Analysis
-
max time kernel
120s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 11:24
Static task
static1
Behavioral task
behavioral1
Sample
b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe
Resource
win7-20240903-en
General
-
Target
b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe
-
Size
3.2MB
-
MD5
07c86dd4f62846c7916a480b4141b540
-
SHA1
bae9b29b94a2380eeb7e28892d0610968f52dae8
-
SHA256
b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67
-
SHA512
79a38bfa48e59222fb38695c169f762bbd4f49ce2b93cb82303d78d871fefba61ef1d3d9b1c82f30f6dd208cc34878925f12ed798d1f17da41ad29cd7a71e487
-
SSDEEP
98304:H3h6d68gwIteZNiiPwVpc3h6d68gwIteZNiiPwVp:HR668aaEL4R668aaEL
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Remcos family
-
Xred family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepid process 2768 powershell.exe 2516 powershell.exe 4828 powershell.exe 3024 powershell.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exeb2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exeSynaptics.exeSynaptics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation Synaptics.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation Synaptics.exe -
Executes dropped EXE 4 IoCs
Processes:
._cache_b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exeSynaptics.exeSynaptics.exe._cache_Synaptics.exepid process 624 ._cache_b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe 4948 Synaptics.exe 2200 Synaptics.exe 2616 ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exeSynaptics.exedescription pid process target process PID 5104 set thread context of 1592 5104 b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe PID 4948 set thread context of 2200 4948 Synaptics.exe Synaptics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
powershell.exeschtasks.exeSynaptics.exe._cache_Synaptics.exeb2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe._cache_b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exepowershell.exeschtasks.exeSynaptics.exeb2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exepowershell.exepowershell.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Modifies registry class 2 IoCs
Processes:
b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exeSynaptics.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2200 schtasks.exe 1656 schtasks.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 2356 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exepowershell.exepowershell.exeSynaptics.exepowershell.exepowershell.exepid process 5104 b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe 5104 b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe 5104 b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe 5104 b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe 2768 powershell.exe 2516 powershell.exe 5104 b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe 5104 b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe 2516 powershell.exe 2768 powershell.exe 4948 Synaptics.exe 4948 Synaptics.exe 4948 Synaptics.exe 4948 Synaptics.exe 4828 powershell.exe 3024 powershell.exe 4948 Synaptics.exe 3024 powershell.exe 4828 powershell.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exepowershell.exepowershell.exeSynaptics.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 5104 b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe Token: SeDebugPrivilege 2768 powershell.exe Token: SeDebugPrivilege 2516 powershell.exe Token: SeDebugPrivilege 4948 Synaptics.exe Token: SeDebugPrivilege 3024 powershell.exe Token: SeDebugPrivilege 4828 powershell.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
Processes:
._cache_b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exeEXCEL.EXEpid process 624 ._cache_b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe 2356 EXCEL.EXE 2356 EXCEL.EXE 2356 EXCEL.EXE 2356 EXCEL.EXE 2356 EXCEL.EXE 2356 EXCEL.EXE 2356 EXCEL.EXE 2356 EXCEL.EXE -
Suspicious use of WriteProcessMemory 49 IoCs
Processes:
b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exeb2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exeSynaptics.exeSynaptics.exedescription pid process target process PID 5104 wrote to memory of 2768 5104 b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe powershell.exe PID 5104 wrote to memory of 2768 5104 b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe powershell.exe PID 5104 wrote to memory of 2768 5104 b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe powershell.exe PID 5104 wrote to memory of 2516 5104 b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe powershell.exe PID 5104 wrote to memory of 2516 5104 b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe powershell.exe PID 5104 wrote to memory of 2516 5104 b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe powershell.exe PID 5104 wrote to memory of 2200 5104 b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe schtasks.exe PID 5104 wrote to memory of 2200 5104 b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe schtasks.exe PID 5104 wrote to memory of 2200 5104 b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe schtasks.exe PID 5104 wrote to memory of 1592 5104 b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe PID 5104 wrote to memory of 1592 5104 b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe PID 5104 wrote to memory of 1592 5104 b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe PID 5104 wrote to memory of 1592 5104 b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe PID 5104 wrote to memory of 1592 5104 b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe PID 5104 wrote to memory of 1592 5104 b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe PID 5104 wrote to memory of 1592 5104 b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe PID 5104 wrote to memory of 1592 5104 b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe PID 5104 wrote to memory of 1592 5104 b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe PID 5104 wrote to memory of 1592 5104 b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe PID 5104 wrote to memory of 1592 5104 b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe PID 1592 wrote to memory of 624 1592 b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe ._cache_b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe PID 1592 wrote to memory of 624 1592 b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe ._cache_b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe PID 1592 wrote to memory of 624 1592 b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe ._cache_b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe PID 1592 wrote to memory of 4948 1592 b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe Synaptics.exe PID 1592 wrote to memory of 4948 1592 b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe Synaptics.exe PID 1592 wrote to memory of 4948 1592 b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe Synaptics.exe PID 4948 wrote to memory of 4828 4948 Synaptics.exe powershell.exe PID 4948 wrote to memory of 4828 4948 Synaptics.exe powershell.exe PID 4948 wrote to memory of 4828 4948 Synaptics.exe powershell.exe PID 4948 wrote to memory of 3024 4948 Synaptics.exe powershell.exe PID 4948 wrote to memory of 3024 4948 Synaptics.exe powershell.exe PID 4948 wrote to memory of 3024 4948 Synaptics.exe powershell.exe PID 4948 wrote to memory of 1656 4948 Synaptics.exe schtasks.exe PID 4948 wrote to memory of 1656 4948 Synaptics.exe schtasks.exe PID 4948 wrote to memory of 1656 4948 Synaptics.exe schtasks.exe PID 4948 wrote to memory of 2200 4948 Synaptics.exe Synaptics.exe PID 4948 wrote to memory of 2200 4948 Synaptics.exe Synaptics.exe PID 4948 wrote to memory of 2200 4948 Synaptics.exe Synaptics.exe PID 4948 wrote to memory of 2200 4948 Synaptics.exe Synaptics.exe PID 4948 wrote to memory of 2200 4948 Synaptics.exe Synaptics.exe PID 4948 wrote to memory of 2200 4948 Synaptics.exe Synaptics.exe PID 4948 wrote to memory of 2200 4948 Synaptics.exe Synaptics.exe PID 4948 wrote to memory of 2200 4948 Synaptics.exe Synaptics.exe PID 4948 wrote to memory of 2200 4948 Synaptics.exe Synaptics.exe PID 4948 wrote to memory of 2200 4948 Synaptics.exe Synaptics.exe PID 4948 wrote to memory of 2200 4948 Synaptics.exe Synaptics.exe PID 2200 wrote to memory of 2616 2200 Synaptics.exe ._cache_Synaptics.exe PID 2200 wrote to memory of 2616 2200 Synaptics.exe ._cache_Synaptics.exe PID 2200 wrote to memory of 2616 2200 Synaptics.exe ._cache_Synaptics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe"C:\Users\Admin\AppData\Local\Temp\b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2768
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\BLznCuyzwk.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2516
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BLznCuyzwk" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEC54.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2200
-
-
C:\Users\Admin\AppData\Local\Temp\b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe"C:\Users\Admin\AppData\Local\Temp\b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\._cache_b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe"C:\Users\Admin\AppData\Local\Temp\._cache_b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:624
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\Synaptics\Synaptics.exe"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4828
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\BLznCuyzwk.exe"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3024
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BLznCuyzwk" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4997.tmp"4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1656
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2616
-
-
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2356
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD507c86dd4f62846c7916a480b4141b540
SHA1bae9b29b94a2380eeb7e28892d0610968f52dae8
SHA256b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67
SHA51279a38bfa48e59222fb38695c169f762bbd4f49ce2b93cb82303d78d871fefba61ef1d3d9b1c82f30f6dd208cc34878925f12ed798d1f17da41ad29cd7a71e487
-
Filesize
144B
MD5f48458a48bcad3f68f53d4ed4d12194c
SHA141a0efec3bf8d6bc388e285c58770dc2e4689696
SHA256f200f0665935677d6cd505e181f2d98d9b8ac59ef585753785d9b2845e984afa
SHA512335ae5b51fc57576aed870f8f0609fdf10e6b78f2e94685ba826a8730c413af4208d131f143608fb1010579772068409e6d2b94a88630bc9ccf1d2338a6b14ef
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
18KB
MD59319c30f0ea4d849212baa310cd1848b
SHA15f58989116b8fc558b0a9e6efd41b3516b13decd
SHA25633e8692226a449f6d2d39bb223500e4cf9c465507b5763d320063e0db5915c6d
SHA5128fbdb25cbb67062f9116053aa6ea11024e072bfab8cca5e1a757ca0a64e662aa02ba72d5ebfebfe5c4fa3cd36607885ee1406b24d39f477da62d0537a117e097
-
Filesize
18KB
MD5e52f2fefbc48efe933b8903ecca12f81
SHA1d83d5aab62097050d406b4083877a9f25237b697
SHA256577b9ac45f73ea561514b8d694efbdb648401e379bd77edaff9ef3a02f105bfb
SHA5120193f0a7054b581f1671dba4bd09958384a811f6fc1d98b164262b31526893a768ce19e9ecde4f373ccf8e24c586e8834a5f17b0f8a15da3927501564d1eebb9
-
C:\Users\Admin\AppData\Local\Temp\._cache_b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe
Filesize483KB
MD5f3b57ccad1c0a308635e17aa591e4038
SHA1ca67ad3c74523b844fc23563f7b288f0389fd645
SHA2565ad6b9a917f35be0a1d66c771069c2143ad765737eedd85436acbc0f95a4c0e7
SHA5125ed754a1b254e8a4b03e0445ac0081c94aaf179c2974827ce4ff10b7deb765d819243b2084212d7c91be9ddc07bf94f55e35f85564781b4124b61647a2f0977a
-
Filesize
21KB
MD5bc22982eab4b6a3e1e8361ee1bb676b4
SHA1c47638e9ecc3147cc9ee1dfff2ca951bce42be29
SHA25614d9d9a60e544737efadf30cb685b668eccc235cb501e7ecc069b84f3d8b3f4a
SHA512430d35a05b78ccdc51f6cdc2a526ab539afe052b98671eeebd684a17249934131df7458e9f5ff60db615debe24f675bd3be934ecd8b49cf56a6fa39264c32cf0
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD5065cc2a6af37de19c189a7c5cad3720a
SHA110fbf9b0e5c6c2be66cec64ec3e39aed738c671c
SHA2567cde8467b4f11d818ad1b70ba6a16b1ff30126d037523857facdb47faf1c6d67
SHA51253fd994c1a195e12d9a3bdf6b77196e1de0d3993d6e0f0b93afaf571f6f26dfa6dbcd956d4245fcd9b32551a4d03a31201a4596bfc352b6ff4b3debce0690bb0