854
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Fri, 22 Nov 2024 10:00:53 GMT
Expires: Fri, 22 Nov 2024 10:50:53 GMT
Cache-Control: public, max-age=3000
Age: 2044
Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT
Content-Type: application/pkix-crl
Vary: Accept-Encoding
-
Remote address:8.8.8.8:53Requesto.pki.googIN AResponseo.pki.googIN CNAMEpki-goog.l.google.compki-goog.l.google.comIN A142.250.200.3
-
GEThttp://o.pki.goog/wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEEGoFYJ0C3qQCbRh5xcgwPQ%3DSynaptics.exeRemote address:142.250.200.3:80RequestGET /wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEEGoFYJ0C3qQCbRh5xcgwPQ%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/10.0
Host: o.pki.goog
ResponseHTTP/1.1 200 OK
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Date: Fri, 22 Nov 2024 09:56:16 GMT
Cache-Control: public, max-age=14400
Content-Type: application/ocsp-response
Age: 2321
-
GEThttp://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDHA1yyGqTiRQmAB36tPEBHSynaptics.exeRemote address:142.250.200.3:80RequestGET /wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDHA1yyGqTiRQmAB36tPEBH HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/10.0
Host: o.pki.goog
ResponseHTTP/1.1 200 OK
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Date: Fri, 22 Nov 2024 10:08:39 GMT
Cache-Control: public, max-age=14400
Content-Type: application/ocsp-response
Age: 1578
-
Remote address:8.8.8.8:53Requestdrive.usercontent.google.comIN AResponsedrive.usercontent.google.comIN A142.250.179.225
-
GEThttps://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadSynaptics.exeRemote address:142.250.179.225:443RequestGET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1
User-Agent: Synaptics.exe
Cache-Control: no-cache
Host: drive.usercontent.google.com
Connection: Keep-Alive
ResponseHTTP/1.1 404 Not Found
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Fri, 22 Nov 2024 10:34:58 GMT
P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."
Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
Content-Security-Policy: script-src 'report-sample' 'nonce-BR17bEmszcmQWtdm4BD6hA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
Cross-Origin-Opener-Policy: same-origin
Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
Content-Length: 1652
X-GUploader-UploadID: AFiumC7EIaxg4C07FEoZXgueFHcmqthoXkqlBzse8zKvaUp4Cc54QC_kcbYdM_uIiBNc8S9Ikr0GniKRSw
Server: UploadServer
Set-Cookie: NID=519=PglaWvIs51Yhn_3RhEhdfbGshYiZMDO9LQQJlU9RMIM78JkVpioFu30gKrZI1cu5h5R99tIDTewQ__RqLlgrvbfQfa8oL6hYK2bFj3fZt5HAqcQxwM_U08f6JgfUQXB-QCvXrdeBGhXaCDw0EnVPgFXTX-Cd6iAT7XrrPsNq6Fi9CcA; expires=Sat, 24-May-2025 10:34:57 GMT; path=/; domain=.google.com; HttpOnly
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Content-Security-Policy: sandbox allow-scripts
-
GEThttps://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadSynaptics.exeRemote address:142.250.179.225:443RequestGET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1
User-Agent: Synaptics.exe
Cache-Control: no-cache
Host: drive.usercontent.google.com
Connection: Keep-Alive
Cookie: NID=519=PglaWvIs51Yhn_3RhEhdfbGshYiZMDO9LQQJlU9RMIM78JkVpioFu30gKrZI1cu5h5R99tIDTewQ__RqLlgrvbfQfa8oL6hYK2bFj3fZt5HAqcQxwM_U08f6JgfUQXB-QCvXrdeBGhXaCDw0EnVPgFXTX-Cd6iAT7XrrPsNq6Fi9CcA
ResponseHTTP/1.1 404 Not Found
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Fri, 22 Nov 2024 10:34:58 GMT
Content-Security-Policy: script-src 'report-sample' 'nonce-uCKkAIzR85pGG01W9eaaAw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
Cross-Origin-Opener-Policy: same-origin
Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
Content-Length: 1652
X-GUploader-UploadID: AFiumC4SHWFy4WtJfnRhUnQ8faQQ40EK_qkOe5x8MKlgn6oMCcIPS-au4IkJ2bBZ8A164e6hEQ
Server: UploadServer
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Content-Security-Policy: sandbox allow-scripts
-
GEThttps://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadSynaptics.exeRemote address:142.250.179.225:443RequestGET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1
User-Agent: Synaptics.exe
Cache-Control: no-cache
Host: drive.usercontent.google.com
Connection: Keep-Alive
Cookie: NID=519=PglaWvIs51Yhn_3RhEhdfbGshYiZMDO9LQQJlU9RMIM78JkVpioFu30gKrZI1cu5h5R99tIDTewQ__RqLlgrvbfQfa8oL6hYK2bFj3fZt5HAqcQxwM_U08f6JgfUQXB-QCvXrdeBGhXaCDw0EnVPgFXTX-Cd6iAT7XrrPsNq6Fi9CcA
ResponseHTTP/1.1 404 Not Found
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Fri, 22 Nov 2024 10:34:58 GMT
Cross-Origin-Opener-Policy: same-origin
Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
Content-Security-Policy: script-src 'report-sample' 'nonce-7kq4-9ByE9XjeMACxaFDdw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
Content-Length: 1652
X-GUploader-UploadID: AFiumC5IvdL_mIxuwIEHCCrZyZLmLmiQa6t_7uhAaRNAwubA_ss7qfiTZieQyulZglAAWTFffg
Server: UploadServer
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Content-Security-Policy: sandbox allow-scripts
-
Remote address:8.8.8.8:53Request206.187.250.142.in-addr.arpaIN PTRResponse206.187.250.142.in-addr.arpaIN PTRlhr25s33-in-f141e100net
-
Remote address:8.8.8.8:53Request3.200.250.142.in-addr.arpaIN PTRResponse3.200.250.142.in-addr.arpaIN PTRlhr48s29-in-f31e100net
-
Remote address:8.8.8.8:53Request225.179.250.142.in-addr.arpaIN PTRResponse225.179.250.142.in-addr.arpaIN PTRlhr25s31-in-f11e100net
-
Remote address:8.8.8.8:53Request13.227.111.52.in-addr.arpaIN PTRResponse
-
69.42.215.252:80http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978httpSynaptics.exe476 B 495 B 7 6
HTTP Request
GET http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978HTTP Response
200 -
142.250.187.206:443https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtls, httpSynaptics.exe1.9kB 11.3kB 16 14
HTTP Request
GET https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadHTTP Response
303HTTP Request
GET https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadHTTP Response
303HTTP Request
GET https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadHTTP Response
303 -
303 B 1.7kB 4 4
HTTP Request
GET http://c.pki.goog/r/r1.crlHTTP Response
200 -
142.250.200.3:80http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDHA1yyGqTiRQmAB36tPEBHhttpSynaptics.exe738 B 1.6kB 6 4
HTTP Request
GET http://o.pki.goog/wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEEGoFYJ0C3qQCbRh5xcgwPQ%3DHTTP Response
200HTTP Request
GET http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDHA1yyGqTiRQmAB36tPEBHHTTP Response
200 -
142.250.179.225:443https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtls, httpSynaptics.exe2.4kB 14.7kB 23 21
HTTP Request
GET https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadHTTP Response
404HTTP Request
GET https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadHTTP Response
404HTTP Request
GET https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadHTTP Response
404
-
66 B 90 B 1 1
DNS Request
8.8.8.8.in-addr.arpa
-
73 B 159 B 1 1
DNS Request
228.249.119.40.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
76.32.126.40.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
72 B 146 B 1 1
DNS Request
240.76.109.52.in-addr.arpa
-
59 B 118 B 1 1
DNS Request
xred.mooo.com
-
64 B 80 B 1 1
DNS Request
freedns.afraid.org
DNS Response
69.42.215.252
-
114 B 2
-
144 B 144 B 2 2
DNS Request
252.215.42.69.in-addr.arpa
DNS Request
252.215.42.69.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
58.55.71.13.in-addr.arpa
-
70 B 156 B 1 1
DNS Request
91.65.42.20.in-addr.arpa
-
72 B 146 B 1 1
DNS Request
212.20.149.52.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
18.31.95.13.in-addr.arpa
-
71 B 135 B 1 1
DNS Request
17.14.97.104.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.210.232.199.in-addr.arpa
-
61 B 77 B 1 1
DNS Request
docs.google.com
DNS Response
142.250.187.206
-
56 B 107 B 1 1
DNS Request
c.pki.goog
DNS Response
142.250.200.3
-
56 B 107 B 1 1
DNS Request
o.pki.goog
DNS Response
142.250.200.3
-
74 B 90 B 1 1
DNS Request
drive.usercontent.google.com
DNS Response
142.250.179.225
-
74 B 113 B 1 1
DNS Request
206.187.250.142.in-addr.arpa
-
72 B 110 B 1 1
DNS Request
3.200.250.142.in-addr.arpa
-
74 B 112 B 1 1
DNS Request
225.179.250.142.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
13.227.111.52.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
771KB
MD52fa089ca87ac89f69b1bb79c60d17e21
SHA191b4543c4b83475f3059e935172adc1e5874fe7b
SHA2563612583e276a5665ac5ea7113a96bb0d5df98ae86aa6ae969f836c889776d80d
SHA512388494a345338e766547ef85212a0c368740bf5c940ecc96b997692d541abca1ff24f0cb271d377288400c54a6897f5a402b4fc60c73046038fc483e84ad00a4
-
C:\Users\Admin\AppData\Local\Temp\._cache_3612583e276a5665ac5ea7113a96bb0d5df98ae86aa6ae969f836c889776d80d.exe
Filesize18KB
MD5ac68a7a10fe2ae79b9e27f3dc123d247
SHA1c3f65c7410d9e4a6f70f3c690e30889a05d27990
SHA256bc3a11b50c10126abfab710b8f143c82ff8010b49e16e73e6b2db0b86739bb79
SHA5126620fcf7c5645873c8de78dca4de7f82ca6826fcd4c1de0453ac0f192560cd48683b62f2dd1315c9e98e69c21019f4a6a9242862096656e9669780200d54e087
-
Filesize
20KB
MD533785fafc92458472aa18b77741b36d8
SHA1fd4bc118dd3c12b0c98965c98194100f7904a7ee
SHA2565fc71a84a8e320bdd812d9414ebeb6bf95590dc74fdd8f0ef3aa39d569d28a3d
SHA5127c45e9a03abefe499d40b1e827dfc48871ecd2e2570e027e9f08684f5821cfe953d4cdff238554cbb731720d6665d88893d94f993ea99a5cf0c5b491d4f3e2f6
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04