Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2024 08:26
Behavioral task
behavioral1
Sample
64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe
Resource
win10v2004-20241007-en
General
-
Target
64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe
-
Size
1.9MB
-
MD5
62a63a6141a5b387ed0378d9c6bc63c0
-
SHA1
d372431f87c4329227e0c6d6cb90a30da8756528
-
SHA256
64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90d
-
SHA512
5a4f1a3f3ba6fce7dad0fa219ea806d4b0a30e657c545a8c0c29d80257545c1da681dcc24d8b05c910eb9be86dd4b9eed0706cebf085bf0de1b3afa81399239f
-
SSDEEP
24576:cnsJ39LyjbJkQFMhmC+6GD9vMRGJ/qofKE:cnsHyjtk2MYC5GDH1qdE
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Floxif family
-
Xred family
-
Detects Floxif payload 1 IoCs
resource yara_rule behavioral2/files/0x000b000000023b76-73.dat floxif -
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000b000000023b76-73.dat acprotect -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation 64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation Synaptics.exe -
Executes dropped EXE 3 IoCs
pid Process 1844 ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe 4832 Synaptics.exe 1396 ._cache_Synaptics.exe -
Loads dropped DLL 4 IoCs
pid Process 1844 ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe 1396 ._cache_Synaptics.exe 1844 ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe 1844 ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Program Files\\system.caca" ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Program Files\\system.caca" ._cache_Synaptics.exe -
Enumerates connected drives 3 TTPs 12 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\i: ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe File opened (read-only) \??\g: ._cache_Synaptics.exe File opened (read-only) \??\j: ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe File opened (read-only) \??\k: ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe File opened (read-only) \??\e: ._cache_Synaptics.exe File opened (read-only) \??\h: ._cache_Synaptics.exe File opened (read-only) \??\i: ._cache_Synaptics.exe File opened (read-only) \??\e: ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe File opened (read-only) \??\g: ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe File opened (read-only) \??\h: ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe File opened (read-only) \??\j: ._cache_Synaptics.exe File opened (read-only) \??\k: ._cache_Synaptics.exe -
pid Process 3268 arp.exe 4748 arp.exe 2344 arp.exe 1372 arp.exe 4272 arp.exe 620 arp.exe 3768 arp.exe 524 arp.exe 4268 arp.exe -
resource yara_rule behavioral2/files/0x000b000000023b6d-5.dat upx behavioral2/memory/1844-37-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/files/0x000b000000023b76-73.dat upx behavioral2/memory/1844-76-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral2/memory/1396-119-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral2/memory/1396-118-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/1844-128-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/1844-129-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral2/memory/1844-131-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral2/memory/1396-132-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/1396-133-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral2/memory/1844-161-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral2/memory/1844-216-0x0000000010000000-0x0000000010033000-memory.dmp upx -
Drops file in Program Files directory 4 IoCs
description ioc Process File created \??\c:\program files\common files\system\symsrv.dll.000 ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe File created C:\Program Files\Common Files\System\symsrv.dll ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe File created C:\Program Files\system.caca ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe File created C:\Program Files\system.caca ._cache_Synaptics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Modifies registry class 13 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\cacafile\shell\open\command\ = "C:\\Program Files\\Internet Explorer\\WINLOGON.exe" ._cache_Synaptics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.caca ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.caca\ = "cacafile" ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cacafile ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cacafile\shell ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.caca\ = "cacafile" ._cache_Synaptics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cacafile\shell\open\command ._cache_Synaptics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cacafile\shell\open\command ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cacafile\shell\open ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\cacafile\shell\open\command\ = "C:\\Program Files\\Internet Explorer\\WINLOGON.exe" ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.caca ._cache_Synaptics.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2244 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1844 ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe 1844 ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe 1844 ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe 1844 ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe 1844 ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe 1844 ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1844 ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe Token: SeDebugPrivilege 1396 ._cache_Synaptics.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2244 EXCEL.EXE 2244 EXCEL.EXE 2244 EXCEL.EXE 2244 EXCEL.EXE -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 4904 wrote to memory of 1844 4904 64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe 83 PID 4904 wrote to memory of 1844 4904 64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe 83 PID 4904 wrote to memory of 1844 4904 64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe 83 PID 4904 wrote to memory of 4832 4904 64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe 84 PID 4904 wrote to memory of 4832 4904 64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe 84 PID 4904 wrote to memory of 4832 4904 64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe 84 PID 1844 wrote to memory of 4748 1844 ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe 85 PID 1844 wrote to memory of 4748 1844 ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe 85 PID 1844 wrote to memory of 4748 1844 ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe 85 PID 1844 wrote to memory of 3268 1844 ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe 87 PID 1844 wrote to memory of 3268 1844 ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe 87 PID 1844 wrote to memory of 3268 1844 ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe 87 PID 1844 wrote to memory of 524 1844 ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe 88 PID 1844 wrote to memory of 524 1844 ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe 88 PID 1844 wrote to memory of 524 1844 ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe 88 PID 1844 wrote to memory of 3768 1844 ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe 89 PID 1844 wrote to memory of 3768 1844 ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe 89 PID 1844 wrote to memory of 3768 1844 ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe 89 PID 1844 wrote to memory of 620 1844 ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe 90 PID 1844 wrote to memory of 620 1844 ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe 90 PID 1844 wrote to memory of 620 1844 ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe 90 PID 1844 wrote to memory of 4272 1844 ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe 91 PID 1844 wrote to memory of 4272 1844 ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe 91 PID 1844 wrote to memory of 4272 1844 ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe 91 PID 1844 wrote to memory of 1372 1844 ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe 92 PID 1844 wrote to memory of 1372 1844 ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe 92 PID 1844 wrote to memory of 1372 1844 ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe 92 PID 1844 wrote to memory of 4268 1844 ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe 93 PID 1844 wrote to memory of 4268 1844 ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe 93 PID 1844 wrote to memory of 4268 1844 ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe 93 PID 1844 wrote to memory of 2344 1844 ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe 94 PID 1844 wrote to memory of 2344 1844 ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe 94 PID 1844 wrote to memory of 2344 1844 ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe 94 PID 4832 wrote to memory of 1396 4832 Synaptics.exe 103 PID 4832 wrote to memory of 1396 4832 Synaptics.exe 103 PID 4832 wrote to memory of 1396 4832 Synaptics.exe 103 PID 1844 wrote to memory of 3660 1844 ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe 113 PID 1844 wrote to memory of 3660 1844 ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe 113 PID 1844 wrote to memory of 3660 1844 ._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe"C:\Users\Admin\AppData\Local\Temp\64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe"C:\Users\Admin\AppData\Local\Temp\._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\SysWOW64\arp.exearp -a3⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:4748
-
-
C:\Windows\SysWOW64\arp.exearp -s 10.127.0.1 9b-be-bd-98-b3-3c3⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:3268
-
-
C:\Windows\SysWOW64\arp.exearp -s 10.127.255.255 1e-6b-2a-1d-59-d83⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:524
-
-
C:\Windows\SysWOW64\arp.exearp -s 49.12.169.208 1f-8f-aa-f8-c3-913⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:3768
-
-
C:\Windows\SysWOW64\arp.exearp -s 224.0.0.22 5c-aa-9c-a6-95-283⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:620
-
-
C:\Windows\SysWOW64\arp.exearp -s 224.0.0.251 7f-08-9d-7b-d8-a73⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:4272
-
-
C:\Windows\SysWOW64\arp.exearp -s 224.0.0.252 98-c4-61-8a-8a-643⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:1372
-
-
C:\Windows\SysWOW64\arp.exearp -s 239.255.255.250 08-f5-77-8f-c8-1a3⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:4268
-
-
C:\Windows\SysWOW64\arp.exearp -s 255.255.255.255 09-0a-57-10-47-973⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:2344
-
-
C:\Windows\SysWOW64\arp.exearp -d3⤵
- System Location Discovery: System Language Discovery
PID:3660
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1396
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2244
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1AppInit DLLs
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1AppInit DLLs
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
71KB
MD54fcd7574537cebec8e75b4e646996643
SHA1efa59bb9050fb656b90d5d40c942fb2a304f2a8b
SHA2568ea3b17e4b783ffc0bc387b81b823bf87af0d57da74541d88ba85314bb232a5d
SHA5127f1a7ef64d332a735db82506b47d84853af870785066d29ccaf4fdeab114079a9f0db400e01ba574776a0d652a248658fe1e8f9659cdced19ad6eea09644ea3e
-
Filesize
1.9MB
MD562a63a6141a5b387ed0378d9c6bc63c0
SHA1d372431f87c4329227e0c6d6cb90a30da8756528
SHA25664a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90d
SHA5125a4f1a3f3ba6fce7dad0fa219ea806d4b0a30e657c545a8c0c29d80257545c1da681dcc24d8b05c910eb9be86dd4b9eed0706cebf085bf0de1b3afa81399239f
-
Filesize
2.0MB
MD507df30672c73d063d599cb8592ae29ba
SHA175cd93ad3b6b4da29d2e482175ea4368ce770871
SHA256e44c0f8fa68c05a20b576f1ad0dc3310a1c393c7db2769b9e169b59ebf556476
SHA5123047fa2621743b5c5993c8cb8afdc5785c6c864d77826ab9bae8838c4f6d72fc6b210fd2cadb21d495628192a71cffe39886c530686e9926ebee143323ea69c0
-
C:\Users\Admin\AppData\Local\Temp\._cache_64a511edf2e950215cc644beb0bea48d63212c1e416166e7c8c27a83ec4bf90dN.exe
Filesize1.2MB
MD56c06a994695fca714484f634106e0a30
SHA18c2c9a454ca15d3a310e44576ce72db109c12ba3
SHA2564269927cb66ec9c91b41b4c63c19c9d219b6b427a2797720f246ded873829054
SHA5128a34c358fe8d52668b5785583f2e9000dacff2f93d5446561479b9aaa2f20121578649c120ef0673cb91492a0599d2a5a99c549e4b2fffce66ed80d262bcea0c
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04