Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30-12-2024 10:23
Static task
static1
Behavioral task
behavioral1
Sample
222.msi
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
222.msi
Resource
win10v2004-20241007-en
General
-
Target
222.msi
-
Size
1.7MB
-
MD5
cf5da0ce656559358c5d06876bbbff3e
-
SHA1
166f0b46a849adeaf1d01378d0db0bb6040c9ed3
-
SHA256
0a6ba519cd28bce39d999a07d2b4dce17fdcd0a0f1ddef94158e377c40de8a26
-
SHA512
ca0f530922d8168cb633f30a5cb97874654515a0c361f20f4490f9f85beedd3f74595141b6305b755fa18796c678d2a89848a069b4471fbb5f66b5ce33343cf7
-
SSDEEP
49152:uElnsHyjtk2MYC5GD8hloJfCAh9RMUBrNUFqtBZl:hnsmtk2a1hlPERBsiT
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HBMQLS.lnk ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" MSICDF0.tmp Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HBMQLS = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windata\\EWZJGF.exe\"" ._cache_Synaptics.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe -
AutoIT Executable 16 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4320-215-0x0000000000270000-0x0000000000470000-memory.dmp autoit_exe behavioral2/memory/4320-216-0x0000000000270000-0x0000000000470000-memory.dmp autoit_exe behavioral2/memory/4320-221-0x0000000000270000-0x0000000000470000-memory.dmp autoit_exe behavioral2/memory/4320-223-0x0000000000270000-0x0000000000470000-memory.dmp autoit_exe behavioral2/memory/4320-225-0x0000000000270000-0x0000000000470000-memory.dmp autoit_exe behavioral2/memory/2020-229-0x0000000000F80000-0x0000000001180000-memory.dmp autoit_exe behavioral2/memory/4320-234-0x0000000000270000-0x0000000000470000-memory.dmp autoit_exe behavioral2/memory/4320-239-0x0000000000270000-0x0000000000470000-memory.dmp autoit_exe behavioral2/memory/4320-261-0x0000000000270000-0x0000000000470000-memory.dmp autoit_exe behavioral2/memory/4320-263-0x0000000000270000-0x0000000000470000-memory.dmp autoit_exe behavioral2/memory/4320-265-0x0000000000270000-0x0000000000470000-memory.dmp autoit_exe behavioral2/memory/464-268-0x0000000000F80000-0x0000000001180000-memory.dmp autoit_exe behavioral2/memory/4320-269-0x0000000000270000-0x0000000000470000-memory.dmp autoit_exe behavioral2/memory/4320-271-0x0000000000270000-0x0000000000470000-memory.dmp autoit_exe behavioral2/memory/4320-273-0x0000000000270000-0x0000000000470000-memory.dmp autoit_exe behavioral2/memory/4320-275-0x0000000000270000-0x0000000000470000-memory.dmp autoit_exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation MSICDF0.tmp Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation Synaptics.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\winmgmts:\localhost\root\SecurityCenter2 ._cache_Synaptics.exe File created C:\Windows\SysWOW64\._cache_MSICDF0.tmp MSICDF0.tmp File opened for modification C:\Windows\SysWOW64\._cache_MSICDF0.tmp MSICDF0.tmp File created C:\Windows\SysWOW64\._cache_Synaptics.exe Synaptics.exe File opened for modification C:\Windows\SysWOW64\._cache_Synaptics.exe Synaptics.exe -
resource yara_rule behavioral2/files/0x000e000000023b86-96.dat upx behavioral2/memory/4320-154-0x0000000000270000-0x0000000000470000-memory.dmp upx behavioral2/memory/4320-215-0x0000000000270000-0x0000000000470000-memory.dmp upx behavioral2/memory/4320-216-0x0000000000270000-0x0000000000470000-memory.dmp upx behavioral2/memory/4320-221-0x0000000000270000-0x0000000000470000-memory.dmp upx behavioral2/memory/4320-223-0x0000000000270000-0x0000000000470000-memory.dmp upx behavioral2/memory/4320-225-0x0000000000270000-0x0000000000470000-memory.dmp upx behavioral2/memory/2020-227-0x0000000000F80000-0x0000000001180000-memory.dmp upx behavioral2/memory/2020-229-0x0000000000F80000-0x0000000001180000-memory.dmp upx behavioral2/memory/4320-234-0x0000000000270000-0x0000000000470000-memory.dmp upx behavioral2/memory/4320-239-0x0000000000270000-0x0000000000470000-memory.dmp upx behavioral2/memory/4320-261-0x0000000000270000-0x0000000000470000-memory.dmp upx behavioral2/memory/4320-263-0x0000000000270000-0x0000000000470000-memory.dmp upx behavioral2/memory/4320-265-0x0000000000270000-0x0000000000470000-memory.dmp upx behavioral2/memory/464-268-0x0000000000F80000-0x0000000001180000-memory.dmp upx behavioral2/memory/4320-269-0x0000000000270000-0x0000000000470000-memory.dmp upx behavioral2/memory/4320-271-0x0000000000270000-0x0000000000470000-memory.dmp upx behavioral2/memory/4320-273-0x0000000000270000-0x0000000000470000-memory.dmp upx behavioral2/memory/4320-275-0x0000000000270000-0x0000000000470000-memory.dmp upx -
Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSICDF0.tmp msiexec.exe File created C:\Windows\Installer\e57ccc6.msi msiexec.exe File opened for modification C:\Windows\Installer\e57ccc6.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{29EF7317-DCA1-4159-97B2-C883AD400AC6} msiexec.exe File opened for modification C:\Windows\Installer\MSICDA0.tmp msiexec.exe -
Executes dropped EXE 5 IoCs
pid Process 1520 MSICDF0.tmp 2856 Synaptics.exe 4320 ._cache_Synaptics.exe 2020 EWZJGF.exe 464 EWZJGF.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3924 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WSCript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EWZJGF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EWZJGF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSICDF0.tmp -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000a47b29fbd6f9c3720000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000a47b29fb0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900a47b29fb000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1da47b29fb000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000a47b29fb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MSICDF0.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3664 schtasks.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1876 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4900 msiexec.exe 4900 msiexec.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe 4320 ._cache_Synaptics.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4320 ._cache_Synaptics.exe -
Suspicious use of AdjustPrivilegeToken 55 IoCs
description pid Process Token: SeShutdownPrivilege 3924 msiexec.exe Token: SeIncreaseQuotaPrivilege 3924 msiexec.exe Token: SeSecurityPrivilege 4900 msiexec.exe Token: SeCreateTokenPrivilege 3924 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3924 msiexec.exe Token: SeLockMemoryPrivilege 3924 msiexec.exe Token: SeIncreaseQuotaPrivilege 3924 msiexec.exe Token: SeMachineAccountPrivilege 3924 msiexec.exe Token: SeTcbPrivilege 3924 msiexec.exe Token: SeSecurityPrivilege 3924 msiexec.exe Token: SeTakeOwnershipPrivilege 3924 msiexec.exe Token: SeLoadDriverPrivilege 3924 msiexec.exe Token: SeSystemProfilePrivilege 3924 msiexec.exe Token: SeSystemtimePrivilege 3924 msiexec.exe Token: SeProfSingleProcessPrivilege 3924 msiexec.exe Token: SeIncBasePriorityPrivilege 3924 msiexec.exe Token: SeCreatePagefilePrivilege 3924 msiexec.exe Token: SeCreatePermanentPrivilege 3924 msiexec.exe Token: SeBackupPrivilege 3924 msiexec.exe Token: SeRestorePrivilege 3924 msiexec.exe Token: SeShutdownPrivilege 3924 msiexec.exe Token: SeDebugPrivilege 3924 msiexec.exe Token: SeAuditPrivilege 3924 msiexec.exe Token: SeSystemEnvironmentPrivilege 3924 msiexec.exe Token: SeChangeNotifyPrivilege 3924 msiexec.exe Token: SeRemoteShutdownPrivilege 3924 msiexec.exe Token: SeUndockPrivilege 3924 msiexec.exe Token: SeSyncAgentPrivilege 3924 msiexec.exe Token: SeEnableDelegationPrivilege 3924 msiexec.exe Token: SeManageVolumePrivilege 3924 msiexec.exe Token: SeImpersonatePrivilege 3924 msiexec.exe Token: SeCreateGlobalPrivilege 3924 msiexec.exe Token: SeBackupPrivilege 3504 vssvc.exe Token: SeRestorePrivilege 3504 vssvc.exe Token: SeAuditPrivilege 3504 vssvc.exe Token: SeBackupPrivilege 4900 msiexec.exe Token: SeRestorePrivilege 4900 msiexec.exe Token: SeRestorePrivilege 4900 msiexec.exe Token: SeTakeOwnershipPrivilege 4900 msiexec.exe Token: SeRestorePrivilege 4900 msiexec.exe Token: SeTakeOwnershipPrivilege 4900 msiexec.exe Token: SeRestorePrivilege 4900 msiexec.exe Token: SeTakeOwnershipPrivilege 4900 msiexec.exe Token: SeBackupPrivilege 2524 srtasks.exe Token: SeRestorePrivilege 2524 srtasks.exe Token: SeSecurityPrivilege 2524 srtasks.exe Token: SeTakeOwnershipPrivilege 2524 srtasks.exe Token: SeRestorePrivilege 4900 msiexec.exe Token: SeTakeOwnershipPrivilege 4900 msiexec.exe Token: SeRestorePrivilege 4900 msiexec.exe Token: SeTakeOwnershipPrivilege 4900 msiexec.exe Token: SeBackupPrivilege 2524 srtasks.exe Token: SeRestorePrivilege 2524 srtasks.exe Token: SeSecurityPrivilege 2524 srtasks.exe Token: SeTakeOwnershipPrivilege 2524 srtasks.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3924 msiexec.exe 3924 msiexec.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 1876 EXCEL.EXE 1876 EXCEL.EXE 1876 EXCEL.EXE 1876 EXCEL.EXE 1876 EXCEL.EXE 1876 EXCEL.EXE 1876 EXCEL.EXE 1876 EXCEL.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 4900 wrote to memory of 2524 4900 msiexec.exe 92 PID 4900 wrote to memory of 2524 4900 msiexec.exe 92 PID 4900 wrote to memory of 1520 4900 msiexec.exe 96 PID 4900 wrote to memory of 1520 4900 msiexec.exe 96 PID 4900 wrote to memory of 1520 4900 msiexec.exe 96 PID 1520 wrote to memory of 2856 1520 MSICDF0.tmp 98 PID 1520 wrote to memory of 2856 1520 MSICDF0.tmp 98 PID 1520 wrote to memory of 2856 1520 MSICDF0.tmp 98 PID 2856 wrote to memory of 4320 2856 Synaptics.exe 99 PID 2856 wrote to memory of 4320 2856 Synaptics.exe 99 PID 2856 wrote to memory of 4320 2856 Synaptics.exe 99 PID 4320 wrote to memory of 1896 4320 ._cache_Synaptics.exe 103 PID 4320 wrote to memory of 1896 4320 ._cache_Synaptics.exe 103 PID 4320 wrote to memory of 1896 4320 ._cache_Synaptics.exe 103 PID 4320 wrote to memory of 2756 4320 ._cache_Synaptics.exe 105 PID 4320 wrote to memory of 2756 4320 ._cache_Synaptics.exe 105 PID 4320 wrote to memory of 2756 4320 ._cache_Synaptics.exe 105 PID 1896 wrote to memory of 3664 1896 cmd.exe 106 PID 1896 wrote to memory of 3664 1896 cmd.exe 106 PID 1896 wrote to memory of 3664 1896 cmd.exe 106 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\222.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3924
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:2524
-
-
C:\Windows\Installer\MSICDF0.tmp"C:\Windows\Installer\MSICDF0.tmp"2⤵
- Adds Run key to start application
- Checks computer location settings
- Drops file in System32 directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
- Checks computer location settings
- Drops file in System32 directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\._cache_Synaptics.exe"C:\Windows\system32\._cache_Synaptics.exe" InjUpdate4⤵
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn HBMQLS.exe /tr C:\Users\Admin\AppData\Roaming\Windata\EWZJGF.exe /sc minute /mo 15⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn HBMQLS.exe /tr C:\Users\Admin\AppData\Roaming\Windata\EWZJGF.exe /sc minute /mo 16⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3664
-
-
-
C:\Windows\SysWOW64\WSCript.exeWSCript C:\Users\Admin\AppData\Local\Temp\HBMQLS.vbs5⤵
- System Location Discovery: System Language Discovery
PID:2756
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3504
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1876
-
C:\Users\Admin\AppData\Roaming\Windata\EWZJGF.exeC:\Users\Admin\AppData\Roaming\Windata\EWZJGF.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2020
-
C:\Users\Admin\AppData\Roaming\Windata\EWZJGF.exeC:\Users\Admin\AppData\Roaming\Windata\EWZJGF.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:464
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
620B
MD54f860afdbfe9a2790f4a11a85bb8e2ac
SHA14f0b8553362e7715cd482ec639ce71889342a21d
SHA256e3d62db3d2be987c3f7400752a5f2f3221d2c97b9c82db437db9e160913d6064
SHA512c878f62c6812ffefaefb4abc7a908826207e04ca217266c247b7051d9fbb44d6a33f21a50bbec1d6abd6ea161dca1a11902a23d3306cba3b207c12110f8bcd9d
-
Filesize
21KB
MD5177db14d3454fd94059fdb2a8ea5bc22
SHA1ff8525b599a0658692da64a7b418f6fb41ad5d8d
SHA256a3ac10611d2fb79f4d6de6e42821d98eb8a3a33298cd23a819bc9d4e778f46c4
SHA512d86e00ca3b24380145de6741e988a32337e6fc42caa8a79988bbca0bf692e6223e4d972889045331fcf5a117287576622a45eb15f4df48c5041584dae50d9c25
-
Filesize
840B
MD589137407cd4107effa2ff9f29a2a99ad
SHA199814ebc80118160841a2cf0f29eb578b57e4ac6
SHA256cbee270ed61982f063979c013888bb288d5db2720d2d69f86ee13263a26ffe36
SHA512d7f64023ef44e2f91195bd8950f211110f530ec751c39b4122925993e8da7c11e0c8bcd6b4286f67efb6df20cc1cde08ededbc241a8ddbde934b58a75592684b
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
1.6MB
MD571386f37f17778126296ca734975db6d
SHA1353818dcd74d06565fc0e8ac4416e594d29ecd0b
SHA256c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae
SHA512e5e0d87f91611bccfea16222c9afb7ac7b949f1762244ced01f9d8a78e2c992cfe8c1faaf1391f4cf107604a0e9f7a64fa4adda1c339d8dc85b27e7be610b83c
-
Filesize
930KB
MD536f4c5372c6391f782c2db490081746f
SHA1a0b1ec84b0a2db8f801981e247578217b71b38da
SHA2561fe023f69f42fcd4be4baa180bbff00b7ffe51c553211dd0df45fb7ff71148b8
SHA512111c1915d81141398b6bb7a0aa0e98896fb05d5548ace8fd1e0e23343eae60ea1e3d6617d3f5f883b96c8e05f5f868a280683341810896c00fa6ef1f68338992
-
Filesize
24.1MB
MD56f7cbd61e07b3f5d3b329aedacbb6b2f
SHA13308ac47a6300ec9301a762fec3daa4c6df15df1
SHA256725bfd88c1d3b5a91d87544b6cff88710e2be8b870a1b7da1ae0069ac3726e04
SHA512226865a05dd6a534208da2ca9e2193f8825bcfcadf3112e22dd054cb24e07a68a4238cdec684834f947a650003842146da89ed58225108b56628199967cd79af
-
\??\Volume{fb297ba4-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{ed15a298-850c-45b1-a6a8-452d3ed6b15a}_OnDiskSnapshotProp
Filesize6KB
MD5cba492d9ee2c8a3e65952f3679e38877
SHA13ee06751b8c329d1b617ae8631e980f3b8371a62
SHA256d5724a5a84859be3d4f0242676c9f29fc6bb8d75e33967d63a9f9624190c6258
SHA512dc41281707955b9d7f678348d91ed3ef7025efa96946924257e385c58e7a1a88ea1dc7d145b112eed8797063cc7974a0863b0890eb7898a02d048f89b0f59da0