Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

9f0af1cf4d...71.exe

windows7-x64

10

9f0af1cf4d...71.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    111s
  • max time network
    117s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/11/2024, 06:10 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9f0af1cf4d104abdef87173ecb3d998003fa6e1bb6bc177efc2aa8621c0a1b71.exe

  • Size

    1.2MB

  • MD5

    a6b0c646c57b62e6f11baa38c5e28ef0

  • SHA1

    e394f063c294ac957cb2a91288b74a399e76de4b

  • SHA256

    9f0af1cf4d104abdef87173ecb3d998003fa6e1bb6bc177efc2aa8621c0a1b71

  • SHA512

    9663202bddf92fb1c81086ad3d57dd1409b15c28d557c94923da2d8a1f367ba55c93023fc30f5f69addd25c8e02d0d39cbdacc2d35a18ba8d8557aba396784f6

  • SSDEEP

    12288:7MSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9APoBhY8QyIE635:7nsJ39LyjbJkQFMhmC+6GD9HY9JBJ

Score
10/10
xredbackdoordiscoverypersistence

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    xredline1@gmail.com

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred
  • Xred family
    xred
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9f0af1cf4d104abdef87173ecb3d998003fa6e1bb6bc177efc2aa8621c0a1b71.exe
    "C:\Users\Admin\AppData\Local\Temp\9f0af1cf4d104abdef87173ecb3d998003fa6e1bb6bc177efc2aa8621c0a1b71.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3336
    • C:\Users\Admin\AppData\Local\Temp\._cache_9f0af1cf4d104abdef87173ecb3d998003fa6e1bb6bc177efc2aa8621c0a1b71.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_9f0af1cf4d104abdef87173ecb3d998003fa6e1bb6bc177efc2aa8621c0a1b71.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1328
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 1048
        3⤵
        • Program crash
        PID:4424
    • C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3496
      • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:396
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 1048
          4⤵
          • Program crash
          PID:3664
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1328 -ip 1328
    1⤵
      PID:3112
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 396 -ip 396
      1⤵
        PID:2892

      Network

      • flag-us
        DNS
        8.8.8.8.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        8.8.8.8.in-addr.arpa
        IN PTR
        Response
        8.8.8.8.in-addr.arpa
        IN PTR
        dnsgoogle
      • flag-us
        DNS
        58.55.71.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        58.55.71.13.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        172.214.232.199.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        172.214.232.199.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        22.160.190.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        22.160.190.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        95.221.229.192.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        95.221.229.192.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        xred.mooo.com
        Synaptics.exe
        Remote address:
        8.8.8.8:53
        Request
        xred.mooo.com
        IN A
        Response
      • flag-us
        DNS
        freedns.afraid.org
        Synaptics.exe
        Remote address:
        8.8.8.8:53
        Request
        freedns.afraid.org
        IN A
        Response
        freedns.afraid.org
        IN A
        69.42.215.252
      • flag-us
        GET
        http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
        Synaptics.exe
        Remote address:
        69.42.215.252:80
        Request
        GET /api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978 HTTP/1.1
        User-Agent: MyApp
        Host: freedns.afraid.org
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Server: nginx
        Date: Mon, 25 Nov 2024 06:10:21 GMT
        Content-Type: text/html; charset=UTF-8
        Transfer-Encoding: chunked
        Connection: keep-alive
        Vary: Accept-Encoding
        X-Cache: MISS
      • flag-us
        DNS
        232.168.11.51.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        232.168.11.51.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        252.215.42.69.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        252.215.42.69.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        252.215.42.69.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        252.215.42.69.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        200.163.202.172.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        200.163.202.172.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        15.164.165.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        15.164.165.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        172.210.232.199.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        172.210.232.199.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        docs.google.com
        Synaptics.exe
        Remote address:
        8.8.8.8:53
        Request
        docs.google.com
        IN A
        Response
        docs.google.com
        IN A
        142.250.187.206
      • flag-gb
        GET
        https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
        Synaptics.exe
        Remote address:
        142.250.187.206:443
        Request
        GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1
        User-Agent: Synaptics.exe
        Host: docs.google.com
        Cache-Control: no-cache
        Response
        HTTP/1.1 303 See Other
        Content-Type: application/binary
        Cache-Control: no-cache, no-store, max-age=0, must-revalidate
        Pragma: no-cache
        Expires: Mon, 01 Jan 1990 00:00:00 GMT
        Date: Mon, 25 Nov 2024 06:11:20 GMT
        Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
        Strict-Transport-Security: max-age=31536000
        Content-Security-Policy: script-src 'report-sample' 'nonce-BilOTUuNkBGqjHhzraUhyw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
        Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
        Cross-Origin-Opener-Policy: same-origin
        Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
        Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        Server: ESF
        Content-Length: 0
        X-XSS-Protection: 0
        X-Frame-Options: SAMEORIGIN
        X-Content-Type-Options: nosniff
        Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
      • flag-gb
        GET
        https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
        Synaptics.exe
        Remote address:
        142.250.187.206:443
        Request
        GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1
        User-Agent: Synaptics.exe
        Host: docs.google.com
        Cache-Control: no-cache
        Cookie: NID=519=Fk1wmIMxfUwmg1YXHUL8yJ9caVqFfaGj-fAVaw1D_Vk8YRieaE914gwUNEQmDN3-uFYxOq5FLquf7GNCLfj5NOfRr7t_H3pk2xxLO_ta_ckuxVGzBESNRLLdE6dg5o3Z0DCnMI10p9eFdmrJG_H5CjxKyUJY_q-DX5i3vXWuQVRw1SnE
        Response
        HTTP/1.1 303 See Other
        Content-Type: application/binary
        Cache-Control: no-cache, no-store, max-age=0, must-revalidate
        Pragma: no-cache
        Expires: Mon, 01 Jan 1990 00:00:00 GMT
        Date: Mon, 25 Nov 2024 06:11:21 GMT
        Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
        Strict-Transport-Security: max-age=31536000
        Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
        Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
        Content-Security-Policy: script-src 'report-sample' 'nonce-ZhYXzpAQqDu9q4LNOQHI7A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
        Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        Cross-Origin-Opener-Policy: same-origin
        Server: ESF
        Content-Length: 0
        X-XSS-Protection: 0
        X-Frame-Options: SAMEORIGIN
        X-Content-Type-Options: nosniff
        Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
      • flag-gb
        GET
        https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
        Synaptics.exe
        Remote address:
        142.250.187.206:443
        Request
        GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1
        User-Agent: Synaptics.exe
        Host: docs.google.com
        Cache-Control: no-cache
        Cookie: NID=519=Fk1wmIMxfUwmg1YXHUL8yJ9caVqFfaGj-fAVaw1D_Vk8YRieaE914gwUNEQmDN3-uFYxOq5FLquf7GNCLfj5NOfRr7t_H3pk2xxLO_ta_ckuxVGzBESNRLLdE6dg5o3Z0DCnMI10p9eFdmrJG_H5CjxKyUJY_q-DX5i3vXWuQVRw1SnE
        Response
        HTTP/1.1 303 See Other
        Content-Type: application/binary
        Cache-Control: no-cache, no-store, max-age=0, must-revalidate
        Pragma: no-cache
        Expires: Mon, 01 Jan 1990 00:00:00 GMT
        Date: Mon, 25 Nov 2024 06:11:21 GMT
        Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
        Strict-Transport-Security: max-age=31536000
        Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
        Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
        Content-Security-Policy: script-src 'report-sample' 'nonce-NO_wiovedsvJSTgSFo3FbA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
        Cross-Origin-Opener-Policy: same-origin
        Server: ESF
        Content-Length: 0
        X-XSS-Protection: 0
        X-Frame-Options: SAMEORIGIN
        X-Content-Type-Options: nosniff
        Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
      • flag-us
        DNS
        c.pki.goog
        Synaptics.exe
        Remote address:
        8.8.8.8:53
        Request
        c.pki.goog
        IN A
        Response
        c.pki.goog
        IN CNAME
        pki-goog.l.google.com
        pki-goog.l.google.com
        IN A
        142.250.200.3
      • flag-us
        DNS
        83.210.23.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        83.210.23.2.in-addr.arpa
        IN PTR
        Response
        83.210.23.2.in-addr.arpa
        IN PTR
        a2-23-210-83deploystaticakamaitechnologiescom
      • flag-us
        DNS
        206.187.250.142.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        206.187.250.142.in-addr.arpa
        IN PTR
        Response
        206.187.250.142.in-addr.arpa
        IN PTR
        lhr25s33-in-f141e100net
      • flag-us
        DNS
        3.200.250.142.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        3.200.250.142.in-addr.arpa
        IN PTR
        Response
        3.200.250.142.in-addr.arpa
        IN PTR
        lhr48s29-in-f31e100net
      • flag-gb
        GET
        http://c.pki.goog/r/r1.crl
        Synaptics.exe
        Remote address:
        142.250.200.3:80
        Request
        GET /r/r1.crl HTTP/1.1
        Connection: Keep-Alive
        Accept: */*
        User-Agent: Microsoft-CryptoAPI/10.0
        Host: c.pki.goog
        Response
        HTTP/1.1 200 OK
        Accept-Ranges: bytes
        Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
        Cross-Origin-Resource-Policy: cross-origin
        Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
        Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
        Content-Length: 854
        X-Content-Type-Options: nosniff
        Server: sffe
        X-XSS-Protection: 0
        Date: Mon, 25 Nov 2024 05:32:04 GMT
        Expires: Mon, 25 Nov 2024 06:22:04 GMT
        Cache-Control: public, max-age=3000
        Age: 2356
        Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT
        Content-Type: application/pkix-crl
        Vary: Accept-Encoding
      • flag-us
        DNS
        o.pki.goog
        Synaptics.exe
        Remote address:
        8.8.8.8:53
        Request
        o.pki.goog
        IN A
        Response
        o.pki.goog
        IN CNAME
        pki-goog.l.google.com
        pki-goog.l.google.com
        IN A
        142.250.200.3
      • flag-gb
        GET
        http://o.pki.goog/wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEEGoFYJ0C3qQCbRh5xcgwPQ%3D
        Synaptics.exe
        Remote address:
        142.250.200.3:80
        Request
        GET /wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEEGoFYJ0C3qQCbRh5xcgwPQ%3D HTTP/1.1
        Connection: Keep-Alive
        Accept: */*
        User-Agent: Microsoft-CryptoAPI/10.0
        Host: o.pki.goog
        Response
        HTTP/1.1 200 OK
        Server: ocsp_responder
        Content-Length: 471
        X-XSS-Protection: 0
        X-Frame-Options: SAMEORIGIN
        Date: Mon, 25 Nov 2024 05:11:49 GMT
        Cache-Control: public, max-age=14400
        Content-Type: application/ocsp-response
        Age: 3571
      • flag-gb
        GET
        http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDHA1yyGqTiRQmAB36tPEBH
        Synaptics.exe
        Remote address:
        142.250.200.3:80
        Request
        GET /wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDHA1yyGqTiRQmAB36tPEBH HTTP/1.1
        Connection: Keep-Alive
        Accept: */*
        User-Agent: Microsoft-CryptoAPI/10.0
        Host: o.pki.goog
        Response
        HTTP/1.1 200 OK
        Server: ocsp_responder
        Content-Length: 472
        X-XSS-Protection: 0
        X-Frame-Options: SAMEORIGIN
        Date: Mon, 25 Nov 2024 05:30:07 GMT
        Cache-Control: public, max-age=14400
        Content-Type: application/ocsp-response
        Age: 2473
      • flag-us
        DNS
        drive.usercontent.google.com
        Synaptics.exe
        Remote address:
        8.8.8.8:53
        Request
        drive.usercontent.google.com
        IN A
        Response
        drive.usercontent.google.com
        IN A
        142.250.179.225
      • flag-gb
        GET
        https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
        Synaptics.exe
        Remote address:
        142.250.179.225:443
        Request
        GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1
        User-Agent: Synaptics.exe
        Cache-Control: no-cache
        Host: drive.usercontent.google.com
        Connection: Keep-Alive
        Response
        HTTP/1.1 404 Not Found
        Content-Type: text/html; charset=utf-8
        Cache-Control: no-cache, no-store, max-age=0, must-revalidate
        Pragma: no-cache
        Expires: Mon, 01 Jan 1990 00:00:00 GMT
        Date: Mon, 25 Nov 2024 06:11:21 GMT
        P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."
        Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
        Content-Security-Policy: script-src 'report-sample' 'nonce-8l_C2xiBJNycOmYEiR0C7Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
        Cross-Origin-Opener-Policy: same-origin
        Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
        Content-Length: 1652
        X-GUploader-UploadID: AFiumC6sgcU4zcMvy9VZKxOV69S-Q589H7wscbSvw4-2Jyzjh7I2ck_L2m-ZZrbIEKGuxc9J2HMq7VCjwA
        Server: UploadServer
        Set-Cookie: NID=519=Fk1wmIMxfUwmg1YXHUL8yJ9caVqFfaGj-fAVaw1D_Vk8YRieaE914gwUNEQmDN3-uFYxOq5FLquf7GNCLfj5NOfRr7t_H3pk2xxLO_ta_ckuxVGzBESNRLLdE6dg5o3Z0DCnMI10p9eFdmrJG_H5CjxKyUJY_q-DX5i3vXWuQVRw1SnE; expires=Tue, 27-May-2025 06:11:21 GMT; path=/; domain=.google.com; HttpOnly
        Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
        Content-Security-Policy: sandbox allow-scripts
      • flag-gb
        GET
        https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
        Synaptics.exe
        Remote address:
        142.250.179.225:443
        Request
        GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1
        User-Agent: Synaptics.exe
        Cache-Control: no-cache
        Host: drive.usercontent.google.com
        Connection: Keep-Alive
        Cookie: NID=519=Fk1wmIMxfUwmg1YXHUL8yJ9caVqFfaGj-fAVaw1D_Vk8YRieaE914gwUNEQmDN3-uFYxOq5FLquf7GNCLfj5NOfRr7t_H3pk2xxLO_ta_ckuxVGzBESNRLLdE6dg5o3Z0DCnMI10p9eFdmrJG_H5CjxKyUJY_q-DX5i3vXWuQVRw1SnE
        Response
        HTTP/1.1 404 Not Found
        Content-Type: text/html; charset=utf-8
        Cache-Control: no-cache, no-store, max-age=0, must-revalidate
        Pragma: no-cache
        Expires: Mon, 01 Jan 1990 00:00:00 GMT
        Date: Mon, 25 Nov 2024 06:11:21 GMT
        Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
        Content-Security-Policy: script-src 'report-sample' 'nonce-u9tl-e3QwoyD0gmV8SvQRA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
        Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
        Cross-Origin-Opener-Policy: same-origin
        Content-Length: 1652
        X-GUploader-UploadID: AFiumC560n3j-NOVmfYqihpSyvfdOCfc1JGAEJgIExjCwr4lG9NBRqtZ4kxNqTjARv14EdIHfTsB41tUDQ
        Server: UploadServer
        Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
        Content-Security-Policy: sandbox allow-scripts
      • flag-gb
        GET
        https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
        Synaptics.exe
        Remote address:
        142.250.179.225:443
        Request
        GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1
        User-Agent: Synaptics.exe
        Cache-Control: no-cache
        Host: drive.usercontent.google.com
        Connection: Keep-Alive
        Cookie: NID=519=Fk1wmIMxfUwmg1YXHUL8yJ9caVqFfaGj-fAVaw1D_Vk8YRieaE914gwUNEQmDN3-uFYxOq5FLquf7GNCLfj5NOfRr7t_H3pk2xxLO_ta_ckuxVGzBESNRLLdE6dg5o3Z0DCnMI10p9eFdmrJG_H5CjxKyUJY_q-DX5i3vXWuQVRw1SnE
        Response
        HTTP/1.1 404 Not Found
        Content-Type: text/html; charset=utf-8
        Cache-Control: no-cache, no-store, max-age=0, must-revalidate
        Pragma: no-cache
        Expires: Mon, 01 Jan 1990 00:00:00 GMT
        Date: Mon, 25 Nov 2024 06:11:21 GMT
        Cross-Origin-Opener-Policy: same-origin
        Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
        Content-Security-Policy: script-src 'report-sample' 'nonce-KvvSOqPf5YE9oOdm3H4TgQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
        Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
        Content-Length: 1652
        X-GUploader-UploadID: AFiumC5Gl4-r-Vqd11hYADr-wR-tqu1X5Q58T7NVgWIPabRfCZKdFhODM5Nx3EMDE0PUdPpeoyLWN51gTQ
        Server: UploadServer
        Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
        Content-Security-Policy: sandbox allow-scripts
      • flag-us
        DNS
        225.179.250.142.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        225.179.250.142.in-addr.arpa
        IN PTR
        Response
        225.179.250.142.in-addr.arpa
        IN PTR
        lhr25s31-in-f11e100net
      • flag-us
        DNS
        22.236.111.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        22.236.111.52.in-addr.arpa
        IN PTR
        Response
      • 69.42.215.252:80
        http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
        http
        Synaptics.exe
        614 B
         415 B
         10
        4

        HTTP Request

        GET http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

        HTTP Response

        200
      • 142.250.187.206:443
        https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
        tls, http
        Synaptics.exe
        1.9kB
         11.3kB
         16
        14

        HTTP Request

        GET https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

        HTTP Response

        303

        HTTP Request

        GET https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

        HTTP Response

        303

        HTTP Request

        GET https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

        HTTP Response

        303
      • 142.250.200.3:80
        http://c.pki.goog/r/r1.crl
        http
        Synaptics.exe
        303 B
         1.7kB
         4
        4

        HTTP Request

        GET http://c.pki.goog/r/r1.crl

        HTTP Response

        200
      • 142.250.200.3:80
        http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDHA1yyGqTiRQmAB36tPEBH
        http
        Synaptics.exe
        738 B
         1.6kB
         6
        4

        HTTP Request

        GET http://o.pki.goog/wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEEGoFYJ0C3qQCbRh5xcgwPQ%3D

        HTTP Response

        200

        HTTP Request

        GET http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDHA1yyGqTiRQmAB36tPEBH

        HTTP Response

        200
      • 142.250.179.225:443
        https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
        tls, http
        Synaptics.exe
        2.4kB
         14.7kB
         23
        21

        HTTP Request

        GET https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

        HTTP Response

        404

        HTTP Request

        GET https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

        HTTP Response

        404

        HTTP Request

        GET https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

        HTTP Response

        404
      • 8.8.8.8:53
        8.8.8.8.in-addr.arpa
        dns
        66 B
         90 B
         1
        1

        DNS Request

        8.8.8.8.in-addr.arpa

      • 8.8.8.8:53
        58.55.71.13.in-addr.arpa
        dns
        70 B
         144 B
         1
        1

        DNS Request

        58.55.71.13.in-addr.arpa

      • 8.8.8.8:53
        172.214.232.199.in-addr.arpa
        dns
        74 B
         128 B
         1
        1

        DNS Request

        172.214.232.199.in-addr.arpa

      • 8.8.8.8:53
        22.160.190.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        22.160.190.20.in-addr.arpa

      • 8.8.8.8:53
        95.221.229.192.in-addr.arpa
        dns
        73 B
         144 B
         1
        1

        DNS Request

        95.221.229.192.in-addr.arpa

      • 8.8.8.8:53
        xred.mooo.com
        dns
        Synaptics.exe
        59 B
         118 B
         1
        1

        DNS Request

        xred.mooo.com

      • 8.8.8.8:53
        freedns.afraid.org
        dns
        Synaptics.exe
        64 B
         80 B
         1
        1

        DNS Request

        freedns.afraid.org

        DNS Response

        69.42.215.252

      • 8.8.8.8:53
        232.168.11.51.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        232.168.11.51.in-addr.arpa

      • 224.0.0.251:5353
        57 B
         1
      • 8.8.8.8:53
        252.215.42.69.in-addr.arpa
        dns
        144 B
         144 B
         2
        2

        DNS Request

        252.215.42.69.in-addr.arpa

        DNS Request

        252.215.42.69.in-addr.arpa

      • 8.8.8.8:53
        200.163.202.172.in-addr.arpa
        dns
        74 B
         160 B
         1
        1

        DNS Request

        200.163.202.172.in-addr.arpa

      • 8.8.8.8:53
        15.164.165.52.in-addr.arpa
        dns
        72 B
         146 B
         1
        1

        DNS Request

        15.164.165.52.in-addr.arpa

      • 8.8.8.8:53
        172.210.232.199.in-addr.arpa
        dns
        74 B
         128 B
         1
        1

        DNS Request

        172.210.232.199.in-addr.arpa

      • 8.8.8.8:53
        docs.google.com
        dns
        Synaptics.exe
        61 B
         77 B
         1
        1

        DNS Request

        docs.google.com

        DNS Response

        142.250.187.206

      • 8.8.8.8:53
        c.pki.goog
        dns
        Synaptics.exe
        56 B
         107 B
         1
        1

        DNS Request

        c.pki.goog

        DNS Response

        142.250.200.3

      • 8.8.8.8:53
        83.210.23.2.in-addr.arpa
        dns
        70 B
         133 B
         1
        1

        DNS Request

        83.210.23.2.in-addr.arpa

      • 8.8.8.8:53
        206.187.250.142.in-addr.arpa
        dns
        74 B
         113 B
         1
        1

        DNS Request

        206.187.250.142.in-addr.arpa

      • 8.8.8.8:53
        3.200.250.142.in-addr.arpa
        dns
        72 B
         110 B
         1
        1

        DNS Request

        3.200.250.142.in-addr.arpa

      • 8.8.8.8:53
        o.pki.goog
        dns
        Synaptics.exe
        56 B
         107 B
         1
        1

        DNS Request

        o.pki.goog

        DNS Response

        142.250.200.3

      • 8.8.8.8:53
        drive.usercontent.google.com
        dns
        Synaptics.exe
        74 B
         90 B
         1
        1

        DNS Request

        drive.usercontent.google.com

        DNS Response

        142.250.179.225

      • 8.8.8.8:53
        225.179.250.142.in-addr.arpa
        dns
        74 B
         112 B
         1
        1

        DNS Request

        225.179.250.142.in-addr.arpa

      • 8.8.8.8:53
        22.236.111.52.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        22.236.111.52.in-addr.arpa

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\Synaptics\Synaptics.exe
        Filesize

        1.2MB

        MD5

        a6b0c646c57b62e6f11baa38c5e28ef0

        SHA1

        e394f063c294ac957cb2a91288b74a399e76de4b

        SHA256

        9f0af1cf4d104abdef87173ecb3d998003fa6e1bb6bc177efc2aa8621c0a1b71

        SHA512

        9663202bddf92fb1c81086ad3d57dd1409b15c28d557c94923da2d8a1f367ba55c93023fc30f5f69addd25c8e02d0d39cbdacc2d35a18ba8d8557aba396784f6

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\._cache_9f0af1cf4d104abdef87173ecb3d998003fa6e1bb6bc177efc2aa8621c0a1b71.exe
        Filesize

        443KB

        MD5

        40918b19a89cc4dcf6ec03c7f07ccd35

        SHA1

        26ec973875e0a5b4d4bb0b3eef70a701f3b86c70

        SHA256

        f723a08340dd51b9264b6dd4b9105634b4537428bc86e1efd93af768501dd66b

        SHA512

        ce5dbdeb674cf3daabaab3779ec749f7114177dc251e79aafaee4bc46b33b453355ee2b02dc146b93b22693540da104bcb256fe4512b8933c5f8774a34f9f31b

        Download Submit

      • memory/1328-133-0x0000000000E30000-0x0000000000EA4000-memory.dmp

        Filesize

        464KB

        Download

      • memory/1328-126-0x000000007284E000-0x000000007284F000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1328-134-0x0000000005E80000-0x0000000006424000-memory.dmp

        Filesize

        5.6MB

        Download

      • memory/1328-165-0x0000000005790000-0x0000000005822000-memory.dmp

        Filesize

        584KB

        Download

      • memory/1328-166-0x0000000005970000-0x0000000005980000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1328-185-0x0000000005760000-0x000000000576A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/3336-129-0x0000000000400000-0x0000000000531000-memory.dmp

        Filesize

        1.2MB

        Download

      • memory/3336-0-0x00000000023E0000-0x00000000023E1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3496-130-0x0000000002090000-0x0000000002091000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3496-196-0x0000000002090000-0x0000000002091000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3496-197-0x0000000000400000-0x0000000000531000-memory.dmp

        Filesize

        1.2MB

        Download

      • memory/3496-222-0x0000000000400000-0x0000000000531000-memory.dmp

        Filesize

        1.2MB

        Download

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.