neshta | 8e12be66a20bed006ce45cbf83658bd56441ed070ce3605814d6d8a38b84f462

Analysis

max time kernel
291s
max time network
247s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-11-2024 20:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

winrar-x64-700.exe
Size

4.6MB
MD5

82d05c70559d829137a17d62d637a061
SHA1

4ad6926261e5b6fdd1b3128e005cd5a67e0b5180
SHA256

8e12be66a20bed006ce45cbf83658bd56441ed070ce3605814d6d8a38b84f462
SHA512

25df17152f2b0f84cc2941a83b4ca91e03e98e3e2c6a9531f5b0c95c521f63ece6228fadf14e21a865d3aeaad3b5531c69f5e0ed9a5e5a2e8ef549c2919c974d
SSDEEP

98304:DBrmtk2a4BTBUWaWOBfKnlSXdgRgopW/r+N5op154iXEBdbwUoy60518ymXM2mGu:QxamnqdgyoE+noL54u2wUoylrVml69

Score

10^/10

neshta xred backdoor discovery persistence spyware stealer

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Detect Neshta payload 31 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x0008000000015d75-2.dat	family_neshta
behavioral1/files/0x0008000000015dc3-14.dat	family_neshta
behavioral1/files/0x0008000000015d7f-40.dat	family_neshta
behavioral1/files/0x0001000000010314-45.dat	family_neshta
behavioral1/memory/528-62-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/2820-57-0x0000000000400000-0x0000000000891000-memory.dmp	family_neshta
behavioral1/files/0x0001000000010312-44.dat	family_neshta
behavioral1/files/0x0013000000010321-43.dat	family_neshta
behavioral1/files/0x005e000000010323-42.dat	family_neshta
behavioral1/memory/2052-79-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/2964-89-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/files/0x000100000000f775-95.dat	family_neshta
behavioral1/files/0x0001000000010b94-111.dat	family_neshta
behavioral1/files/0x0001000000010f30-119.dat	family_neshta
behavioral1/files/0x0001000000011a18-125.dat	family_neshta
behavioral1/files/0x0001000000011b57-130.dat	family_neshta
behavioral1/files/0x0003000000012141-152.dat	family_neshta
behavioral1/files/0x0003000000005ab6-223.dat	family_neshta
behavioral1/files/0x000b000000005986-230.dat	family_neshta
behavioral1/files/0x000d0000000056d4-228.dat	family_neshta
behavioral1/files/0x000400000000571f-227.dat	family_neshta
behavioral1/files/0x000300000000e6f5-226.dat	family_neshta
behavioral1/files/0x00050000000055e4-221.dat	family_neshta
behavioral1/memory/2728-339-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/1976-340-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/864-341-0x0000000000400000-0x0000000000891000-memory.dmp	family_neshta
behavioral1/memory/2728-363-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/1976-364-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/864-365-0x0000000000400000-0x0000000000891000-memory.dmp	family_neshta
behavioral1/memory/864-366-0x0000000000400000-0x0000000000891000-memory.dmp	family_neshta
behavioral1/memory/864-400-0x0000000000400000-0x0000000000891000-memory.dmp	family_neshta

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Neshta family
neshta
Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Executes dropped EXE 9 IoCs

Processes:

winrar-x64-700.exe._cache_winrar-x64-700.exesvchost.comSynaptics.exe_CACHE~1.EXE._cache_Synaptics.exesvchost.com_CACHE~2.EXE

pid	Process
2820	winrar-x64-700.exe
1976	._cache_winrar-x64-700.exe
528	svchost.com
864	Synaptics.exe
2332	_CACHE~1.EXE
2052	._cache_Synaptics.exe
2964	svchost.com
2408	_CACHE~2.EXE
1192

Loads dropped DLL 19 IoCs

Processes:

winrar-x64-700.exewinrar-x64-700.exesvchost.comSynaptics.exesvchost.com._cache_winrar-x64-700.exe

pid	Process
2728	winrar-x64-700.exe
2728	winrar-x64-700.exe
2820	winrar-x64-700.exe
2820	winrar-x64-700.exe
2820	winrar-x64-700.exe
2820	winrar-x64-700.exe
2820	winrar-x64-700.exe
528	svchost.com
864	Synaptics.exe
864	Synaptics.exe
864	Synaptics.exe
2964	svchost.com
2728	winrar-x64-700.exe
1976	._cache_winrar-x64-700.exe
1192
1976	._cache_winrar-x64-700.exe
2728	winrar-x64-700.exe
2728	winrar-x64-700.exe
1976	._cache_winrar-x64-700.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

Processes:

winrar-x64-700.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	winrar-x64-700.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

winrar-x64-700.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	winrar-x64-700.exe

Drops file in Program Files directory 64 IoCs

Processes:

._cache_winrar-x64-700.exewinrar-x64-700.exe_CACHE~1.EXE_CACHE~2.EXE

description	ioc	Process
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	._cache_winrar-x64-700.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	winrar-x64-700.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	winrar-x64-700.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE	winrar-x64-700.exe
File created	C:\Program Files\WinRAR\RarFiles.lst	_CACHE~1.EXE
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	winrar-x64-700.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmprph.exe	winrar-x64-700.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	_CACHE~1.EXE
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe	winrar-x64-700.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	._cache_winrar-x64-700.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	._cache_winrar-x64-700.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.lst	_CACHE~1.EXE
File created	C:\Program Files\WinRAR\RarExtInstaller.exe	_CACHE~1.EXE
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	._cache_winrar-x64-700.exe
File created	C:\Program Files\WinRAR\Uninstall.lst	_CACHE~1.EXE
File created	C:\Program Files\WinRAR\WinRAR.chm	_CACHE~2.EXE
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	winrar-x64-700.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe	._cache_winrar-x64-700.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	winrar-x64-700.exe
File opened for modification	C:\Program Files\WinRAR	_CACHE~2.EXE
File opened for modification	C:\Program Files\WinRAR\ReadMe.txt	_CACHE~1.EXE
File opened for modification	C:\Program Files\WinRAR\Order.htm	_CACHE~2.EXE
File opened for modification	C:\Program Files\WinRAR\WinCon.SFX	_CACHE~2.EXE
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe	._cache_winrar-x64-700.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	._cache_winrar-x64-700.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE	winrar-x64-700.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	winrar-x64-700.exe
File opened for modification	C:\Program Files\WinRAR\Descript.ion	_CACHE~1.EXE
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE	winrar-x64-700.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	._cache_winrar-x64-700.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	winrar-x64-700.exe
File created	C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_259423890	_CACHE~1.EXE
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	._cache_winrar-x64-700.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.exe	_CACHE~1.EXE
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	._cache_winrar-x64-700.exe
File opened for modification	C:\Program Files\WinRAR\Rar.exe	_CACHE~2.EXE
File opened for modification	C:\Program Files\WinRAR\RarExt32.dll	_CACHE~1.EXE
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE	._cache_winrar-x64-700.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	._cache_winrar-x64-700.exe
File created	C:\Program Files\WinRAR\ReadMe.txt	_CACHE~1.EXE
File created	C:\Program Files\WinRAR\WinRAR.exe	_CACHE~1.EXE
File opened for modification	C:\Program Files\WinRAR\Resources.pri	_CACHE~1.EXE
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE	._cache_winrar-x64-700.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\misc.exe	winrar-x64-700.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE	winrar-x64-700.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe	winrar-x64-700.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE	._cache_winrar-x64-700.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\WMPDMC.exe	winrar-x64-700.exe
File created	C:\Program Files\WinRAR\Uninstall.exe	_CACHE~1.EXE
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	winrar-x64-700.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE	winrar-x64-700.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmprph.exe	._cache_winrar-x64-700.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	winrar-x64-700.exe
File opened for modification	C:\Program Files\WinRAR\Descript.ion	_CACHE~2.EXE
File created	C:\Program Files\WinRAR\Order.htm	_CACHE~1.EXE
File opened for modification	C:\Program Files\WinRAR\WinRAR.exe	_CACHE~2.EXE
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE	winrar-x64-700.exe
File opened for modification	C:\Program Files\WinRAR\WhatsNew.txt	_CACHE~2.EXE
File opened for modification	C:\Program Files\WinRAR\RarFiles.lst	_CACHE~2.EXE
File opened for modification	C:\Program Files\WinRAR\7zxa.dll	_CACHE~1.EXE
File created	C:\Program Files\WinRAR\Default.SFX	_CACHE~2.EXE
File created	C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_259423890	_CACHE~2.EXE
File created	C:\Program Files\WinRAR\RarExt.dll	_CACHE~2.EXE
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe	winrar-x64-700.exe

Drops file in Windows directory 8 IoCs

Processes:

winrar-x64-700.exe._cache_winrar-x64-700.exesvchost.com._cache_Synaptics.exesvchost.com

description	ioc	Process
File opened for modification	C:\Windows\svchost.com	winrar-x64-700.exe
File opened for modification	C:\Windows\svchost.com	._cache_winrar-x64-700.exe
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com
File opened for modification	C:\Windows\directx.sys	._cache_Synaptics.exe
File opened for modification	C:\Windows\svchost.com	._cache_Synaptics.exe
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

winrar-x64-700.exe._cache_winrar-x64-700.exeSynaptics.exesvchost.com._cache_Synaptics.exesvchost.comEXCEL.EXEwinrar-x64-700.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winrar-x64-700.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_winrar-x64-700.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winrar-x64-700.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

_CACHE~1.EXE_CACHE~2.EXE

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	_CACHE~1.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	_CACHE~2.EXE

Modifies registry class 1 IoCs

Processes:

winrar-x64-700.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	winrar-x64-700.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid	Process
2964	EXCEL.EXE

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

_CACHE~1.EXE_CACHE~2.EXEEXCEL.EXE

pid	Process
2332	_CACHE~1.EXE
2332	_CACHE~1.EXE
2408	_CACHE~2.EXE
2408	_CACHE~2.EXE
2964	EXCEL.EXE

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

winrar-x64-700.exewinrar-x64-700.exe._cache_winrar-x64-700.exesvchost.comSynaptics.exe._cache_Synaptics.exesvchost.com

description	pid	Process	procid_target
PID 2728 wrote to memory of 2820	2728	winrar-x64-700.exe	30
PID 2728 wrote to memory of 2820	2728	winrar-x64-700.exe	30
PID 2728 wrote to memory of 2820	2728	winrar-x64-700.exe	30
PID 2728 wrote to memory of 2820	2728	winrar-x64-700.exe	30
PID 2820 wrote to memory of 1976	2820	winrar-x64-700.exe	31
PID 2820 wrote to memory of 1976	2820	winrar-x64-700.exe	31
PID 2820 wrote to memory of 1976	2820	winrar-x64-700.exe	31
PID 2820 wrote to memory of 1976	2820	winrar-x64-700.exe	31
PID 1976 wrote to memory of 528	1976	._cache_winrar-x64-700.exe	32
PID 1976 wrote to memory of 528	1976	._cache_winrar-x64-700.exe	32
PID 1976 wrote to memory of 528	1976	._cache_winrar-x64-700.exe	32
PID 1976 wrote to memory of 528	1976	._cache_winrar-x64-700.exe	32
PID 2820 wrote to memory of 864	2820	winrar-x64-700.exe	33
PID 2820 wrote to memory of 864	2820	winrar-x64-700.exe	33
PID 2820 wrote to memory of 864	2820	winrar-x64-700.exe	33
PID 2820 wrote to memory of 864	2820	winrar-x64-700.exe	33
PID 528 wrote to memory of 2332	528	svchost.com	34
PID 528 wrote to memory of 2332	528	svchost.com	34
PID 528 wrote to memory of 2332	528	svchost.com	34
PID 528 wrote to memory of 2332	528	svchost.com	34
PID 864 wrote to memory of 2052	864	Synaptics.exe	35
PID 864 wrote to memory of 2052	864	Synaptics.exe	35
PID 864 wrote to memory of 2052	864	Synaptics.exe	35
PID 864 wrote to memory of 2052	864	Synaptics.exe	35
PID 2052 wrote to memory of 2964	2052	._cache_Synaptics.exe	36
PID 2052 wrote to memory of 2964	2052	._cache_Synaptics.exe	36
PID 2052 wrote to memory of 2964	2052	._cache_Synaptics.exe	36
PID 2052 wrote to memory of 2964	2052	._cache_Synaptics.exe	36
PID 2964 wrote to memory of 2408	2964	svchost.com	37
PID 2964 wrote to memory of 2408	2964	svchost.com	37
PID 2964 wrote to memory of 2408	2964	svchost.com	37
PID 2964 wrote to memory of 2408	2964	svchost.com	37

C:\Users\Admin\AppData\Local\Temp\winrar-x64-700.exe
"C:\Users\Admin\AppData\Local\Temp\winrar-x64-700.exe"
1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Users\Admin\AppData\Local\Temp\3582-490\winrar-x64-700.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\winrar-x64-700.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Users\Admin\AppData\Local\Temp\._cache_winrar-x64-700.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_winrar-x64-700.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1976
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:528
    - - C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2332
- - C:\ProgramData\Synaptics\Synaptics.exe
    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:864
  - - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2052
    - - C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2964
      - C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2408

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE

Filesize
859KB

MD5
02ee6a3424782531461fb2f10713d3c1

SHA1
b581a2c365d93ebb629e8363fd9f69afc673123f

SHA256
ead58c483cb20bcd57464f8a4929079539d634f469b213054bf737d227c026dc

SHA512
6c9272cb1b6bde3ee887e1463ab30ea76568cb1a285d11393337b78c4ad1c3b7e6ce47646a92ab6d70bff4b02ab9d699b84af9437b720e52dcd35579fe2693ec

Download Submit
C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe

Filesize
547KB

MD5
cf6c595d3e5e9667667af096762fd9c4

SHA1
9bb44da8d7f6457099cb56e4f7d1026963dce7ce

SHA256
593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d

SHA512
ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80

Download Submit
C:\MSOCache\ALLUSE~1\{9A861~1\ose.exe

Filesize
186KB

MD5
58b58875a50a0d8b5e7be7d6ac685164

SHA1
1e0b89c1b2585c76e758e9141b846ed4477b0662

SHA256
2a0aa0763fdef9c38c5dd4d50703f0c7e27f4903c139804ec75e55f8388139ae

SHA512
d67214077162a105d01b11a8e207fab08b45b08fbfba0615a2ea146e1dd99eea35e4f02958a1754d3192292c00caf777f186f0a362e4b8b0da51fabbdb76375b

Download Submit
C:\MSOCache\ALLUSE~1\{9A861~1\setup.exe

Filesize
1.1MB

MD5
566ed4f62fdc96f175afedd811fa0370

SHA1
d4b47adc40e0d5a9391d3f6f2942d1889dd2a451

SHA256
e17cd94c08fc0e001a49f43a0801cea4625fb9aee211b6dfebebec446c21f460

SHA512
cdf8f508d396a1a0d2e0fc25f2ae46398b25039a0dafa0919737cc44e3e926ebae4c3aa26f1a3441511430f1a36241f8e61c515a5d9bd98ad4740d4d0f7b8db7

Download Submit
C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe

Filesize
422KB

MD5
8bb6d1d1f40099aa6a629fbb036a8cb3

SHA1
8b388ca335032e3b04b0a7d1351ce25c61b4ba52

SHA256
a89419fc4ba9bf5f7ac6b348428ee57403fec3b5964f9e49b6eea49d779f4071

SHA512
3015b210c79a4c61143fa56d62caabc5aebfe8d95b20753aa7f52ed0bcd4faf801134e5ee614c3714d95da666e0548f88db4d3df96d6d7e0e124c5a5add23a81

Download Submit
C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE

Filesize
588KB

MD5
c275134502929608464f4400dd4971ab

SHA1
107b91a5249425c83700d64aff4b57652039699d

SHA256
ca5263f340cc735ba279532bbd9fe505fcf05d81b52614e05aff31c14d18f831

SHA512
913cadcb575519f924333c80588781caecd6cd5f176dc22ac7391f154ffc3b3f7302d010433c22c96fde3591cac79df3252798e52abf5706517493ef87a7ef7d

Download Submit
C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE

Filesize
503KB

MD5
3f67da7e800cd5b4af2283a9d74d2808

SHA1
f9288d052b20a9f4527e5a0f87f4249f5e4440f7

SHA256
31c10320edb2de22f37faee36611558db83b78a9c3c71ea0ed13c8dce25bf711

SHA512
6a40f4629ddae102d8737e921328e95717274cea16eb5f23bff6a6627c6047d7f27e7f6eb5cb52f53152e326e53b6ee44d9a9ee8eca7534a2f62fa457ac3d4e3

Download Submit
C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe

Filesize
1.1MB

MD5
426b3bfe5f493cf140a67b3799ac9948

SHA1
37f106a31f72dbe07e21dbffefe2b77b9b7f59e2

SHA256
2311547cc9f985e3c316fb2f90784d9f44733044d50b48f4e1e54d3c50e969c1

SHA512
f9ad8fa69a071faec825e0ddbdcae93c0667c900a6859c5ce14ccbe1e76cd6085e651e8784f07ef2b74e02e2bbec4c8b6bd979c5b298e7641d50f43b5bf0d973

Download Submit
C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe

Filesize
1.2MB

MD5
5b24abc7cf28c120c137737fee803563

SHA1
ea3be34ebd74b939d3fe451e4a088c913e515f5d

SHA256
e067fdd1abf7036c5a076dba33c7a01afc5a0bc8425bbc52d064826e220fe396

SHA512
4adaea09ec179ab1996d07fc05598c1ca86efcdbb21b40eb619504df16fcca1e8f3405a8329a8d4eb527d8b58f177eef93305d1e59c393059f92df245946538a

Download Submit
C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE

Filesize
305KB

MD5
ec73ca9f6105d3c696647afb815e4683

SHA1
08cdf07cb4cfb58c75ac7d28d7d12b604235618f

SHA256
a0f61fff90702092143409945a38041495cc4e43798f835e3947d6c7b7f70b45

SHA512
6dec731a684a5228268f54115eaf40a5c055f4ffc75b70e6ad23be304dcd604abd8c908f97ceabe4362eb2bf80aca166a7066c156f6bbc67db21e40cc9b2f45e

Download Submit
C:\Program Files\WinRAR\Descript.ion

Filesize
1KB

MD5
84846abc52dc17020e4e934d3c94b4e6

SHA1
94562a3e13b3edccf1848ec0743caf0e32ed5e3e

SHA256
3449fd40d054c96285fab92011e732174c7cd000eda67470376f26f0d431f1f2

SHA512
9b8cf7844d346b806e2ff6fe9d165d82fc7b4f764846c0f9b30443672e585f588399cf915df728743e420fc8e58008f0373f7570c8483a2e408567aa1026900e

Download Submit
C:\Program Files\WinRAR\License.txt

Filesize
6KB

MD5
672064cf19db0b083b981cf0be7662b0

SHA1
c200c77558ca77c044a2c2d794c98f8437ffd2b4

SHA256
9fc8aa33ccafa04c1ce4c0a61047b341297d720adab1b77f67b5fe59f43bb59f

SHA512
a016b287b6d1a4320bd5ab5790163f837a28b54d8bcca56a51dc8b6a50374aacb35c0341d42915cd97d3b135dbf1f363087a4631deb69f82811d41db2f78a0a8

Download Submit
C:\Program Files\WinRAR\Order.htm

Filesize
3KB

MD5
5c336de3b3d794322ad9e5915e3a509f

SHA1
5256262a417e9a29fe23e8cca09782c7a3532fc9

SHA256
bce29ef3b95306cb7b304fb8c3039be7157356d9f9d4e7e1c6bfbf02a117f48f

SHA512
7243c9b8eb39fc8aa10ec8b5c290e27d44fa1c245f0478b75ae77964c178d41e9c1f651f987316f1153c1a7176eecebc269ffb0c42ced5bd0b12e5cc1b95da04

Download Submit
C:\Program Files\WinRAR\Rar.exe

Filesize
744KB

MD5
168ee0a1413bd8a97a2411acaa1607c6

SHA1
2a77d60cf21ee993215c1a2cf9bee25ffd5954bd

SHA256
b61f5cd83d9f781e57d17a78ad421e04267dc99bd0a3ebeaa1fc07e271d9e07b

SHA512
43ae8907f329fe15ddb3f0afeea55b52699392acd0997c410778b87a8fa2ae54cfa8065da89fcc8e400a252fb39ea29ba04cc863fc61b33b2d02755001b94af3

Download Submit
C:\Program Files\WinRAR\Rar.txt

Filesize
105KB

MD5
fc13e375f3144a55adfb46f342778447

SHA1
f2e716a60f6371eeba55fbcc90c3b8b7c14eb4a4

SHA256
7511c100daa946175efc18082d1923518bf1bfc8c1a80ea0252af585fbe295b5

SHA512
8ca4a0ecc0d55d29a8ff291afb8cdffbf4a949d0979ffe2e262465db8e8c7dc30837a4ea17c163fea1902ed0bebb5a937eafc179d25f6ce1fc747f6309181e40

Download Submit
C:\Program Files\WinRAR\RarExtInstaller.exe

Filesize
181KB

MD5
7e6c8fabc1d5528211640f702f71d260

SHA1
306d0e56c845e4e25cf6067b678c0b636a3b8c8d

SHA256
7d1240aabc797322bba0e42061202125293ebf82ad338f41b66a4ea6d5c4fa42

SHA512
80effd13bf0f2e43ab272e4241be3615ff8eff3e23f42dd48d7f38d8d3090baf693d17983e68655382be2886c5fb9357a99692223ef0c88ede68a73dac003419

Download Submit
C:\Program Files\WinRAR\RarFiles.lst

Filesize
1KB

MD5
e70e22d45ecb35217d66a4ce30f081fa

SHA1
a5f6c6e1335596d50e89f99267773e30bebe159e

SHA256
9eb1099d7231cd24d8740609d3ac6985139f2334730356df983ab01d7896ad6f

SHA512
638ab88bcf95aa16e2f15036f3de1c5803a30b518b1a283464444a9b2f04b45f7927fb3c4bf666740c8d042c991d872b6d5749bbd9a721a42dde6dbf9f549cd3

Download Submit
C:\Program Files\WinRAR\ReadMe.txt

Filesize
1KB

MD5
00d0a57a6d64ee3de8f4d5529d6c6447

SHA1
56c7a7fefb01aa0a032a8e0f91ea9eff53bee1f3

SHA256
fcd13e1b97af47b8b923ba97ae15e9731c66093609667c3171d5dd24a6f7f2e6

SHA512
a644967d0cd6ef47324b2e8c52698318c658d1b3b37e5f4de5e6897af9ca951b0611ceba5c6d3e087ca9958286e481becf9bbfa1c483cb11ebd2f4be7526f474

Download Submit
C:\Program Files\WinRAR\Uninstall.exe

Filesize
477KB

MD5
0c52b3fb85bd6ec371183a4bfb0ec5ed

SHA1
c756d66045e8b2603c1ad8fb3caf8d01efe48f9c

SHA256
4d24274b446a85edf45270b606b2a9f789d16ab84714e745512051bd192faad4

SHA512
7d3aaf09ee7ee50fe542a17818797ea1b0cce9bf2d337d8bbe5fabeed7331ea774faf1e4e337c2cc2ee0dab6de261ee1f1245cea21afd15eb7298a1298613e70

Download Submit
C:\Program Files\WinRAR\Uninstall.lst

Filesize
793B

MD5
6eeefcb85673c14201d024b6e6ac6258

SHA1
dd3bbad1b014f8d8e9f981ac0deb9f2f343c5cf4

SHA256
b75fdee208d2834ab147dacb51f4e7d70e44457c8b639048fe67b252b8d61f1f

SHA512
d68322f4b861f05876e9b3f349d135b3df115a52b93c52590a1dc240089ab0dcdb256f91fca01fd65dc8e689ee53cbd106337bbda42d402d12b9dca90434671b

Download Submit
C:\Program Files\WinRAR\WhatsNew.txt

Filesize
43KB

MD5
2b9e0d72411ef328313c0c703d76854c

SHA1
6f52c400fb211181985cd28330a173b74af0a685

SHA256
c13db7e2b3fb2430a10abf78efcc2a6fb0ca1dd7d18c9d7b28c09a41238d7157

SHA512
ce71a9a84ac9f4da74bda7653a150a8b950e5da95cd708de266fb33506054aafd12b35ac3d28e0569f3c298967db4a3c5581d184a3d320bed6122bea1e1cc741

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{33D1F~1\VCREDI~1.EXE

Filesize
526KB

MD5
cc5020b193486a88f373bedca78e24c8

SHA1
61744a1675ce10ddd196129b49331d517d7da884

SHA256
e87936bb1f0794b7622f8ce5b88e4b57b2358c4e0d0fd87c5cd9fa03b8429e2a

SHA512
bc2c77a25ad9f25ac19d8216dafc5417513cb57b9984237a5589a0bb684fdac4540695fcfb0df150556823b191014c96b002e4234a779bd064d36166afeb09d2

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{4D8DC~1\VC_RED~1.EXE

Filesize
674KB

MD5
97510a7d9bf0811a6ea89fad85a9f3f3

SHA1
2ac0c49b66a92789be65580a38ae9798237711db

SHA256
c48abbc29405559e68cc9f8fc6d218aa317a9d0023839c7846ca509c1f563fea

SHA512
2a93e2a3bd187fdde160f87ef777ccd1d1c398d547b7c869e6b64469b9418ad04d887cdfe94af7407476377bf2d009f576de3935c025b7aefbab26fbcd8f90fb

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{57A73~1\VC_RED~1.EXE

Filesize
715KB

MD5
06366e48936df8d5556435c9820e9990

SHA1
0e3ed1da26a0c96f549720684e87352f1b58ef45

SHA256
cd47cce50016890899413b2c3609b3b49cb1b65a4dfcaa34ece5a16d8e8f6612

SHA512
bea7342a6703771cb9b11cd164e9972eb981c33dcfe3e628b139f9e45cf1e24ded1c55fcdfa0697bf48772a3359a9ddd29e4bb33c796c94727afd1c4d5589ea3

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{61087~1\VCREDI~1.EXE

Filesize
536KB

MD5
31685b921fcd439185495e2bdc8c5ebf

SHA1
5d171dd1f2fc2ad55bde2e3c16a58abff07ae636

SHA256
4798142637154af13e3ed0e0b508459cf71d2dc1ae2f80f8439d14975617e05c

SHA512
04a414a89e02f9541b0728c82c38f0c64af1e95074f00699a48c82a5e99f4a6488fd7914ff1fa7a5bf383ce85d2dceab7f686d4ee5344ab36e7b9f13ceec9e7f

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{CA675~1\VCREDI~1.EXE

Filesize
525KB

MD5
261b20dc81bdd7def64bc1bcee858a37

SHA1
75965a4be13e839a39685bc818c79cd98c0edb10

SHA256
63927b22c5fc994790c3365460bd421f587138b7074aabe046e379f428ab4298

SHA512
6e76356b663e131d7eabdfee3b2ce80934f7630593d84cdd1566991e02bf38d60337ce2a1c893f7b9c35bdf8cc44b84ae9855b1e13f94d257ed70206a125f330

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{EF6B0~1\VCREDI~1.EXE

Filesize
536KB

MD5
2acb54dd83be1957482f0df591ade3f5

SHA1
c6e9ebe71564c55a7260d1e8f45b11bd125d95cc

SHA256
af7961a615915aa0c59b735254e537004eab00e57466585390bbb0e29a5948a6

SHA512
011a2ca1d42e4bc26db7353ca79a9800cb9c9be271c531ce2afbb230b8487729da02c307f65a52f828459ca1b3aa4326c576bb4364f70b149e8b4f479b06cc1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_winrar-x64-700.exe

Filesize
3.8MB

MD5
e1444ef9fae2c4e96e82fdadb2d55562

SHA1
37e0752741342148132cc052ec94c09c699e4da9

SHA256
ace00d359a579417781ae1b6cb482b8ac2c8acb8617ac0952887fcc43e25b375

SHA512
924394effac8b16650a72422c397d3b827025eb03776fc1d102acc287ad64cab422290871a3e305256e3582e5a778ca33423971c0a407111e48cea5ad2ff54df

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE

Filesize
3.8MB

MD5
48deabfacb5c8e88b81c7165ed4e3b0b

SHA1
de3dab0e9258f9ff3c93ab6738818c6ec399e6a4

SHA256
ff309d1430fc97fccaa9cb82ddf3d23ce9afdf62dcf8c69512de40820df15e24

SHA512
d1d30f6267349bb23334f72376fe3384ac14d202bc8e12c16773231f5f4a3f02b76563f05b11d89d5ef6c05d4acaacc79f72f1d617ee6d1b6eddab2b866426af

Download Submit
C:\Windows\directx.sys

Filesize
57B

MD5
6b3bfceb3942a9508a2148acbee89007

SHA1
3622ac7466cc40f50515eb6fcdc15d1f34ad3be3

SHA256
e0a7bae2a9ac263cff5d725922e40272d8854278d901233a93a5267859c00a3c

SHA512
fa222bfcade636824af32124b45450c92b1abec7a33e6e647a9248eef5371c127d22ccb7cc5a096b4d5d52e2457f3841293a1b34304e8e5523549856ac02f224

Download Submit
C:\Windows\svchost.com

Filesize
40KB

MD5
3ef1c7215091e71cc869d4bae25bd8e6

SHA1
7aea7c89e8ed7b53ec828de7ba17c45fe510a6be

SHA256
b549fa9002ce39ae7df3f2f027372cadc9d19b10c3f220ba323d2b85d5cbe190

SHA512
7a081a78d43de844f957cdb39ffd69caf9fceb6889cab95e52fae9f5814d0ef6bcfa341d2658545bf9556f2fe9574be41086f272d3d255a77f3bc1e67c102a00

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

Filesize
252KB

MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\winrar-x64-700.exe

Filesize
4.5MB

MD5
a477b22c086fe3b66f2e7c28a7e2f3fc

SHA1
fe8cb3c370d7362039a3a7d18b8f1496dffac027

SHA256
ccac32bfa0d9f9042575c405cc8b09a8c0f5ea551e1eee4a60bedb28146bbf9c

SHA512
1e08025b8e427ab35a1e8cee1c71c67bdb14cf9e54f2cb5149fb026514a4ef7038f824f2a935bc11876b85e1525a9d0406c7ababee141cd32e0db6ffccd2ed43

Download Submit
memory/528-62-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/864-400-0x0000000000400000-0x0000000000891000-memory.dmp

Filesize
4.6MB

Download
memory/864-366-0x0000000000400000-0x0000000000891000-memory.dmp

Filesize
4.6MB

Download
memory/864-341-0x0000000000400000-0x0000000000891000-memory.dmp

Filesize
4.6MB

Download
memory/864-365-0x0000000000400000-0x0000000000891000-memory.dmp

Filesize
4.6MB

Download
memory/1976-364-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1976-340-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2052-79-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2728-339-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2728-363-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2820-57-0x0000000000400000-0x0000000000891000-memory.dmp

Filesize
4.6MB

Download
memory/2820-12-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2964-342-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2964-89-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download